bytedance / bytedance/android-inline-hook
published AAR has an unnecessary kotlin-stdlib dependency
- Dominant language
- C
- Stars
- 2.4k
- Forks
- 410
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 2
Description
### ShadowHook Version
2.0.1 / commit 0976d6ff428e01f2cab1fbe33c934b62859776c0 (current main and dev)
### Android OS Version
All Android versions; this affects published dependency metadata.
### Android ABIs
All supported ABIs.
### Device Manufacturers and Models
Not device-specific.
### Describe the Bug
The published com.bytedance.android:shadowhook:2.0.1 POM declares org.jetbrains.kotlin:kotlin-stdlib:2.2.10 as a compile dependency even though the repository contains no Kotlin source files.
Published POM:
https://repo.maven.apache.org/maven2/com/bytedance/android/shadowhook/2.0.1/shadowhook-2.0.1.pom
Source evidence:
rg --files | rg "\.(kt|kts)$"
This produces no matches. The project uses Android Gradle Plugin 9.2.1, which enables built-in Kotlin by default. Android's official migration guide recommends setting enableKotlin = false on modules without Kotlin sources; it states that this removes both the Kotlin compile task and the automatic standard-library dependency:
https://developer.android.com/build/migrate-to-built-in-kotlin#selectively-disable
Expected: the native/Java ShadowHook AAR has no Kotlin standard-library dependency.
Actual: every consumer receives kotlin-stdlib 2.2.10 transitively at compile/runtime scope, adding an unrelated runtime library and creating avoidable version-alignment work for applications that use a different Kotlin version or no Kotlin at all.
A likely fix is to set enableKotlin = false in shadowhook/build.gradle and verify the regenerated POM and Gradle module metadata. I am filing this as issue-only because my Windows audit environment does not have the repository-required Android SDK 37, NDK 23.2.8568313, or CMake 4.1.2, so I cannot safely regenerate and compare the release metadata for a PR.
Contributor guide
Assessment
This issue has not been assessed yet.