From 78d18883c86ae4bf8427799fbd9a24b253845d8b Mon Sep 17 00:00:00 2001
From: Brandon McAnsh <git@bmcreations.dev>
Date: Thu, 20 Aug 2026 08:45:13 -0400
Subject: [PATCH] fix(deps): keep both libphonenumber artifacts on the same
 version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#1241 and #1242 were meant to land together at 9.0.36, but Dependabot rebased
#1242 onto a newer upstream release, so code/cash ended up with the Android
port at 9.0.36 and Google's artifact at 9.0.37.

That skew matters here: :shared:phone parses and formats with
io.michaelrocks:libphonenumber-android, while :services:flipcash,
:services:flipcash-compose, :services:opencode and :shared:onramp:coinbase
validate with com.googlecode.libphonenumber:libphonenumber. Each artifact
bundles its own copy of the libphonenumber metadata, so one patch of drift is
enough for the two to disagree on whether a given number is valid — a class of
bug that surfaces as an unexplained rejection for a handful of countries.

The port lags upstream (9.0.36 is its latest), so it sets the ceiling. Pins
-google back to 9.0.36 and documents the coupling in the catalog.

Also groups both artifacts in dependabot.yml so future bumps arrive as a single
PR. Grouping does not force matching versions — the port will still lag — but
it puts any skew in one diff instead of two independently mergeable PRs.

Verified with :apps:flipcash:app:assembleDebug plus the phone and encryption
unit tests.
---
 .github/dependabot.yml    | 7 +++++++
 gradle/libs.versions.toml | 7 ++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d43eeec884..85b6b2bf55 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,13 @@ updates:
   schedule:
     interval: weekly
   open-pull-requests-limit: 10
+  groups:
+    # Both libphonenumber artifacts must move together — see the note in gradle/libs.versions.toml.
+    # Grouping them into one PR makes any version skew visible in a single diff rather than in two
+    # PRs that can land independently.
+    libphonenumber:
+      patterns:
+        - "*libphonenumber*"
   labels:
     - "dependencies"
     - "type: build"
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 0dd454b9ce..aac0a44f3e 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -64,8 +64,13 @@ protobuf = "4.35.1"
 protobuf-plugin = "0.10.0"
 protovalidate-kt = "0.1.1"
 
+# These two must stay on the SAME version. `:shared:phone` parses and formats with the Android port
+# while the services modules validate with Google's artifact, and each ships its own copy of the
+# libphonenumber metadata — so a version skew means the two can disagree on whether a number is
+# valid. The port lags upstream, so it sets the ceiling: only bump `-google` once the port has
+# published a matching release.
 lib-phone-number-port = "9.0.36"
-lib-phone-number-google = "9.0.37"
+lib-phone-number-google = "9.0.36"
 zxing = "3.5.4"
 
 androidx-benchmark-macro = "1.5.0-beta01"