Skip to content

fix: update navigationSafeArgsGradlePlugin - #1717

Merged
noguier merged 2 commits into
mainfrom
security-updates-JDOM
Sep 29, 2026
Merged

noguier merged 2 commits into
mainfrom
security-updates-JDOM

Conversation

@noguier

@noguier noguier commented Sep 29, 2026

Copy link
Copy Markdown
Contributor

Summary of changes

  • bump the version of navigationSafeArgsGradlePlugin to 2.10.2 to avoid transitively pulling a dependency with a vulnerabilty
  • this library is only used in Demo module, so I do not believe that the CHANGELOG entry is necessary

AI Usage

Which AI Agent Was Used?

  • Copilot
  • Claude
  • NA

How was AI used?
did use ai to generate this code

Estimated AI Code Contribution

  • less than 30%
  • 30 - 60%
  • 60 - 100%

Checklist

  • Added a changelog entry
  • Tested and confirmed payment flows affected by this change are functioning as expected

Authors

List GitHub usernames for everyone who contributed to this pull request.
@noguier

@noguier
noguier requested review from a team and a balanced review from Copilot September 29, 2026 16:14
@noguier
noguier requested a review from a team as a code owner September 29, 2026 16:14
@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities found.

Scanned Files

  • settings.gradle

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The new plugin version exists, is compatible with the project toolchain, and does not affect SDK runtime dependencies.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the Demo app’s Navigation Safe Args build tooling to avoid a vulnerable transitive dependency.

Changes:

  • Bumps Safe Args Gradle plugin from 2.5.0 to 2.10.2.
File Description
gradle/​libs.versions.toml Updates the centralized Safe Args plugin version.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot AI review requested due to automatic review settings September 29, 2026 16:18

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The valid build-only dependency update is correctly scoped and introduces no unresolved issues.

Review effort: Balanced
Findings: None

@saralvasquez saralvasquez left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 is this related to the security bug-bash thing?

@noguier

noguier commented Sep 29, 2026 •

Copy link
Copy Markdown
Contributor Author

🚀 is this related to the security bug-bash thing?

Yes, exactly, dependabot flagged some transitive dependency that may cause a security issue, I will be more descriptive in next PRs :)

@noguier
noguier merged commit e1f3c50 into main Sep 29, 2026
14 checks passed
@noguier
noguier deleted the security-updates-JDOM branch September 29, 2026 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants