fix: bump Gson to 2.14.0 to bundle its R8/ProGuard rules

[solevic]

Changes

Bumps Gson from 2.8.9 to 2.14.0.

Gson versions below 2.11.0 do not ship consumer ProGuard/R8 rules. With R8 full mode (the default since AGP 8), the generic signature of the anonymous TypeToken subclass used by JWTParser is stripped in minified builds, and constructing a JWT crashes at runtime with:

java.lang.RuntimeException: Missing type parameter.

Since 2.11.0, Gson bundles the required keep rules in its artifact (META-INF/proguard/gson.pro), so consuming apps get them automatically and no longer need to copy them into their own ProGuard configuration. This resolves the request in #72 the way the R8 team recommended there (#72 (comment)): upgrading Gson rather than duplicating its rules as consumer rules in this library.

No public API changes.

Note on minimum Android API level: Gson 2.11.0+ requires API level 21 (and 2.15.0+ requires 24, which is why this PR targets 2.14.0 — the newest release still supporting 21). This library currently declares minSdkVersion 15, so the effective minimum for consumers becomes API 21. Since the R8 rules were introduced in the same Gson release that raised the requirement, any version that fixes this crash implies API 21+. Happy to also bump the declared minSdkVersion to 21 in this PR if you prefer it explicit.

References

• Closes Include proguard consumer directives for R8 compatibility #72
• Fixes the crash reported in Gson R8 proguard rules (java.lang.runtimeexception: missing type parameter.) #79 and When minifyEnabled is set to true, android app crashes moment user logs in. Using different build type than release. #56
• Gson started bundling shrinker rules in 2.11.0: https://github.com/google/gson/releases/tag/gson-parent-2.11.0
• Gson Android API level requirements: https://github.com/google/gson#requirements

Testing

• ./gradlew :jwtdecode:testDebugUnitTest passes: 93 tests, 0 failures, 0 skipped.

• Verified in a consuming app: a minified (R8 full mode) release build crashed with "Missing type parameter." when decoding an ID token on Gson 2.8.9 without manual keep rules, and works with Gson 2.11+ rules present.

• This change adds test coverage — dependency bump only; the existing suite covers the affected paths

• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors

[pmathew92]

Hi @solevic , thanks for raising this PR. We will review and get back on this

[solevic]

It seems I missed that the latest 2.1.0 release removed TypeToken entirely, which voids the purpose of this PR. Sorry about that.