[EUX-1843] Document chat lifecycle hub, matrix, samples, and gateway/API touchpoints

README.md

@@ -1,8 +1,16 @@
 # android-chat-sdk-samples
+
+**What this is:** **Sample Android application(s)** for **testing and validating** the [**Kustomer Chat SDK for Android**](https://github.com/kustomer/customer-android-kotlin)—integration flows, session bootstrap over HTTP, and **PubNub** realtime in a real app shell. This repo is **not** the SDK library, not a substitute for the [Developer Portal](https://developer.kustomer.com/), and the bundled apps are **not** production-ready products as-is.
+
 A repository to hold sample apps using the Kustomer Chat SDK v2
 
-- [kotlin_chat_v2_sample](https://github.com/kustomer/android-chat-sdk-samples/tree/main/kotlin_chat_v2_sample): Sample app writen in Kotlin that highlights using the Kustomer Chat SDK.
+- [kotlin_chat_v2_sample](https://github.com/kustomer/android-chat-sdk-samples/tree/main/kotlin_chat_v2_sample): Sample app written in Kotlin that highlights using the Kustomer Chat SDK.
+
+## Chat Lifecycle
+
+Sample apps exercise the **Android chat SDK** end-to-end (HTTP + **PubNub**). Behavior and channel naming follow **chat-api**; see [pubnub.md](https://github.com/kustomer/chat-api/blob/master/pubnub.md).
 
+**See also:** [Chat ecosystem map — `CHAT_CONNECTIONS.md`](https://github.com/kustomer/chat-api/blob/master/docs/CHAT_CONNECTIONS.md) · [chat-api — Chat Lifecycle](https://github.com/kustomer/chat-api/blob/master/README.md#chat-lifecycle) · [customer-android-kotlin](https://github.com/kustomer/customer-android-kotlin)
 
 Requirements
 You need to have a Kustomer account as developer or customer to access the Kustomer Platform in order to use the sample apps. Please visit the [Kustomer website](https://kustomer.com) for more information.

kotlin_chat_v2_sample/build.gradle

@@ -1,6 +1,26 @@
+import org.gradle.util.internal.VersionNumber
+
 // Top-level build file where you can add configuration options common to all sub-projects/modules.
+// Align transitive Netty (e.g. from Android Gradle Plugin) past CVEs in 4.1.34.Final — dependency-review / GHSA.
+//
+// PR feedback: eachDependency has no details.require(). To enforce a *minimum* only, only call useVersion
+// when the requested version is missing or lower than the floor; leave newer transitives (e.g. 4.1.127) unchanged.
 buildscript {
     ext.kotlin_version = "1.9.24"
+    def nettyMin = '4.1.118.Final'
+    configurations.classpath {
+        resolutionStrategy {
+            eachDependency { details ->
+                if (details.requested.group == 'io.netty') {
+                    def cur = details.requested.version
+                    if (!cur || VersionNumber.parse(cur) < VersionNumber.parse(nettyMin)) {
+                        details.useVersion(nettyMin)
+                        details.because('Netty minimum 4.1.118.Final (CVE); newer versions left as requested')
+                    }
+                }
+            }
+        }
+    }
     repositories {
         google()
         mavenCentral()
@@ -14,6 +34,26 @@ buildscript {
     }
 }
 
+// Keep in sync with nettyMin inside buildscript {} above.
+ext.nettyMinVersion = '4.1.118.Final'
+
+subprojects { subproject ->
+    subproject.configurations.configureEach { configuration ->
+        configuration.resolutionStrategy {
+            eachDependency { details ->
+                if (details.requested.group == 'io.netty') {
+                    def cur = details.requested.version
+                    def min = rootProject.ext.nettyMinVersion
+                    if (!cur || VersionNumber.parse(cur) < VersionNumber.parse(min)) {
+                        details.useVersion(min)
+                        details.because('Netty minimum 4.1.118.Final (CVE); newer versions left as requested')
+                    }
+                }
+            }
+        }
+    }
+}
+
 allprojects {
     repositories {
         google()
@@ -23,4 +63,4 @@ allprojects {
 
 task clean(type: Delete) {
     delete rootProject.buildDir
-}
+}