search

firebase / firebase-android-sdk

Firebase Android SDK
https://firebase.google.com
Apache License 2.0
2.29k stars 579 forks source link

Gradle AppDistributionPlugin should upgrade its dependencies #6556

Open bmuschko opened 13 hours ago

bmuschko commented 13 hours ago

What feature would you like to see?

Some of the dependencies referenced by the plugin are pretty old. For example, it uses google-api-client 1.30.9, released 4 years ago. In turn, the dependency pulls in a very old version of jackson-core, 2.10.2, which contains a security vulnerability with "high" severity.

How would you use it?

Gradle doesn't create an isolated classloader between different plugins in a project. Therefore, Jackson core can easily conflict with other Jackson core versions in the combined plugin classpath.

google-oss-bot commented 13 hours ago

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.