[kirich1409]

Fixes #224

Recount

Recounted on develop at a4efcc3 (2026-11-07), not from the May 2026 text of 33 and not from the default-branch Dependabot list. Default branch is main, which is behind develop and does not include the AppMetrica provider. Open Dependabot alerts on main were 79 Maven alerts when this was recounted. Reachability verdict is disabled. That list is not the work list.

Published consumer runtime edges that were still vulnerable:

• featured-firebase-provider publishes implementation firebase-analytics. Catalog firebaseBom 34.19.0 pins analytics 23.2.0. play-services-measurement-api 23.2.0 declares com.google.guava:guava:31.1-android as a normal compile dependency. Advisories: GHSA-xxph-c9ww-hj94 / CVE-2026-102554 (high), GHSA-7g45-4rm6-3mm3 (medium), GHSA-5mg8-w23w-74h3 (low). firebase-bom does not manage Guava. BOM 35.1.0 / analytics 24.0.0 still has the same path, so the BOM was not bumped.
• featured-appmetrica-provider publishes implementation com.yandex.varioqub:config:0.10.0, the latest Maven Central version. That runtime edge requires com.squareup.okhttp3:okhttp:3.12.0, not strictly, and therefore Okio 1.15.0. Advisories: GHSA-3cqm-mf7h-prrj / CVE-2021-0341 (high) and GHSA-w33c-445m-f8w7 / CVE-2023-3635 (medium). Varioqub 0.8.0 and 0.9.0 pin the same OkHttp.

Fix

The providers now publish coordinates that were already on the consumer classpath:

• featured-firebase-provider publishes implementation com.google.guava:guava:33.8.0-android.
• featured-appmetrica-provider publishes implementation com.squareup.okhttp3:okhttp:4.12.0, which depends on Okio 3.6.0.

33.7.2-android is the first Android flavor that clears the three Guava advisories. 33.8.0-android is the selected pin: it exists on Maven Central and get_dependency_vulnerabilities for it is empty. get_vulnerability_paths for OkHttp 4.12.0 is empty and not partial. A local-only constraint would not reach POM consumers; the published runtime metadata carries the explicit version. Highest-wins and nearest-wins both select that direct request over the transitive pins.

Firebase Analytics stays. The provider has published that runtime edge since the module was added. Varioqub stays at 0.10.0. Replacing it would be a new product dependency. OkHttp 4.9.2 was not used because it still depends on vulnerable Okio 2.8.0. OkHttp 5.x was not used because those jars do not contain okhttp3/RequestBody. The Guava JRE flavor is not published.

Already published 1.2.0 still has the old edges. This change does not republish 1.2.0, bump VERSION_NAME, or cut a release.

Not fixed, and why

The other open advisories are on the build, test, or plugin classpath, not on a published consumer runtime classpath:

• AGP, lint, Android UTP / testing platform, Dokka, Kover, Robolectric, and kotlin-swift-export-embeddable are build or test tools.
• bcpg-jdk18on 1.80 is Dependabot-direct on main but absent from source and from the featured-gradle-plugin 1.2.0 POM.
• featured-gradle-plugin compileOnly AGP pulls kotlin-gradle-plugin 2.2.10 (GHSA-r937-wjx7-w2jp). Develop applies Kotlin 2.4.20, past the fix at 2.4.20-Beta1, and compileOnly is not in the published plugin POM.
• Guava 33.4.8-jre via Robolectric is test-only.
• Sample-only io.appmetrica.analytics:analytics is not a published provider dependency.

Verification

No committed unit test can show this bug. :providers:firebase:test and :providers:appmetrica:test pass on develop while the published runtime variants still require the vulnerable coordinates. This repository has no publication-metadata test place, and a provider test that only compiles or mocks the SDKs would pass on the buggy behavior. The check is generated maven publication metadata, without signing or publishing, then resolution of those runtime variants plus OSV.

Pass check, run on this branch:

• Generated POM for featured-firebase-provider has com.google.guava:guava 33.8.0-android at runtime scope. Variant releaseVariantReleaseRuntimePublication requires that version.
• Generated POM for featured-appmetrica-provider has com.squareup.okhttp3:okhttp 4.12.0 at runtime scope. The same runtime variant requires that version.
• Resolving that Firebase runtime publication against firebase-bom 34.19.0 selects firebase-analytics 23.2.0 and Guava 33.8.0-android. play-services-measurement-api 23.2.0 still requests Guava 31.1-android; the direct higher Android flavor wins. get_dependency_vulnerabilities for 33.8.0-android is empty.
• Resolving that AppMetrica runtime publication against Varioqub config 0.10.0 selects OkHttp 4.12.0 over the requested 3.12.0, and Okio 3.6.0. get_vulnerability_paths for OkHttp 4.12.0 is empty, partial: false, truncated: false.
• get_vulnerability_paths is empty, not partial, and not truncated for firebase-config 23.1.0, configcat-kotlin-client 5.1.0, datastore-preferences 1.3.0, kotlinx-serialization-json 1.12.0, coroutines-core 1.11.0, coroutines-android 1.11.0, preference-ktx 1.2.1, core-ktx 1.19.1, androidx.compose.runtime:runtime 1.12.1, and org.jetbrains.skiko:skiko 0.150.2.

Also run, and not treated as the CVE pass: spotlessCheck, :providers:firebase:test, :providers:appmetrica:test, and checkAndroidApi on both providers. All passed. Public signatures do not change, so the Android API dumps were not updated.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation
• Chore / refactor

Checklist

• Tests added or updated
• Docs updated (KDoc, README, CHANGELOG)
• ./gradlew spotlessCheck passes
• CHANGELOG.md updated

Notes for reviewers

No unit test was added. A test in the provider source sets cannot fail while the vulnerable published edges are still present. The failing check is the generated publication metadata plus resolution, recorded above.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.