Manifest merger showing implied permissions why?

Question

I recently upgraded to android studio 3.1 and when i build out my project as a signed release the google play console tells me that there are 3 new permissions which i did not add to my manifest.

I then checked the manifest merger report and saw the following explaination:

 uses-permission#android.permission.WRITE_EXTERNAL_STORAGE
IMPLIED from /Users/me/Development/QA/android/myapp/app/src/main/AndroidManifest.xml:2:1-222:12 reason: com.google.android.gms.license has a targetSdkVersion < 4
uses-permission#android.permission.READ_PHONE_STATE
IMPLIED from /Users/me/Development/QA/android/myapp/app/src/main/AndroidManifest.xml:2:1-222:12 reason: com.google.android.gms.license has a targetSdkVersion < 4
uses-permission#android.permission.READ_EXTERNAL_STORAGE
IMPLIED from /Users/me/Development/QA/android/myapp/app/src/main/AndroidManifest.xml:2:1-222:12 reason: com.google.android.gms.license requested WRITE_EXTERNAL_STORAGE

What does this mean , why is it saying the license class has a targetSdkVersion less then 4 ?

here are my gradle dependency versions:

  firebase_version = '12.0.1'

    supportlib_version = '27.0.2'

    room_version = '1.0.0'

    espresso_version = '3.0.1'

    archLifecycleVersion = '1.1.1'

and here are my minimum sdks:

android {
compileSdkVersion 27
defaultConfig {
    minSdkVersion 16

    targetSdkVersion 27
    applicationId "com.mobile.myapp"

    multiDexEnabled true
}

compileOptions {
    sourceCompatibility JavaVersion.VERSION_1_8
    targetCompatibility JavaVersion.VERSION_1_8
}

i did check the release notes for google api and saw that firebase was updated to 12.0.1 but im already using that. My goal is i do not want these permissions if they are not needed by google. i dont want to include these permission if its just for a license file ? any ideas ? i also do not know what an implied permission is. but let me show you my actual permissions in my manifest:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
xmlns:tools="http://schemas.android.com/tools"
package="com.mobile.myapp">

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
<uses-permission android:name="android.permission.CAMERA" />

<!-- firebase analytics needs to hold a wake lock -->
<uses-permission android:name="android.permission.WAKE_LOCK" />
<!-- hotline io uses record audio dangerous permission, we will remove it here -->
<uses-permission
    android:name="android.permission.RECORD_AUDIO"
    tools:node="remove" />


<supports-screens
    android:anyDensity="true"
    android:largeScreens="true"
    android:normalScreens="true"
    android:smallScreens="true"
    android:xlargeScreens="true" />

    //...

UPDATE: here is my google play services version:

<integer name="google_play_services_version">12211000</integer>

and i have two google play services components i use here they are:

  // Analytics
        implementation "com.google.android.gms:play-services-analytics:$firebase_version"

  implementation("com.google.android.gms:play-services-auth:$firebase_version") {
        force = true
    }

WHERE firebase_version = '12.0.1' IS THE LATEST.

and here are the top level dependencies:

 dependencies {
    classpath 'com.android.tools.build:gradle:3.1.0'
    classpath 'com.google.gms:google-services:3.2.0'
    classpath 'io.fabric.tools:gradle:1.25.1'
    classpath "com.newrelic.agent.android:agent-gradle-plugin:5.+"
    classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
    // NOTE: Do not place your application dependencies here; they belong
    // in the individual module build.gradle files
}

Answer 1

The following steps rectified the issue:

update gradle wrapper to latest 4.6

then create the following dependency resolution strategy that forces all libraries to comply with latest version (at this time) of google play libraries:

subprojects {
    //todo change this to loop once
    project.configurations.all {
        resolutionStrategy.eachDependency { details ->
            if (details.requested.group == 'com.android.support'
                    && !details.requested.name.contains('multidex')) {
                details.useVersion "$supportlib_version"
            }
            else if(details.requested.group == 'com.google.android.gms'){
                details.useVersion(firebase_version) //this is critical to resolve the error
            }
        }
        resolutionStrategy {
            forcedModules = [
                    "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version",
                    "org.jetbrains.kotlin:kotlin-reflect:$kotlin_version"
            ]
        }
    }
}

Answer 2

Upgrade your Google Play Services to 12.0.1

In its release notes (https://developers.google.com/android/guides/releases) you can find the following:

Adds missing minSdkVersion in -license artifacts to prevent automatic inclusion of READ_PHONE_STATE and READ_EXTERNAL_STORAGE permissions.