Add Automated Dependency Vulnerability Scanning to CI

[maugauwi-hash]

Labels: enhancement, cross-platform, security, ci
Priority: Medium
Estimated Time: 1 hour

Description:
Neither android-ci.yml nor ios-ci.yml runs any dependency vulnerability scan — Android's Gradle
dependencies (Ktor, Room, WorkManager, Firebase, credentials libraries) and iOS's SPM dependencies
are never checked against known-CVE databases as part of the build.

Tasks:

• Add ./gradlew dependencyCheckAnalyze (or equivalent, e.g., GitHub's Dependabot alerts made blocking) to android-ci.yml
• Add an SPM-equivalent audit step to ios-ci.yml (e.g., swift package show-dependencies cross-checked against an advisory feed)
• Fail or warn the build on newly introduced high-severity findings

---

[smartalee]

@smartalee has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would love to work on this asap please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @smartalee to this issue.

[Ola-Olamijuwon]

@Ola-Olamijuwon has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello maintainer, can i please work on this.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ola-Olamijuwon to this issue.

[Luchistack]

@Luchistack has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi Maintainer, I would love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Luchistack to this issue.

[E-m-e-k-a]

@E-m-e-k-a has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Please assign this issue to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @E-m-e-k-a to this issue.