diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 12:59:30 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 12:59:30 +0100 |
| commit | 5972d8bb6ab2369e298be0e6641d92ab8f1b2f7a (patch) | |
| tree | 5a3b5fe9dfaf9d88965dfb23b857d1f7fef087eb /app/lint-baseline.xml | |
| parent | d5df91b3c63ca0445035c957c2bb07dc156ec2a8 (diff) | |
| download | HardenedPass-5972d8bb6ab2369e298be0e6641d92ab8f1b2f7a.tar.gz HardenedPass-5972d8bb6ab2369e298be0e6641d92ab8f1b2f7a.zip | |
build(deps): update JGit from 4.5.7 to 5.13.5
JGit 4.5.7 dates from 2019. 5.13 is the last line that needs only Java 8
APIs, so it works with Android's desugaring; it also fixes
GHSA-3p86-9955-h393 (arbitrary file overwrite on checkout).
GHSA-vrpq-qp53-qv56 (XXE in repo manifest parsing) has no 5.x fix but
the app never parses repo manifests.
API changes:
- SshSessionFactory now requires getType().
- CheckoutCommand.setForce is deprecated; setForceRefUpdate is its
documented replacement with the same meaning.
JGit 5 references java.lang.management and javax.management, which
Android lacks; R8 flagged them. Both paths are made unreachable rather
than only silenced:
- WindowCache registers JMX statistics by default; Application.onCreate
now installs a WindowCacheConfig with exposeStatsViaJmx = false.
- GC.gc() takes a PID lock that queries ManagementFactory and would
throw NoClassDefFoundError on a device. GcOperation now runs the GC
steps (packRefs, repack, prune) directly; the lock only guards against
concurrent gc processes, which cannot happen in the app. Aggressive
packing is dropped.
The R8 -dontwarn rules and the lint baseline entries are added only for
those two now-unreachable references.
JGitBehaviourTest covers the operations' command chains plus the GC
steps and passes on 5.13.5. It now ignores the developer's global git
config, which JGit 5 reads (commit.gpgsign made test commits try to
sign).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'app/lint-baseline.xml')
| -rw-r--r-- | app/lint-baseline.xml | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/app/lint-baseline.xml b/app/lint-baseline.xml index 8feed974..d9be2a91 100644 --- a/app/lint-baseline.xml +++ b/app/lint-baseline.xml @@ -1,5 +1,5 @@ <?xml version="1.0" encoding="UTF-8"?> -<issues format="6" by="lint 8.6.0" type="baseline" client="gradle" dependencies="false" name="AGP (8.6.0)" variant="all" version="8.6.0"> +<issues format="6" by="lint 9.5.0" type="baseline" client="gradle" dependencies="false" name="AGP (9.5.0)" variant="all" version="9.5.0"> <issue id="InvalidPackage" @@ -17,9 +17,16 @@ <issue id="InvalidPackage" - message="Invalid package reference in org.eclipse.jgit:org.eclipse.jgit; not included in Android: `javax.xml.bind`. Referenced from `org.eclipse.jgit.transport.WalkEncryption.SymmetricEncryption`."> + message="Invalid package reference in org.eclipse.jgit:org.eclipse.jgit; not included in Android: `java.lang.management`. Referenced from `org.eclipse.jgit.internal.storage.file.GC.PidLock`."> <location - file="$GRADLE_USER_HOME/caches/modules-2/files-2.1/org.eclipse.jgit/org.eclipse.jgit/4.5.7.201904151645-r/e84008db495a7f48d65fb09afe53279b0df68c80/org.eclipse.jgit-4.5.7.201904151645-r.jar"/> + file="$GRADLE_USER_HOME/caches/modules-2/files-2.1/org.eclipse.jgit/org.eclipse.jgit/5.13.5.202508271544-r/166bc880beb891b201cd3216407fd4ffcd4930fd/org.eclipse.jgit-5.13.5.202508271544-r.jar"/> + </issue> + + <issue + id="InvalidPackage" + message="Invalid package reference in org.eclipse.jgit:org.eclipse.jgit; not included in Android: `javax.management`. Referenced from `org.eclipse.jgit.util.Monitoring`."> + <location + file="$GRADLE_USER_HOME/caches/modules-2/files-2.1/org.eclipse.jgit/org.eclipse.jgit/5.13.5.202508271544-r/166bc880beb891b201cd3216407fd4ffcd4930fd/org.eclipse.jgit-5.13.5.202508271544-r.jar"/> </issue> <issue |