From 3568339ba1858e1bed059466882ddbc6f74f1550 Mon Sep 17 00:00:00 2001 From: Jonatan Rhodin Date: Mon, 23 Sep 2024 11:05:25 +0200 Subject: [PATCH 1/2] Update agp to 8.6.1 --- android/gradle.properties | 1 - android/gradle/libs.versions.toml | 4 +- android/gradle/verification-metadata.xml | 530 +++++++++-------------- 3 files changed, 215 insertions(+), 320 deletions(-) diff --git a/android/gradle.properties b/android/gradle.properties index 324e171187d3..74c277e3a155 100644 --- a/android/gradle.properties +++ b/android/gradle.properties @@ -3,4 +3,3 @@ android.nonTransitiveRClass=false android.useAndroidX=true kotlin.code.style=official org.gradle.jvmargs=-Xmx8192M -Dkotlin.daemon.jvm.options\="-Xmx8192M" -android.experimental.lint.version = 8.4.0 diff --git a/android/gradle/libs.versions.toml b/android/gradle/libs.versions.toml index 9d5d8b2ea92f..589ef5448e26 100644 --- a/android/gradle/libs.versions.toml +++ b/android/gradle/libs.versions.toml @@ -3,8 +3,8 @@ # The android-gradle-aapt plugin version must be in sync with the android plugin version. # Required for Gradle metadata verification to work properly, see: # https://github.com/gradle/gradle/issues/19228 -android-gradle-plugin = "8.3.0" -android-gradle-aapt = "10880808" +android-gradle-plugin = "8.6.1" +android-gradle-aapt = "11315950" android-billingclient = "7.0.0" android-volley = "1.2.1" diff --git a/android/gradle/verification-metadata.xml b/android/gradle/verification-metadata.xml index b6ff9d018a7c..10b902e95f88 100644 --- a/android/gradle/verification-metadata.xml +++ b/android/gradle/verification-metadata.xml @@ -1188,14 +1188,14 @@ - - + + - - - + + + @@ -2234,13 +2234,13 @@ - - + + - - + + @@ -2254,231 +2254,162 @@ - - + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + - - - - - - - - - - - - - + + + - - - + + + - - - + + + - - - + + + - - - - - - - - - - - - - - - + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - - - - - - - - - - - - - - - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -2502,219 +2433,199 @@ - - - + + + - - - - - - - + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - - - - - + + - - - + + + - - - - - - - + + - - - + + + - - - - - - - + + - - + + - - - + + + - - + + - - + + - - - + + + - - + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - + + - - + + - - - + + + - - + + - - + + - - - + + + - - + + - - + + - - - + + + - - + + - - + + - - - + + + - - + + - - + + - - - + + + - - + + - - + + - - - + + + @@ -4570,9 +4481,9 @@ - - - + + + @@ -4580,26 +4491,11 @@ - - - - - - - - - - - - - - - From e95642136871c5027c6793b0e0f3cbfe30859bfd Mon Sep 17 00:00:00 2001 From: Jonatan Rhodin Date: Mon, 23 Sep 2024 17:13:49 +0200 Subject: [PATCH 2/2] Add suppressions for unintended CVEs --- android/build.gradle.kts | 6 ++- ...dependency-check-suppression-agp-fixes.xml | 40 +++++++++++++++++++ 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 android/config/dependency-check-suppression-agp-fixes.xml diff --git a/android/build.gradle.kts b/android/build.gradle.kts index a136aa6fd847..f62e00c87eaf 100644 --- a/android/build.gradle.kts +++ b/android/build.gradle.kts @@ -109,7 +109,11 @@ allprojects { configure { failBuildOnCVSS = 0F // All severity levels - suppressionFile = "${rootProject.projectDir}/config/dependency-check-suppression.xml" + suppressionFiles = + listOf( + "${rootProject.projectDir}/config/dependency-check-suppression.xml", + "${rootProject.projectDir}/config/dependency-check-suppression-agp-fixes.xml", + ) } configure { diff --git a/android/config/dependency-check-suppression-agp-fixes.xml b/android/config/dependency-check-suppression-agp-fixes.xml new file mode 100644 index 000000000000..9f402e1ca900 --- /dev/null +++ b/android/config/dependency-check-suppression-agp-fixes.xml @@ -0,0 +1,40 @@ + + + + + ^pkg:maven/io\.netty/.*@.*$ + CVE-2022-41881 + CVE-2023-44487 + CVE-2023-34462 + CVE-2022-24823 + CVE-2024-29025 + CVE-2022-41915 + + + + ^pkg:maven/com\.google\.protobuf/.*@.*$ + CVE-2024-7254 + CVE-2022-3171 + CVE-2022-3510 + CVE-2021-22569 + + + + ^pkg:maven/com.google.guava/guava@.*$ + CVE-2023-2976 + CVE-2020-8908 + + +