Force patched versions of vulnerable build classpath dependencies

README.md

@@ -20,7 +20,7 @@ The library is published on Maven Central, add the dependency (remember to check
 
 ```groovy
     dependencies {
-        implementation 'io.github.simonebortolin:FlowLayoutManager:1.10.2'
+        implementation 'io.github.simonebortolin:FlowLayoutManager:1.11.0'
     }
 ```
 

build.gradle

@@ -1,3 +1,21 @@
+// The Android Gradle Plugin pulls in vulnerable transitive dependencies on the build classpath:
+// force patched versions until AGP ships them itself.
+buildscript {
+    dependencies {
+        constraints {
+            classpath('org.apache.commons:commons-lang3:3.18.0') { because 'CVE-2025-48924' }
+            classpath('org.apache.commons:commons-compress:1.28.0') { because 'security fixes' }
+            classpath('org.apache.httpcomponents:httpclient:4.5.14') { because 'CVE-2020-13956' }
+            classpath('org.apache.httpcomponents:httpmime:4.5.14') { because 'aligned with httpclient' }
+            classpath('org.jdom:jdom2:2.0.6.1') { because 'CVE-2021-33813' }
+            classpath('org.bitbucket.b_c:jose4j:0.9.6') { because 'CVE-2024-29371' }
+            classpath('org.bouncycastle:bcprov-jdk18on:1.85') { because 'security fixes' }
+            classpath('org.bouncycastle:bcpkix-jdk18on:1.85') { because 'security fixes' }
+            classpath('org.bouncycastle:bcutil-jdk18on:1.85') { because 'security fixes' }
+        }
+    }
+}
+
 plugins {
     alias(libs.plugins.android.application) apply false
     alias(libs.plugins.android.library) apply false

gradle.properties

@@ -1,5 +1,5 @@
 # Version of the library and of the sample app, used by CI to tag and release.
-VERSION_NAME=1.10.2
+VERSION_NAME=1.11.0
 VERSION_CODE=22
 # Keep it as low as the dependencies allow, library and sample app share it.
 MIN_SDK=21