From b43049bb0b82331f76a73b0888272faee7062749 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Wed, 26 Aug 2026 10:43:08 +0530 Subject: [PATCH 1/2] fix(security): substitute vulnerable bcprov/bcpkix-jdk15on with jdk18on:1.85 Resolves Snyk-flagged CVEs in transitive BouncyCastle 1.56/1.65 pulled in by AGP lint/build tooling and Robolectric. jdk15on is discontinued at 1.70, so substitute to the patched jdk18on line. Co-Authored-By: Claude Opus 5 --- build.gradle | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 5e77b8d2..e3a16c92 100644 --- a/build.gradle +++ b/build.gradle @@ -17,9 +17,16 @@ buildscript { allprojects { group = 'com.auth0.android' - + repositories { mavenCentral() google() } + + configurations.all { + resolutionStrategy.dependencySubstitution { + substitute module('org.bouncycastle:bcprov-jdk15on') using module('org.bouncycastle:bcprov-jdk18on:1.85') + substitute module('org.bouncycastle:bcpkix-jdk15on') using module('org.bouncycastle:bcpkix-jdk18on:1.85') + } + } } From 36083266fd82ae5f5ad4b535abc813ca04932593 Mon Sep 17 00:00:00 2001 From: utkrishtS Date: Thu, 27 Aug 2026 11:56:38 +0530 Subject: [PATCH 2/2] fix(security): substitute bouncycastle on buildscript classpath too --- build.gradle | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/build.gradle b/build.gradle index e3a16c92..8a8404b5 100644 --- a/build.gradle +++ b/build.gradle @@ -13,6 +13,13 @@ buildscript { classpath 'com.android.tools.build:gradle:4.2.2' classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version" } + + configurations.classpath { + resolutionStrategy.dependencySubstitution { + substitute module('org.bouncycastle:bcprov-jdk15on') using module('org.bouncycastle:bcprov-jdk18on:1.85') + substitute module('org.bouncycastle:bcpkix-jdk15on') using module('org.bouncycastle:bcpkix-jdk18on:1.85') + } + } } allprojects {