Document need to stick with Commons IO 2.6.

2.6 is currently working, so leave it in place. But if someone uses a new
method from commons-io, it might cause problems, in which case they would
have to downgrade to 2.5, implement desugaring, or bump minSdkVersion.

!1165

app/build.gradle

@@ -165,6 +165,7 @@ dependencies {
     implementation 'com.google.zxing:core:3.3.3' // newer version need minSdk 24 or library desugering
     implementation 'info.guardianproject.netcipher:netcipher:2.2.0-alpha'
     implementation 'info.guardianproject.panic:panic:1.0'
+    //noinspection GradleDependency -> Commons IO > 2.5 uses java.nio.file, which requires desugaring
     implementation 'commons-io:commons-io:2.6'
     implementation 'commons-net:commons-net:3.6'
     implementation 'ch.acra:acra-mail:5.9.0'

gradle/verification-metadata.xml

@@ -3651,6 +3651,11 @@
             <sha256 value="b2b5dd46cf998fa626eb6f8a1c114f6167c8d392694164e62533e5898e9b31f2" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="commons-io" name="commons-io" version="2.5">
+         <artifact name="commons-io-2.5.jar">
+            <sha256 value="a10418348d234968600ccb1d988efcbbd08716e1d96936ccc1880e7d22513474" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="commons-io" name="commons-io" version="2.6">
          <artifact name="commons-io-2.6.jar">
             <pgp value="cd5464315f0b98c77e6e8ecd9daadc1c9fcc82d0"/>