Update dependency com.google.code.gson:gson to v2.8.9 [SECURITY] #99
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.3.1
->2.8.9
GitHub Vulnerability Alerts
CVE-2022-25647
The package
com.google.code.gson:gson
before 2.8.9 is vulnerable to Deserialization of Untrusted Data via thewriteReplace()
method in internal classes, which may lead to denial of service attacks.Release Notes
google/gson (com.google.code.gson:gson)
v2.8.9
sun.misc
optional (https://github.com/google/gson/pull/1993).Gson.excluder()
exposing internalExcluder
class (https://github.com/google/gson/pull/1986).RuntimeTypeAdapterFactory
depending on internalStreams
class (https://github.com/google/gson/pull/1959).java.sql
optional (https://github.com/google/gson/pull/1707).v2.8.8
Unsafe
if there is a security manager (https://github.com/google/gson/pull/1712).EnumTypeAdapter
now works better when ProGuard has obfuscated enum fields (https://github.com/google/gson/pull/1495).v2.8.7
ISO8601UtilsTest
failing on systems with UTC+X.JsonStreamParser
.IllegalStateException
inJsonTreeWriter
(https://github.com/google/gson/issues/1592).JsonArray.isEmpty()
(https://github.com/google/gson/pull/1640).v2.8.6
2019-10-04 GitHub Diff
JsonParser.parseString
andJsonParser.parseReader
and deprecated instance methodJsonParser.parse
v2.8.5
2018-05-21 GitHub Diff
utils.VersionUtils
class tointernal.JavaVersion
. This is a potential backward incompatible change from 2.8.4v2.8.4
2018-05-01 GitHub Diff
LOWER_CASE_WITH_DOTS
that mapps JSON namesomeFieldName
tosome.field.name
sun.misc.Unsafe
v2.8.3
2018-04-27 GitHub Diff
GsonBuilder.newBuilder()
that clones the current builderv2.8.2
2017-09-19 GitHub Diff
JsonElement.deepCopy()
v2.8.1
2017-05-30 GitHub Diff
JsonObject.keySet()
@JsonAdapter
annotation can now useJsonSerializer
andJsonDeserializer
as well.v2.7
2016-06-14 GitHub Diff
v2.6.2
2016-02-26 GitHub Diff
v2.6.1
2016-02-11 GitHub Diff
2.6.1 release is identical to 2.6, but it targets Java 1.6.
v2.6
2016-02-26 GitHub Diff
v2.5
2015-11-24 GitHub Diff
java.util.Currency
,AtomicLong
,AtomicLongArray
,AtomicInteger
,AtomicIntegerArray
,AtomicBoolean
. This change is backward-incompatible because the earlier version of Gson used the default serialization which wasn't intuitive. We hope that these classes are not used enough to actually cause problems in the field.v2.4
2015-10-04
IOException
fromTypeAdapter.toJson()
. This is a binary-compatible change, but maycause compiler errors where
IOExceptions
are being caught but no longer thrown. The correct fixfor this problem is to remove the unnecessary
catch
clause.Gson.newJsonWriter
method returns configuredJsonWriter
instances.@SerializedName
now works with [AutoValue’s][autovalue] abstract property methods.@SerializedName
permits alternate names when deserializing.JsonWriter#jsonValue
writes raw JSON values.JsonArray
instances.FieldNamingPolicy
now works properly when running on a device with a Turkish locale.[autovalue]: https://redirect.github.com/google/auto/tree/main/value
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.