chore(deps): update dependencies across the version catalog

Bumps every catalog entry that has a newer release, verified with the
JVM/Android unit test suites and the desktop Compose UI tests.

Highlights:
- Kotlin 2.4.10 -> 2.4.20 (and kotlinTest, ksp 2.3.12)
- Compose Multiplatform 1.11.1 -> 1.12.0, androidx compose BOM 2026.09.00,
  runtime-annotation 1.12.1
- coil 3.5.0 -> 3.6.2, media3 1.11.1, navigation-compose 2.10.1,
  camera 1.6.2, sqlite 2.7.1, firebase BOM 34.19.0, vico 3.3.1
- benchmark 1.5.0-rc01 -> 1.5.0 (final), kotlinx-collections-immutable 0.5.2,
  slf4j 2.0.19, spotless 8.10.2, sonarqube plugin 7.5.0.8588
- CI: actions/cache v4 -> v6 in build.yml, matching create-release.yml

Two entries needed more than a version change:

- material3 1.9.0 -> 1.12.0-alpha03. coil 3.6.2 requires Compose
  Multiplatform 1.12.0, whose foundation changed the CustomStyle.applyStyle
  signature. Every material3 release built against foundation 1.11.x (the
  stable 1.9.0, and the 1.11.0-alpha07 kodein-emoji drags in) then throws
  AbstractMethodError from OutlinedTextFieldDefaults at runtime; two desktop
  UI tests caught it. 1.12.0-alpha03 is the first release built against
  foundation 1.12.x. Android still takes androidx material3 from composeBom,
  so this ref only drives desktop/iOS.

- cachemap stays at 0.2.4. 0.3.0 makes CacheMap.entries/keys/values
  DeprecationLevel.ERROR and throws at runtime; quartz's appleMain
  LargeCache/ConcurrentHashCache read those views directly and through the
  stdlib Map operators. Porting them to the new forEach/forEachKey/
  forEachValue API needs a build on an Apple target, so it is left for a
  follow-up. Rationale recorded in the catalog.

commons/build.gradle.kts: DisableCacheInKotlinVersion.2_4_10 no longer
exists in KGP 2.4.20 (the enum keeps a sliding window on purpose, to force a
re-check each release), so the iOS ui-uikit prebuilt-cache workaround moves
to 2_4_20.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HXfvJi9QshDv9Umzp3ZYgQ

.github/workflows/build.yml

@@ -230,7 +230,7 @@ jobs:
       # well over a gigabyte on every run. Keyed on the version catalog so a Kotlin bump
       # re-populates it.
       - name: Cache Kotlin/Native toolchain
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.konan
           key: konan-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml') }}

commons/build.gradle.kts

@@ -8,13 +8,13 @@ import org.jetbrains.kotlin.gradle.plugin.mpp.TestExecutable
 // Disables the Kotlin/Native compiler cache for an iOS test binary so the
 // Compose ui-uikit klib recompiles fresh instead of linking the broken prebuilt
 // cache (see the call site in the `kotlin {}` block). The version guard makes
-// Kotlin re-surface this workaround once we move past 2.4.10, so it can be
+// Kotlin re-surface this workaround once we move past 2.4.20, so it can be
 // dropped when a newer Compose/Kotlin pairing fixes the cache. Wrapped in a
 // helper because @OptIn only applies to declarations, not bare statements.
 @OptIn(KotlinNativeCacheApi::class)
 fun TestExecutable.disableUiKitPrebuiltCache() =
     disableNativeCache(
-        DisableCacheInKotlinVersion.`2_4_10`,
+        DisableCacheInKotlinVersion.`2_4_20`,
         "Compose ui-uikit prebuilt cache references UIViewLayoutRegion (iOS 17+); " +
             "linking the iOS test binary fails under Xcode 16.4.",
     )

gradle/libs.versions.toml

@@ -5,8 +5,13 @@
 app = "1.14.0"
 appCode = "457"
 accompanistAdaptive = "0.37.3"
+# Pinned: 0.3.0 turns CacheMap.entries/keys/values into DeprecationLevel.ERROR (and
+# throws UnsupportedOperationException at runtime), which breaks quartz's appleMain
+# LargeCache/ConcurrentHashCache — they read those views directly and through the
+# stdlib Map operators (filter/map/groupBy/associate/count). Bumping needs a port to
+# the new forEach/forEachKey/forEachValue API, verified on an Apple target.
 cachemapVersion = "0.2.4"
-composeMultiplatform = "1.11.1"
+composeMultiplatform = "1.12.0"
 activityCompose = "1.13.0"
 agp = "9.4.0"
 android-compileSdk = "37"
@@ -15,17 +20,17 @@ android-targetSdk = "37"
 androidxJunit = "1.3.0"
 appcompat = "1.8.0"
 audiowaveform = "1.1.2"
-benchmark = "1.5.0-rc01"
+benchmark = "1.5.0"
 uiautomator = "2.4.0"
 biometricKtx = "1.4.0-alpha02"
-coil = "3.5.0"
-composeBom = "2026.08.00"
-composeRuntimeAnnotation = "1.12.0"
+coil = "3.6.2"
+composeBom = "2026.09.00"
+composeRuntimeAnnotation = "1.12.1"
 coreKtx = "1.19.0"
 datastore = "1.2.1"
 devWhyolegCryptography = "0.6.0"
 espressoCore = "3.7.0"
-firebaseBom = "34.18.0"
+firebaseBom = "34.19.0"
 fragmentKtx = "1.9.0"
 gms = "4.5.0"
 healthConnect = "1.1.0"
@@ -36,8 +41,8 @@ kmpTorResource = "409.5.0"
 kodeinEmoji = "2.5.0"
 junit = "4.13.2"
 kchesslib = "1.0.5"
-kotlin = "2.4.10"
-kotlinxCollectionsImmutable = "0.5.1"
+kotlin = "2.4.20"
+kotlinxCollectionsImmutable = "0.5.2"
 kotlinxCoroutinesCore = "1.11.0"
 kotlinxSerialization = "1.11.0"
 genaiProofreading = "1.0.0-beta1"
@@ -50,27 +55,32 @@ lightcompressor-enhanced = "2.2.1"
 jlatexmath = "1.5"
 markdown = "4d3b3dd173"
 highlights = "1.1.0"
-material3 = "1.9.0"
-media3 = "1.11.0"
+# JetBrains material3 must track Compose Multiplatform's foundation: CMP 1.12.0 changed
+# the CustomStyle.applyStyle signature, so the stable 1.9.0 (and the 1.11.0-alpha07 that
+# kodein-emoji pulls in) crash at runtime with AbstractMethodError in OutlinedTextField.
+# 1.12.0-alpha03 is the first release built against foundation 1.12.x. Android keeps taking
+# androidx material3 from composeBom; this ref only drives desktop/iOS.
+material3 = "1.12.0-alpha03"
+media3 = "1.11.1"
 mockk = "1.14.11"
 kotlinx-coroutines-test = "1.11.0"
 negentropyKmp = "v1.2.0"
-navigationCompose = "2.9.8"
+navigationCompose = "2.10.1"
 okhttp = "5.5.0"
 osmdroid = "6.1.20"
 runner = "1.7.0"
 secp256k1KmpJniAndroid = "0.24.0"
 schnorr256k1Kmp = "1.0.5"
 securityCryptoKtx = "1.1.0"
-slf4j = "2.0.18"
-sonarqubeGradlePlugin = "7.4.0.8496"
-spotless = "8.10.0"
+slf4j = "2.0.19"
+sonarqubeGradlePlugin = "7.5.0.8588"
+spotless = "8.10.2"
 streamWebrtcAndroid = "1.3.10"
 translate = "17.0.3"
-jetbrainsCompose = "1.11.1"
+jetbrainsCompose = "1.12.0"
 unifiedpush = "3.0.10"
 playServicesCast = "22.3.1"
-vico-charts-compose = "3.3.0"
+vico-charts-compose = "3.3.1"
 zelory = "3.0.1"
 zoomable = "2.13.0"
 composemediaplayer = "0.11.4"
@@ -84,14 +94,14 @@ webkit = "1.17.0"
 privacysandboxUi = "1.0.0-alpha17"
 windowCoreAndroid = "1.5.1"
 workRuntime = "2.11.2"
-androidxCamera = "1.6.1"
+androidxCamera = "1.6.2"
 androidxCollection = "1.6.0"
 androidxProfileinstaller = "1.4.1"
 androidxExifinterface = "1.4.2"
-kotlinTest = "2.4.10"
+kotlinTest = "2.4.20"
 core = "1.7.0"
 mavenPublish = "0.37.0"
-sqlite = "2.7.0"
+sqlite = "2.7.1"
 ktor = "3.5.2"
 fourkoma = "1.2.0"
 
@@ -102,7 +112,7 @@ fourkoma = "1.2.0"
 # publish alpha10, but -service stopped at alpha09, and all three share this
 # ref. Check every artifact before bumping, not just the main one.
 appfunctions = "1.0.0-alpha09"
-ksp = "2.3.11"
+ksp = "2.3.12"
 
 [libraries]
 abedElazizShe-video-compressor-fork = { group = "com.github.davotoula", name = "LightCompressor-enhanced", version.ref = "lightcompressor-enhanced" }