build: raise the pipeline dependency floors and take WorkManager 2.12.0

cryptography>=42.0 admitted versions with CVE-2026-69247, 69248 and 69249
(fixed in 50.0.0), and urllib3, pulled in unpinned by requests, could
resolve below 2.7.0 (CVE-2026-44431 and 44432). The floors are now
cryptography>=50.0.1 and urllib3>=2.7.0; the pipeline suites already run on
those versions here.

WorkManager 2.12.0 needs compileSdk 35 and AGP 8.6 (its AAR metadata); this
build has 36 and 8.13.2. Relocked with :app:dependencies --write-locks,
which changed only the work-runtime and work-testing entries. The full JVM
suite (1,594) passes, including every worker test. There are no
instrumented worker tests to run.

Author: SysAdminDoc

CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes to CallShield will be documented in this file.
 
 ## Unreleased
 
+- WorkManager is 2.12.0. The data pipeline now requires cryptography 50.0.1
+  and urllib3 2.7.0 or later, which fix published vulnerabilities.
 - Backups now carry the outgoing-call hold, the theme, the update check and
   the feed mirror, which a restore used to leave behind. Restoring an older
   backup leaves those four as they are. A test now fails when a new setting

app/gradle.lockfile

@@ -187,8 +187,8 @@ androidx.viewpager:viewpager:1.0.0=debugAndroidTestCompileClasspath,debugAndroid
 androidx.window:window-core-android:1.5.0=debugAndroidTestRuntimeClasspath,debugRuntimeClasspath,debugUnitTestRuntimeClasspath,releaseRuntimeClasspath,releaseUnitTestRuntimeClasspath
 androidx.window:window-core:1.5.0=debugAndroidTestRuntimeClasspath,debugRuntimeClasspath,debugUnitTestRuntimeClasspath,releaseRuntimeClasspath,releaseUnitTestRuntimeClasspath
 androidx.window:window:1.5.0=debugAndroidTestRuntimeClasspath,debugRuntimeClasspath,debugUnitTestRuntimeClasspath,releaseRuntimeClasspath,releaseUnitTestRuntimeClasspath
-androidx.work:work-runtime:2.11.2=debugAndroidTestCompileClasspath,debugCompileClasspath,debugRuntimeClasspath,debugUnitTestCompileClasspath,debugUnitTestRuntimeClasspath,releaseCompileClasspath,releaseRuntimeClasspath,releaseUnitTestCompileClasspath,releaseUnitTestRuntimeClasspath
-androidx.work:work-testing:2.11.2=debugUnitTestCompileClasspath,debugUnitTestRuntimeClasspath,releaseUnitTestCompileClasspath,releaseUnitTestRuntimeClasspath
+androidx.work:work-runtime:2.12.0=debugAndroidTestCompileClasspath,debugCompileClasspath,debugRuntimeClasspath,debugUnitTestCompileClasspath,debugUnitTestRuntimeClasspath,releaseCompileClasspath,releaseRuntimeClasspath,releaseUnitTestCompileClasspath,releaseUnitTestRuntimeClasspath
+androidx.work:work-testing:2.12.0=debugUnitTestCompileClasspath,debugUnitTestRuntimeClasspath,releaseUnitTestCompileClasspath,releaseUnitTestRuntimeClasspath
 ch.qos.logback:logback-classic:1.3.16=ktlint
 ch.qos.logback:logback-core:1.3.16=ktlint
 com.almworks.sqlite4java:sqlite4java:1.0.392=debugUnitTestCompileClasspath,debugUnitTestRuntimeClasspath,releaseUnitTestCompileClasspath,releaseUnitTestRuntimeClasspath

gradle/libs.versions.toml

@@ -18,7 +18,7 @@ room = "2.8.5"
 paging = "3.5.1"
 navigation = "2.9.8"
 datastore = "1.2.1"
-work = "2.11.2"
+work = "2.12.0"
 okhttp = "5.4.0"
 moshi = "1.15.2"
 okio = "3.18.2"

scripts/requirements.txt

@@ -1,6 +1,7 @@
 requests>=2.33.0
+urllib3>=2.7.0
 scikit-learn>=1.5.0
 numpy>=1.24.0
 idna>=3.15
 publicsuffixlist>=1.0.2.20260625
-cryptography>=42.0
+cryptography>=50.0.1