Skip to content

K2GO-358 fix(deps): raise vulnerable transitive dependency versions #601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
luisguzman-adfa merged 4 commits into from
Oct 1, 2026
Merged

K2GO-358 fix(deps): raise vulnerable transitive dependency versions #601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ca2ca2b
K2GO-358 fix(deps): raise transitive dep versions
luisguzman-adfa Sep 30, 2026
291949e
Merge branch 'main' of github.com:appdevforall/iiab-android into fix/…
luisguzman-adfa Sep 30, 2026
5d92354
K2GO-358 fix(deps): raise transitive kotlin-stdlib to 2.1.0 (Snyk)
luisguzman-adfa Sep 30, 2026
94336bc
Merge branch 'main' of github.com:appdevforall/iiab-android into fix/…
luisguzman-adfa Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions controller/app/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,6 +237,28 @@ android {
}

dependencies {
// Security (Snyk): raise vulnerable transitive versions. The app does not call these
// APIs directly, so this changes only the resolved version, not app behavior.
constraints {
implementation('org.bouncycastle:bcprov-jdk15to18:1.85') {
because 'Snyk CVE fixes; pulled transitively by libadb-android 3.1.1 (was 1.81).'
}
implementation('com.squareup.okio:okio:1.17.6') {
because 'Snyk CVE fix; transitive (was 1.17.5).'
}
implementation('org.jetbrains.kotlin:kotlin-stdlib:2.1.0') {
because 'Snyk CVE-2020-29582 (removes deprecated kotlin.io temp-file helpers); transitive via AndroidX (was 1.9.24). No Kotlin source in this module.'
}
// Keep the stdlib family in lockstep. jdk7/jdk8 are empty stubs since Kotlin
// 1.8, so this only prevents version drift; it changes no code.
implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0') {
because 'Align with kotlin-stdlib above.'
}
implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.1.0') {
because 'Align with kotlin-stdlib above.'
}
}

// ADFA-4533: GlitchTip (Sentry-compatible) crash reporting SDK.
implementation 'io.sentry:sentry-android-core:8.29.0'

Expand Down
18 changes: 17 additions & 1 deletion controller/termux-core/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,12 +114,28 @@ if (System.getProperty("os.arch") == "aarch64"
}

dependencies {
// Security (Snyk): raise the transitive Kotlin stdlib. This module has no Kotlin
// source; the stdlib arrives through AndroidX. Version-only, no behavior change.
constraints {
implementation('org.jetbrains.kotlin:kotlin-stdlib:2.1.0') {
because 'Snyk CVE-2020-29582 (removes deprecated kotlin.io temp-file helpers); transitive via AndroidX (was 1.8.22).'
}
// Keep the stdlib family in lockstep. jdk7/jdk8 are empty stubs since Kotlin
// 1.8, so this only prevents version drift; it changes no code.
implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0') {
because 'Align with kotlin-stdlib above.'
}
implementation('org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.1.0') {
because 'Align with kotlin-stdlib above.'
}
}

implementation 'androidx.appcompat:appcompat:1.7.1'
implementation 'com.google.android.material:material:1.13.0'

// --- TERMUX PATCHES ---
implementation 'com.google.guava:guava:31.1-jre'
implementation 'commons-io:commons-io:2.11.0'
implementation 'commons-io:commons-io:2.14.0' // Snyk CVE fix (was 2.11.0)

// Markdown
implementation 'io.noties.markwon:core:4.6.2'
Expand Down
Loading