diff --git a/CHANGELOG.md b/CHANGELOG.md index 8757a7e6..85fccedd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ## [Unreleased] +- We updated vulnerable `okhttp`, `jackson`, and `security-crypto` dependencies. + +## [14.1.15] - 2026-04-22 + - We updated `@mendix/native` to v9.3.1, strengthening Android cookie encryption by migrating from `AES/CBC/PKCS7Padding` to `AES/GCM/NoPadding`. ## [14.1.14] - 2026-02-25 diff --git a/android/app/build.gradle b/android/app/build.gradle index 8fcbbd68..40f2b0d2 100644 --- a/android/app/build.gradle +++ b/android/app/build.gradle @@ -124,14 +124,14 @@ dependencies { implementation project(":mendixnative-release") // Explicit add okhttp - implementation("com.squareup.okhttp3:okhttp:4.9.1") - implementation("com.squareup.okhttp3:okhttp-urlconnection:4.9.1") + implementation("com.squareup.okhttp3:okhttp:${rootProject.ext.okhttpVersion}") + implementation("com.squareup.okhttp3:okhttp-urlconnection:${rootProject.ext.okhttpVersion}") // Required by MendixNative - implementation("com.fasterxml.jackson.core:jackson-core:2.11.3") - implementation("com.fasterxml.jackson.core:jackson-databind:2.11.3") - implementation("com.fasterxml.jackson.core:jackson-annotations:2.11.3") - implementation "androidx.security:security-crypto:1.1.0-alpha06" + implementation("com.fasterxml.jackson.core:jackson-core:${rootProject.ext.jacksonVersion}") + implementation("com.fasterxml.jackson.core:jackson-databind:${rootProject.ext.jacksonVersion}") + implementation("com.fasterxml.jackson.core:jackson-annotations:${rootProject.ext.jacksonVersion}") + implementation "androidx.security:security-crypto:${rootProject.ext.securityCryptoVersion}" // Required for Custom Dev Apps devImplementation "androidx.constraintlayout:constraintlayout:2.0.4" diff --git a/android/build.gradle b/android/build.gradle index 504dc229..5c3440b6 100644 --- a/android/build.gradle +++ b/android/build.gradle @@ -13,6 +13,10 @@ buildscript { androidXBrowser = "1.3.0" ndkVersion = "27.3.13750724" + + jacksonVersion = "2.17.3" + okhttpVersion = "4.12.0" + securityCryptoVersion = "1.1.0" } repositories { google()