appmattus / certificatetransparency

Certificate transparency for Android and JVM
Apache License 2.0
142 stars 29 forks source link

Update library to latest dependencies and resolve Okio security vulnerability #103

Closed mattmook closed 11 months ago

mattmook commented 11 months ago

Library depends on Okhttp which pulls in an older version of Okio (c3.2.0) that has a security vulnerability - to resolve this we have forced Okio to a higher version (v3.6.0). Fixes #102

All project dependencies have been updated and as part of this work the library now targets Java 11.

codecov[bot] commented 11 months ago

Codecov Report

Merging #103 (da4981a) into main (09f1e18) will decrease coverage by 0.35%. Report is 59 commits behind head on main. The diff coverage is 100.00%.

@@             Coverage Diff              @@
##               main     #103      +/-   ##
============================================
- Coverage     76.65%   76.30%   -0.35%     
+ Complexity      504      501       -3     
============================================
  Files           116      116              
  Lines          2013     2009       -4     
  Branches        314      315       +1     
============================================
- Hits           1543     1533      -10     
- Misses          334      337       +3     
- Partials        136      139       +3     
Files Coverage Δ
...parency/internal/loglist/parser/LogListVerifier.kt 80.00% <100.00%> (ø)
...ransparency/internal/serialization/Deserializer.kt 73.07% <100.00%> (ø)
...ansparency/internal/utils/asn1/bytes/ByteBuffer.kt 100.00% <100.00%> (ø)
...etransparency/internal/utils/asn1/x509/Validity.kt 91.66% <100.00%> (-1.20%) :arrow_down:

... and 3 files with indirect coverage changes