[mattcreaser]

• PR title and description conform to Pull Request guidelines.

Issue #, if available:

Description of changes:
From AGP 9 a library's published AAR metadata carries minCompileSdk equal to its own compileSdk, where AGP 8 published 1. Comparing the metadata inside core:

build	minCompileSdk
2.42.0 (AGP 8.11.1, compileSdk 36)	1
main (AGP 9.4.1, compileSdk 37)	37

So compileSdk 37 now makes every consumer below 37 fail checkReleaseAarMetadata, and compileSdk 37 is only reachable on AGP 9. Releasing as-is would require consumers to migrate to AGP 9 — this pins compileSdk back to 36 so that migration can be its own, later release.

Only one dependency actually needs compileSdk 37: okhttp-android 5.5.0, which arrives transitively with okhttp 5.5.0 and is held here at 5.4.0 (minCompileSdk=36). Nothing else on the graph asks for more than 36, and already-released 2.42.0 ships androidx.browser 1.10.0, so compileSdk 36 / AGP 8.9.1 is the floor consumers are on today — this release raises nothing.

AGP itself stays at 9.4.1, which builds against 36 without complaint, so none of the toolchain upgrade is given back.

Dependency updates that are deferred to a follow-up release for the same reason:

• okhttp 5.5.0
• androidx.core 1.19.x, which declares minCompileSdk=37 and minAndroidGradlePluginVersion=9.1.0, so it is a hard AGP 9 requirement for consumers. 1.18.0 is the last version at 36. The other bumps grouped with it are all at 35 or below and are unaffected.

How did you test these changes?
./gradlew build covers compilation, Lint, ktlint, apiCheck, Kover and unit tests across every module. It reports the same four licensee failures as unmodified main (sqlcipher 4.19.1's license URL and a BSD-3-Clause artifact from firebase-bom 35.0.0 are not in the allowlist); everything else passes.

Verified the consumer-facing effect directly: a standalone Android library on AGP 8.11.1 at compileSdk 36, depending on every published Amplify artifact from mavenLocal and compiling against Amplify plus the Auth/API/Storage/DataStore/Analytics plugins. It fails checkReleaseAarMetadata against the compileSdk 37 artifacts and builds successfully against these. All published AARs, including the KMP foundation-android, now declare minCompileSdk=36.

Documentation update required?

• No
• Yes (Please include a PR link for the documentation update)

General Checklist

• Added Unit Tests
• Added Integration Tests
• Security oriented best practices and standards are followed (e.g. using input sanitization, principle of least privilege, etc)
• Ensure commit message has the appropriate scope (e.g fix(storage): message, feat(auth): message, chore(all): message)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.76%. Comparing base (6c98d46) to head (10c8b82).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3498      +/-   ##
==========================================
+ Coverage   57.65%   57.76%   +0.11%     
==========================================
  Files        1128     1129       +1     
  Lines       33198    33268      +70     
  Branches     4949     4961      +12     
==========================================
+ Hits        19140    19217      +77     
+ Misses      12130    12123       -7     
  Partials     1928     1928              

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.