From 5972d8bb6ab2369e298be0e6641d92ab8f1b2f7a Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Mon, 2 Nov 2026 12:59:30 +0100 Subject: build(deps): update JGit from 4.5.7 to 5.13.5 JGit 4.5.7 dates from 2019. 5.13 is the last line that needs only Java 8 APIs, so it works with Android's desugaring; it also fixes GHSA-3p86-9955-h393 (arbitrary file overwrite on checkout). GHSA-vrpq-qp53-qv56 (XXE in repo manifest parsing) has no 5.x fix but the app never parses repo manifests. API changes: - SshSessionFactory now requires getType(). - CheckoutCommand.setForce is deprecated; setForceRefUpdate is its documented replacement with the same meaning. JGit 5 references java.lang.management and javax.management, which Android lacks; R8 flagged them. Both paths are made unreachable rather than only silenced: - WindowCache registers JMX statistics by default; Application.onCreate now installs a WindowCacheConfig with exposeStatsViaJmx = false. - GC.gc() takes a PID lock that queries ManagementFactory and would throw NoClassDefFoundError on a device. GcOperation now runs the GC steps (packRefs, repack, prune) directly; the lock only guards against concurrent gc processes, which cannot happen in the app. Aggressive packing is dropped. The R8 -dontwarn rules and the lint baseline entries are added only for those two now-unreachable references. JGitBehaviourTest covers the operations' command chains plus the GC steps and passes on 5.13.5. It now ignores the developer's global git config, which JGit 5 reads (commit.gpgsign made test commits try to sign). Co-Authored-By: Claude Opus 5.5 --- app/proguard-rules.pro | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'app/proguard-rules.pro') diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro index 25887cac..6f354039 100644 --- a/app/proguard-rules.pro +++ b/app/proguard-rules.pro @@ -4,3 +4,9 @@ -keep class org.eclipse.jgit.internal.JGitText { *; } -keep class org.bouncycastle.jcajce.provider.** { *; } -keep class !org.bouncycastle.jce.provider.X509LDAPCertStoreSpi,org.bouncycastle.jce.provider.** { *; } + +# JGit 5 references JMX (java.lang.management, javax.management), absent on Android. Both +# paths are unreachable: WindowCache JMX stats are disabled in Application.onCreate and +# GcOperation runs the GC steps without the PID lock that queries ManagementFactory. +-dontwarn java.lang.management.** +-dontwarn javax.management.** -- cgit v1.2.3