Latest version 2.0.1 adds new android.permission.READ_PHONE_STATE to client manifest

[rolgalan]

When I was trying to update our io.arrow-kt:arrow-core from version 2.0.0 to version 2.0.1 we noticed thanks to a CI check an unexpected change in the Android Manifest file, requiring a new permission not used before by our app android.permission.READ_PHONE_STATE.

Checking into the logs we see that indeed this is coming from the Arrow dependency:

uses-permission#android.permission.READ_PHONE_STATE
IMPLIED from ..app/src/main/AndroidManifest.xml:1:1-85:12 reason: arrow.core has a targetSdkVersion < 4

I see in the latest changelog that now arrow-core is declaring an andorid compileSdk, but it is missing to declare the targetSdk. Maybe due to this reason the build process infers a default 0 value, producing this behaviour in the merged manifest in the client apps. I believe that a possible solution for this bug would be to specify a targetSdk.

android {
  namespace = "arrow.core"
  compileSdk = libs.versions.android.compileSdk.get().toInt()
}

[nomisRev]

Hey @rolgalan,

Thank you for the bug report! That is quite concerning. Looking at the Android Dev docs, it seems to say that to prepare your library for release you should set a minSdk.

cc\ @serras

[serras]

I'm actually looking at this; the solution to this specific problem is to set the minSdk to at least 4, but I'm a bit concerned about any potential side effect of this. My current plan is to change minTargetSdk to be 21, which is the version released 10 years ago.

[nomisRev]

I think we can safely try setting to minSdk to 21, it's needed for Compose and pretty much everything modern on Android. If minSdk 4 doesn't cause a conflict, then I'm fine with 4 as well. We don't use anything from the SDK so should be fine.