diff options
| author | Albin <albin@mullvad.net> | 2023-06-07 13:41:12 +0200 |
|---|---|---|
| committer | Albin <albin@mullvad.net> | 2023-06-07 13:41:12 +0200 |
| commit | a050643585ea2f0e8fcb98dfeae6b893fc023618 (patch) | |
| tree | 9e8f1d7e12548d02b7b55ed7b6033e187dec9b82 | |
| parent | fcd2fdd499fff080ec7430322a88bcbe403b8cfe (diff) | |
| parent | 7f6cb542ba1e9062ce47b2a169fbbb141f343efe (diff) | |
| download | mullvadvpn-a050643585ea2f0e8fcb98dfeae6b893fc023618.tar.xz mullvadvpn-a050643585ea2f0e8fcb98dfeae6b893fc023618.zip | |
Merge branch 'bump-dependencies-and-update-suppressions'
4 files changed, 407 insertions, 408 deletions
diff --git a/android/app/src/main/kotlin/net/mullvad/mullvadvpn/compose/theme/typeface/TypeScale.kt b/android/app/src/main/kotlin/net/mullvad/mullvadvpn/compose/theme/typeface/TypeScale.kt index eecac666f9..53116ad7e8 100644 --- a/android/app/src/main/kotlin/net/mullvad/mullvadvpn/compose/theme/typeface/TypeScale.kt +++ b/android/app/src/main/kotlin/net/mullvad/mullvadvpn/compose/theme/typeface/TypeScale.kt @@ -7,7 +7,7 @@ import androidx.compose.ui.unit.sp * * NOTE: * * Do not use these font sizes directly. Instead use the styles defined in Typeface and/or the - * standard styles in the material theme + * standard styles in the material theme * * Order entries within each type by descending size. */ internal object TypeScale { diff --git a/android/buildSrc/src/main/kotlin/Versions.kt b/android/buildSrc/src/main/kotlin/Versions.kt index dda1ffd39e..a259148dc2 100644 --- a/android/buildSrc/src/main/kotlin/Versions.kt +++ b/android/buildSrc/src/main/kotlin/Versions.kt @@ -1,39 +1,39 @@ object Versions { const val commonsValidator = "1.7" - const val jodaTime = "2.12.2" + const val jodaTime = "2.12.5" const val junit = "4.13.2" const val jvmTarget = "1.8" const val koin = "2.2.3" const val kotlin = "1.8.21" const val kotlinCompilerExtensionVersion = "1.4.7" - const val kotlinx = "1.6.4" - const val leakCanary = "2.10" - const val mockk = "1.13.3" - const val mockWebserver = "4.10.0" - const val turbine = "0.12.1" + const val kotlinx = "1.7.1" + const val leakCanary = "2.11" + const val mockk = "1.13.5" + const val mockWebserver = "4.11.0" + const val turbine = "0.13.0" object Android { const val compileSdkVersion = 33 - const val material = "1.7.0" + const val material = "1.9.0" const val minSdkVersion = 26 const val targetSdkVersion = 33 const val volley = "1.2.1" } object AndroidX { - const val appcompat = "1.5.1" + const val appcompat = "1.6.1" const val coreKtx = "1.9.0" const val constraintlayout = "2.1.4" const val coordinatorlayout = "1.2.0" - const val espresso = "3.5.0" - const val lifecycle = "2.5.1" - const val fragment = "1.5.4" - const val recyclerview = "1.2.1" + const val espresso = "3.5.1" + const val lifecycle = "2.6.1" + const val fragment = "1.5.7" + const val recyclerview = "1.3.0" const val junit = "1.1.4" const val test = "1.5.0" - const val testMonitor = "1.6.0" + const val testMonitor = "1.6.1" const val testOrchestrator = "1.4.2" - const val testRunner = "1.5.1" + const val testRunner = "1.5.2" const val uiautomator = "2.2.0" } @@ -44,7 +44,7 @@ object Versions { const val foundation = base const val material = base const val material3 = "1.0.1" - const val uiController = "0.28.0" + const val uiController = "0.30.1" const val viewModelLifecycle = "2.6.1" } @@ -52,9 +52,9 @@ object Versions { // The androidAapt plugin version must be in sync with the android plugin version. const val android = "7.4.2" const val androidAapt = "$android-8841542" - const val playPublisher = "3.7.0" - const val dependencyCheck = "7.4.4" - const val gradleVersions = "0.44.0" - const val ktfmt = "0.11.0" + const val playPublisher = "3.8.3" + const val dependencyCheck = "8.2.1" + const val gradleVersions = "0.46.0" + const val ktfmt = "0.12.0" } } diff --git a/android/config/dependency-check-suppression.xml b/android/config/dependency-check-suppression.xml index ebdce9de22..9e7d9e87a2 100644 --- a/android/config/dependency-check-suppression.xml +++ b/android/config/dependency-check-suppression.xml @@ -1,41 +1,6 @@ <?xml version="1.0" encoding="UTF-8"?> <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd"> - <suppress until="2023-06-01Z"> - <notes><![CDATA[ - This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic - checks and tracking externally. - - File name: protobuf-lite-3.0.1.jar - ]]></notes> - <packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf\-lite@.*$</packageUrl> - <cve>CVE-2021-22569</cve> - </suppress> - <suppress until="2023-06-01Z"> - <notes><![CDATA[ - This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic - checks and tracking externally. - - File name: protobuf-lite-3.0.1.jar - ]]></notes> - <packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf\-lite@.*$</packageUrl> - <cve>CVE-2022-3171</cve> - </suppress> - <suppress until="2023-06-01Z"> - <notes><![CDATA[ - This CVE affects the Apache Commons Net's FTP client that this app doesn't use. - https://www.openwall.com/lists/oss-security/2022/12/03/1 - - File names: - - commons-beanutils-1.9.4.jar - - commons-collections-3.2.2.jar - - commons-digester-2.1.jar - - commons-logging-1.2.jar - - commons-validator-1.7.jar - ]]></notes> - <packageUrl regex="true">^pkg:maven/commons\-.*/commons\-.*@.*$</packageUrl> - <cve>CVE-2021-37533</cve> - </suppress> - <suppress until="2023-06-01Z"> + <suppress until="2023-11-01Z"> <notes><![CDATA[ This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic checks and tracking externally. @@ -45,27 +10,19 @@ <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl> <cve>CVE-2020-8908</cve> </suppress> - <suppress until="2023-06-01Z"> + <suppress until="2023-09-01Z"> <notes><![CDATA[ This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic checks and tracking externally. + Fix released in: https://github.com/google/guava/releases/tag/v32.0.0 + File name: guava-28.2-android.jar ]]></notes> <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl> - <cve>CVE-2020-8908</cve> + <cve>CVE-2023-2976</cve> </suppress> - <suppress until="2023-06-01Z"> - <notes><![CDATA[ - This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic - checks and tracking externally. - - File name: jsoup-1.12.2.jar - ]]></notes> - <packageUrl regex="true">^pkg:maven/org\.jsoup/jsoup@.*$</packageUrl> - <cve>CVE-2021-37714</cve> - </suppress> - <suppress until="2023-06-01Z"> + <suppress until="2023-11-01Z"> <notes><![CDATA[ This CVE only part of the debugAndroidTestRuntimeClasspath so suppressing in automatic checks and tracking externally. @@ -74,26 +31,7 @@ ]]></notes> <packageUrl regex="true">^pkg:maven/org\.jsoup/jsoup@.*$</packageUrl> <cve>CVE-2022-36033</cve> - </suppress> - <suppress until="2023-06-01Z"> - <notes><![CDATA[ - This CVE is limited to processing of screenshots, which this app doesn't use. - https://nvd.nist.gov/vuln/detail/CVE-2021-4277 - - File name: legacy-support-core-utils-1.0.0.aar - ]]></notes> - <packageUrl regex="true">^pkg:maven/androidx\.legacy/legacy\-support\-core\-utils@.*$</packageUrl> - <cve>CVE-2021-4277</cve> - </suppress> - <suppress until="2023-06-01Z"> - <notes><![CDATA[ - This CVE is limited to processing of screenshots, which this app doesn't use. - https://nvd.nist.gov/vuln/detail/CVE-2021-4277 - - File name: leakcanary-android-utils-2.10.aar - ]]></notes> - <packageUrl regex="true">^pkg:maven/com\.squareup\.leakcanary/leakcanary\-android\-utils@.*$</packageUrl> - <cve>CVE-2021-4277</cve> + <cve>CVE-2021-37714</cve> </suppress> <suppress until="2023-11-01Z"> <notes><