From 9875d660c9bd80fe3943f835f7bf407ff4c098b8 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 25 Oct 2026 21:30:14 +0000 Subject: [PATCH 1/2] Force patched versions of vulnerable build classpath dependencies The Android Gradle Plugin brings in vulnerable transitive dependencies (commons-lang3, httpclient, jdom2, jose4j, commons-compress, Bouncy Castle) reported by Dependabot: pin patched versions with buildscript constraints. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0178vjPYCurDqWnpvkLsVmZ1 --- build.gradle | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/build.gradle b/build.gradle index 9c5ba57..c1f3fd9 100644 --- a/build.gradle +++ b/build.gradle @@ -1,3 +1,21 @@ +// The Android Gradle Plugin pulls in vulnerable transitive dependencies on the build classpath: +// force patched versions until AGP ships them itself. +buildscript { + dependencies { + constraints { + classpath('org.apache.commons:commons-lang3:3.18.0') { because 'CVE-2025-48924' } + classpath('org.apache.commons:commons-compress:1.28.0') { because 'security fixes' } + classpath('org.apache.httpcomponents:httpclient:4.5.14') { because 'CVE-2020-13956' } + classpath('org.apache.httpcomponents:httpmime:4.5.14') { because 'aligned with httpclient' } + classpath('org.jdom:jdom2:2.0.6.1') { because 'CVE-2021-33813' } + classpath('org.bitbucket.b_c:jose4j:0.9.6') { because 'CVE-2024-29371' } + classpath('org.bouncycastle:bcprov-jdk18on:1.85') { because 'security fixes' } + classpath('org.bouncycastle:bcpkix-jdk18on:1.85') { because 'security fixes' } + classpath('org.bouncycastle:bcutil-jdk18on:1.85') { because 'security fixes' } + } + } +} + plugins { alias(libs.plugins.android.application) apply false alias(libs.plugins.android.library) apply false From ef1544ae298fbaa17c3a6d7ac0d9f5fc737878a4 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 25 Oct 2026 21:34:02 +0000 Subject: [PATCH 2/2] Bump version to 1.11.0 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0178vjPYCurDqWnpvkLsVmZ1 --- README.md | 2 +- gradle.properties | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 87e8084..6494908 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ The library is published on Maven Central, add the dependency (remember to check ```groovy dependencies { - implementation 'io.github.simonebortolin:FlowLayoutManager:1.10.2' + implementation 'io.github.simonebortolin:FlowLayoutManager:1.11.0' } ``` diff --git a/gradle.properties b/gradle.properties index e8dccd2..9e328e9 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,5 +1,5 @@ # Version of the library and of the sample app, used by CI to tag and release. -VERSION_NAME=1.10.2 +VERSION_NAME=1.11.0 VERSION_CODE=22 # Keep it as low as the dependencies allow, library and sample app share it. MIN_SDK=21