[jamesnrokt]

Why

Dependabot keeps reopening dependency updates that the team has already closed on purpose, because they would break apps that use the SDK or need a planned build migration. The same updates have been closed three times since 12 October and come back each day. Once this lands, Dependabot stops proposing those updates, and patch-level updates to the same dependencies still arrive.

Programme

Standalone change, no programme.

What changes

Before: closing a grouped Dependabot pull request records nothing, so Kotlin 2.4, Gradle 9 and android-media 1.7 updates reopen daily. After: .github/dependabot.yml ignores minor and major updates for Kotlin (org.jetbrains.kotlin:*, org.jetbrains.kotlin.* and the jvm plugin) and com.mparticle:android-media, and major updates for gradle-wrapper. Moving to any of these becomes a deliberate change; delete the matching rule when that work starts.

Linked work

Related: #940, #941, #942, #945, #946, #947, #948, #949 — the updates closed today that this stops from reopening.

Rollout

Nothing changes in production; if this is wrong, revert the pull request.

Risks

• A security fix ships only in a newer Kotlin or android-media minor; patch updates still flow and GitHub security alerts are separate from these rules; we would see a Dependabot security alert.
• The jvm name does not match the build-logic Kotlin plugin; it is the name Dependabot itself uses in those pull requests; we would see a bump jvm pull request reappear.

Risk class: low.

Who

Written by: an automated coding agent, at a maintainer's request.
Code reviewed before opening: an automated review agent read the change before commit.
Design reviewed before opening: no one.
Decision this implements: the maintainer's triage of open Dependabot pull requests on 19 October 2026.
Checked: the file parses as YAML; dependency names match those in the closed pull requests.
Not checked: Dependabot's behaviour after merge, which shows only on its next scheduled run.

Size

Hand-written: 14 lines in 1 file.
Generated: none.

[github-actions]

Kotlin migration progress

No change to the Java left to convert.

Module	Kotlin LOC	Java LOC	Java staying (facade)	Java left to convert	Kotlin share
android-core	3,249	22,690	9,716	12,974	12.5%
android-kit-base	601	5,405	1,651	3,754	10.0%
Total	3,850	28,095	11,367	16,728	12.1%

Conversion progress: 0.0% (16,728 of 16,550 baseline Java LOC left to convert). 132 Java files and 36 Kotlin files in scope.

[github-actions]

Binary compatibility

• ✅ android-core is compatible with 6.1.9 (115 classes compared, 0 with additions only).
• ✅ android-kit-base is compatible with 6.1.9 (44 classes compared, 0 with additions only).

Compares the release AAR against the same artifact at the last version published to Maven Central; R8-renamed classes and members are excluded (see the script docstring). Full japicmp HTML/XML reports are attached as the api-compat-reports workflow artifact. This check is not in the required-check set yet, so a red result here does not block merging.

[github-actions]

📦 SDK Size Impact Report

What the SDK adds to a minified release APK.

mParticle Core SDK

Measured against an empty baseline app. Unlike the Rokt kit, android-core ships no Compose and no resources, so there is nothing here that a host app would already provide.

Metric	Target branch	This PR	Change
APK size	120.63 KB	120.63 KB	-6 bytes
Download size	118.45 KB	118.45 KB	-2 bytes
Dex bytes	215.25 KB	215.25 KB	0 bytes

mParticle Core + Rokt kit

Measured against a Compose + Material3 reference app, so these are the costs on top of an app that already ships Compose. The reference app's dependencies are a documented convention, not a measured average: see size-report-rokt/README.md.

Metric	Target branch	This PR	Change
APK size	1.26 MB	1.26 MB	0 bytes
Download size	1.25 MB	1.25 MB	-4 bytes
Dex bytes	2.23 MB	2.23 MB	0 bytes

Rokt SDK+ umbrella (adds the payment extension)

Metric	Target branch	This PR	Change	On top of mParticle Core + Rokt kit
APK size	6.55 MB	6.55 MB	0 bytes	+5.29 MB
Download size	6.43 MB	6.43 MB	-1 bytes	+5.19 MB
Dex bytes	7.12 MB	7.12 MB	0 bytes	+4.88 MB

➡️ SDK size impact change is minimal.

Raw measurements

core, Target branch:

{"baseline_dex_bytes": 0, "baseline_download_bytes": 2513, "baseline_install_bytes": 7529, "core_dex_bytes": 220412, "core_download_bytes": 123804, "core_install_bytes": 131057}

core, This PR:

{"baseline_dex_bytes": 0, "baseline_download_bytes": 2511, "baseline_install_bytes": 7528, "core_dex_bytes": 220412, "core_download_bytes": 123800, "core_install_bytes": 131050}

rokt, Target branch:

{"baseline_dex_bytes": 1829108, "baseline_download_bytes": 1240062, "baseline_install_bytes": 1300934, "kit_dex_bytes": 4170020, "kit_download_bytes": 2548124, "kit_install_bytes": 2623275, "sdkplus_dex_bytes": 9291568, "sdkplus_download_bytes": 7985700, "sdkplus_install_bytes": 8165359}

rokt, This PR:

{"baseline_dex_bytes": 1829108, "baseline_download_bytes": 1240062, "baseline_install_bytes": 1300934, "kit_dex_bytes": 4170020, "kit_download_bytes": 2548120, "kit_install_bytes": 2623275, "sdkplus_dex_bytes": 9291568, "sdkplus_download_bytes": 7985699, "sdkplus_install_bytes": 8165359}

_{Measured 430526c merged into 3fb1b63}