Repository navigation
chore(deps): fix vulnerable test and build dependencies, submit the Gradle dependency graph - #125
Merged
Merged
Conversation
This was referenced Nov 3, 2026
…radle dependency graph - logback-classic 1.5.16 -> 1.5.38 (CVE-2025-11226, CVE-2026-1225, CVE-2026-9828, CVE-2026-10532) - mockwebserver 4.11.0 -> 4.12.0: okio 3.6.0 (CVE-2023-3635), junit 4.13.2 (CVE-2020-15250) - drop the unused shadow 5.2.0 plugin and its log4j 2.11, ant 1.9.7, jdom2, plexus-utils and commons-io 2.6 build classpath; JitPack publishes the plain jar - submit the Gradle dependency graph on pushes to master so Dependabot alerts see Gradle dependencies at all Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pashidlos
force-pushed
the
chore/deps-security
branch
from
November 3, 2026 06:50
5ab124e to
c30e6fb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #124. Merge #124 first; GitHub then retargets this PR to
master. No CI shows here yet: master'sgradle.ymlonly runs for PRs intomaster. The requiredbuildcheck will run after the retarget. Until then:./gradlew checkon JDK 11 passes locally, and so does a JitPack build of this commit.Why Dependabot showed 0 alerts: GitHub's dependency graph for this repo lists no Gradle packages at all, only Actions. Dependabot couldn't see any of our Gradle dependencies. I resolved the real trees (
dependencies+buildEnvironmenton Gradle 6.1 / JDK 11) and checked every coordinate against OSV.The runtime dependencies (
gson 2.9.0,slf4j-api 1.7.25) were already clean. The published POM is unchanged, so this needs no release.Changes:
logback-classic1.5.16 → 1.5.38 (test): CVE-2025-11226, CVE-2026-1225, CVE-2026-9828, CVE-2026-10532.mockwebserver4.11.0 → 4.12.0 (test): okio 3.6.0 (CVE-2023-3635), junit 4.13.2 (CVE-2020-15250). Gradle 6.1 picks the sources variant of okio's Kotlin multiplatform module, so resolvable configurations now requestCategory=library. Gradle 9 in build!: Gradle 9, Java 25, current dependencies and CI #122 doesn't need this and drops it.shadow5.2.0 plugin, which this build never used. It put log4j-core 2.11.0 (Log4Shell), ant 1.9.7, jdom2 2.0.6, plexus-utils 3.0.24 and commons-io 2.6 on the build classpath. JitPack publishes the plain jar either way: its 5.6.0 log shows onlyjar→publishToMavenLocal.dependency-submission.yml(gradle/actions/dependency-submission@v6): submits the Gradle dependency graph on pushes to master that touch build files, so Dependabot alerts cover Gradle dependencies from now on. It was tested on this branch with a temporary trigger. The snapshot was accepted and the run passed on Gradle 6.1.Checked:
./gradlew checkon JDK 11 (63 tests). A JitPack build of this commit succeeded, and its POM matches 5.6.0's (gson 2.9.0, slf4j-api 1.7.25).🤖 Generated with Claude Code