fix(ci): re-add Kotlin to CodeQL (#32); bump Flutter 3.44.5 + supabase_flutter 2.16.0 (#85)

CodeQL CLI 2.26.0 / codeql-bundle-v2.26.0 (published 2026-07-08) ships the
Kotlin 2.4.0 support merged in github/codeql#21970, so codeql-action@v4 no
longer aborts with "Kotlin version 2.4.0 is too recent". Re-add the
java-kotlin matrix entry (build-mode manual: setup-java temurin 17 +
flutter build apk --debug, checkout with LFS for the libdovi AAR) and
refresh the header comment to document the >= v2.26.0 bundle requirement.

Also bump the Flutter pin 3.44.4 -> 3.44.5 across build/codeql/release
workflows and upgrade supabase_flutter 2.15.4 -> 2.16.0 (supabase 2.14.0,
gotrue 2.26.0, realtime_client 2.11.0, passkeys_platform_interface 2.8.0).

flutter analyze clean; flutter test 141/141 pass.

Closes #32


Claude-Session: https://claude.ai/code/session_01Pf76uZnruw81CCGZo1pQFo

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: GCHOfficial

.github/workflows/build.yml

@@ -17,7 +17,7 @@ permissions:
   contents: read
 
 env:
-  FLUTTER_VERSION: 3.44.4
+  FLUTTER_VERSION: 3.44.5
 
 jobs:
   # Fast gate: static analysis + the pure-logic / persistence unit tests. Always

.github/workflows/codeql.yml

@@ -9,22 +9,22 @@ on:
     - cron: '23 5 * * 1' # weekly, Monday 05:23 UTC
 
 # CodeQL doesn't support Dart (the bulk of lib/), so this covers the native code
-# it can: the Windows-runner C++ (GDI overlay, HDR badges) and the workflow YAML.
+# it can: the Windows-runner C++ (GDI overlay, HDR badges), the Android Kotlin
+# (native HDR player / preview engine), and the workflow YAML.
+#
+# java-kotlin needs a CodeQL CLI that accepts the app's Kotlin (2.4.0). That
+# landed in CLI 2.26.0 / codeql-bundle-v2.26.0 (github/codeql#21970) — earlier
+# CLIs aborted with "Kotlin version 2.4.0 is too recent". The pinned
+# codeql-action major (@v4) must therefore resolve to a bundle >= v2.26.0.
 #
 # Not covered:
-#   - java-kotlin (the Android player/HDR code): the app is on Kotlin 2.4.0, and
-#     the latest released CodeQL CLI (2.25.6) still caps at < 2.3.30 ("Kotlin
-#     version 2.4.0 is too recent"). Support is merged upstream
-#     (github/codeql#21970) but not yet in a CLI release. Re-add a
-#     `{language: java-kotlin, build-mode: manual}` entry (with setup-java +
-#     `flutter build apk` + `lfs: true`) once a CLI past 2.25.6 ships it.
 #   - javascript-typescript: web/ is only Flutter's generated bootstrap (no source).
 #   - swift: the iOS/macOS shells are Flutter template code (no first-party logic).
 permissions:
   contents: read
 
 env:
-  FLUTTER_VERSION: 3.44.4
+  FLUTTER_VERSION: 3.44.5
 
 jobs:
   analyze:
@@ -42,33 +42,54 @@ jobs:
           - language: c-cpp
             build-mode: manual
             runner: windows-latest
+          - language: java-kotlin
+            build-mode: manual
+            runner: ubuntu-latest
           - language: actions
             build-mode: none
             runner: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          # The Android build links the libdovi libmpv AAR, which lives in Git LFS
+          # (android/app/libs/libmpv-dovi.aar); other languages don't need it.
+          lfs: ${{ matrix.language == 'java-kotlin' }}
 
       - uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
-      # C++ is Flutter-driven, so CodeQL's autobuild can't build it — run the real
-      # Flutter build under build-mode manual so the tracer sees the compiler.
+      # Both native builds are Flutter-driven, so CodeQL's autobuild can't build
+      # them — run the real Flutter build under build-mode manual so the tracer
+      # sees the compiler.
       - if: matrix.build-mode == 'manual'
         uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
           channel: stable
           cache: true
 
+      - name: Set up JDK
+        if: matrix.language == 'java-kotlin'
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+
       - name: Build Windows (C++)
         if: matrix.language == 'c-cpp'
         run: |
           flutter config --enable-windows-desktop
           flutter pub get
           flutter build windows --debug
 
+      - name: Build Android (Kotlin)
+        if: matrix.language == 'java-kotlin'
+        run: |
+          flutter pub get
+          flutter build apk --debug
+
       - uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -16,7 +16,7 @@ permissions:
   contents: write
 
 env:
-  FLUTTER_VERSION: 3.44.4
+  FLUTTER_VERSION: 3.44.5
 
 jobs:
   # Resolve the version string once (tag minus the leading `v`, or the manual input).

pubspec.lock

@@ -332,10 +332,10 @@ packages:
     dependency: transitive
     description:
       name: gotrue
-      sha256: ac6b664b35304aece2034c66bc09ce761f9f7c8fb6066bbb6b2932aa87d82653
+      sha256: "360bba9606e58d5acc59a033ab64ae3cf571a6868f7a7267cb8e9a204b7bf1b2"
       url: "https://pub.dev"
     source: hosted
-    version: "2.25.0"
+    version: "2.26.0"
   gtk:
     dependency: transitive
     description:
@@ -596,10 +596,10 @@ packages:
     dependency: transitive
     description:
       name: passkeys_platform_interface
-      sha256: "56dd98bbe45d79de87e8683d25741b2f61743542a39a85207b0a5b4bccff600e"
+      sha256: "9610bd136b3382500390912ddd8517ee99505228b1af7b507b9c907f7e99a47d"
       url: "https://pub.dev"
     source: hosted
-    version: "2.7.0"
+    version: "2.8.0"
   path:
     dependency: "direct main"
     description:
@@ -716,10 +716,10 @@ packages:
     dependency: transitive
     description:
       name: realtime_client
-      sha256: cf816d406248a6286bf7aa2053b406583ff88bd0842ab7f3f3127d53f6f1c68b
+      sha256: "0cfbe0047e2591eba348938e9b4e620d5b1a8df6c374757e8eb8645252b8387f"
       url: "https://pub.dev"
     source: hosted
-    version: "2.10.0"
+    version: "2.11.0"
   record_use:
     dependency: transitive
     description:
@@ -921,18 +921,18 @@ packages:
     dependency: transitive
     description:
       name: supabase
-      sha256: "6933e60614652fa10749eb29fdcc6f2adb6515f5638e5ce28376ae08a626d745"
+      sha256: "3879996256325fcc9abb03b62b12c07e4eaae2e008e1bf043cc1525184159a43"
       url: "https://pub.dev"
     source: hosted
-    version: "2.13.4"
+    version: "2.14.0"
   supabase_flutter:
     dependency: "direct main"
     description:
       name: supabase_flutter
-      sha256: b6d34558565c14f1b44ff7bc9ca2979ed38ee2907b80ed73e699150cec08b739
+      sha256: c9916c1cd512ebf3107ec0f83c9dca13d2e1e789629c2a5df896586bff46ce5f
       url: "https://pub.dev"
     source: hosted
-    version: "2.15.4"
+    version: "2.16.0"
   synchronized:
     dependency: transitive
     description: