Resolve androidx.navigation.safeargs.kotlin in root module

[wzieba]

Fixes

• https://github.com/woocommerce/woocommerce-android/security/dependabot/48
• https://github.com/woocommerce/woocommerce-android/security/dependabot/45
• https://github.com/woocommerce/woocommerce-android/security/dependabot/42
• https://github.com/woocommerce/woocommerce-android/security/dependabot/53
• https://github.com/woocommerce/woocommerce-android/security/dependabot/54

Description

This PR moves resolving of androidx.navigation.safeargs.kotlin plugin to the root module.

This way, androidx.navigation.safeargs.kotlin applied in WooCommerce module isn't resolved in isolation, causing resolution in module-specific classpath.

In this particular example, applying this plugin in WooCommerce caused protobuf-java in version 3.17.2 to be applied. This dependency is already on classpath on root module in version 3.22.3 so resolving safeargs in root module classpath will bump protobuf to higher version.

Testing information

Not necessary: 🟢 from CI checks should be just fine.

• I have considered adding unit tests for this change. If I decided not to add them, I have provided a brief explanation below (optional):
• I have considered if this change warrants release notes and have added them to RELEASE-NOTES.txt if necessary. Use the "[Internal]" label for non-user-facing changes.

[wpmobilebot]

📲 You can test the changes from this Pull Request in WooCommerce-Wear Android by scanning the QR code below to install the corresponding build.

	App Name	WooCommerce-Wear Android
	Platform	⌚️ Wear OS
	Flavor	Jalapeno
	Build Type	Debug
	Commit	997e8c2
	Direct Download	woocommerce-wear-prototype-build-pr12337-997e8c2.apk

[wpmobilebot]

📲 You can test the changes from this Pull Request in WooCommerce Android by scanning the QR code below to install the corresponding build.

	App Name	WooCommerce Android
	Platform	📱 Mobile
	Flavor	Jalapeno
	Build Type	Debug
	Commit	997e8c2
	Direct Download	woocommerce-prototype-build-pr12337-997e8c2.apk

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 40.01%. Comparing base (ecca3e7) to head (997e8c2).
Report is 106 commits behind head on trunk.

Additional details and impacted files

@@             Coverage Diff              @@
##              trunk   #12337      +/-   ##
============================================
- Coverage     40.01%   40.01%   -0.01%     
+ Complexity     5598     5597       -1     
============================================
  Files          1219     1219              
  Lines         69355    69355              
  Branches       9525     9525              
============================================
- Hits          27752    27751       -1     
  Misses        39073    39073              
- Partials       2530     2531       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ParaskP7]

👋 @wzieba !

I have reviewed this PR as per the instructions, everything LGTM, great job in figuring this out! 🌟 x 🌟 ^ 🌟

---

Btw, I tried testing it a bit too, just to make sure I see what you see as well, is that what you see when comparing the builds? 🤔

BEFORE

AFTER

---

Also, for those 2 security issues below:

• https://github.com/woocommerce/woocommerce-android/security/dependabot/53
• https://github.com/woocommerce/woocommerce-android/security/dependabot/54

Both are suggesting to updade to 1.53.0 or later, but we are anyway at least above 3.17.2, even before that change, what am I missing... 🤔

[wzieba]

Both are suggesting to updade to 1.53.0 or later, but we are anyway at least above 3.17.2, even before that change, what am I missing... 🤔

The two alerts you linked are about io.grpc:grpc-protobuf dependency, which is a transitive dependency for protobuf-java. I hope this clarifies things!

[ParaskP7]

The two alerts you linked are about io.grpc:grpc-protobuf dependency, which is a transitive dependency for protobuf-java. I hope this clarifies things!

Ah, true, thanks for clarifying this for me! 🫣