Using git bisect, I tracked down which commit in my project was causing the READ_PHONE_STATE permission to be implicitly added (ie, the permission is not in my manifest, but appears in the Play Store). In the commit, I extend an adapter with the EndlessAdapter library. I added the library via gradle:
compile "com.commonsware.cwac:endless:1.2.3"
According to the docs, if min and target sdk are set to 3 or lower, this permission is granted implicitly. This doesn't seem to be the issue with this library, however, as its min sdk is set to 4.
However, it is dependent on the CWAC-AdapterWrapper class and specifically v1.0.1. CWAC-Adapter-v1.0.1's compileSdkVersion is set to 4, but no minSdkVersion is set. However, v1.0.3 has minSdkVersion set to 4 in its manifest.
Is this the root of the issue? That the minSdkVersion needs to be set to 4 for this CWAC-Adapter class or rather, that EndlessAdapter should point to CWAC-Adapter-v1.0.3? If so, how can I make this change while keeping the library in gradle?