search

SumSubstance / idensic-mobile-sdk-sample-android

11 stars 5 forks source link

JUnit dependency provided transitively through idensic-mobile-sdk-prooface #8

Closed midery closed 2 years ago

midery commented 2 years ago

Hello! We're found a problem when tried to analyze our application's dependencies: idensic-mobile-sdk is providing junit dependency transitively:

     +--- com.sumsub.sns:idensic-mobile-sdk-prooface:1.19.5
     |    +--- org.jetbrains.kotlin:kotlin-parcelize-runtime:1.6.20 (*)
     |    +--- com.madgag.spongycastle:prov:1.58.0.0
     |    |    +--- com.madgag.spongycastle:core:1.58.0.0
     |    |    \--- junit:junit:4.12
     |    |         \--- org.hamcrest:hamcrest-core:1.3

This leads to some problems which we discovered:

  1. Junit sources will be loaded to debug/release classpath without developers notice.
  2. LeakCanary analysis will be switched off: https://square.github.io/leakcanary/recipes/#leakcanary-test-environment-detection.

As we can see, spongycatstle library is a culprit here, and I don't see how it is using junit in main source set, so I believe dependency can be simply excluded.

Please, consider to exclude junit and hamcrest dependencies from your library to make it lighter and more consistent.

palmut commented 2 years ago

Thank you! We will fix it next release.

palmut commented 2 years ago

will be fixed in the next SDK release