From 01e0afd9c2b95715e520599e4fa7b64a188163a5 Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Mon, 15 Jun 2026 20:06:12 +0530 Subject: [PATCH 1/7] Test commit --- app/src/main/java/com/auth0/guardian/sample/Constants.java | 1 + 1 file changed, 1 insertion(+) diff --git a/app/src/main/java/com/auth0/guardian/sample/Constants.java b/app/src/main/java/com/auth0/guardian/sample/Constants.java index 553507a..d68cf31 100644 --- a/app/src/main/java/com/auth0/guardian/sample/Constants.java +++ b/app/src/main/java/com/auth0/guardian/sample/Constants.java @@ -22,6 +22,7 @@ package com.auth0.guardian.sample; +// Test commit public class Constants { public static final String ENROLLMENT = "com.auth0.guardian.sample.Constants.ENROLLMENT"; From a35bb19ca7a38603fbb9fd8cd5f2442d89e8b253 Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Wed, 1 Jul 2026 11:12:42 +0530 Subject: [PATCH 2/7] Test commit to check whether SCA is working or not --- .github/workflows/sca_scan.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sca_scan.yml b/.github/workflows/sca_scan.yml index 8bef070..6a468c2 100644 --- a/.github/workflows/sca_scan.yml +++ b/.github/workflows/sca_scan.yml @@ -8,5 +8,7 @@ jobs: snyk-cli: uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@main with: - additional-arguments: "--exclude=README.md,.jfrog" + java-version: "17" + pre-scan-commands: "./gradlew :guardian:dependencies --no-daemon --console=plain" + additional-arguments: "--exclude=app" secrets: inherit From c0d0ecfe29a671a2c75340f57aa9444271f4f8bf Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Mon, 20 Jul 2026 17:38:26 +0530 Subject: [PATCH 3/7] Test commit --- .../src/main/java/com/auth0/android/guardian/sdk/ClientInfo.java | 1 + 1 file changed, 1 insertion(+) diff --git a/guardian/src/main/java/com/auth0/android/guardian/sdk/ClientInfo.java b/guardian/src/main/java/com/auth0/android/guardian/sdk/ClientInfo.java index 5c16a4d..24cc077 100644 --- a/guardian/src/main/java/com/auth0/android/guardian/sdk/ClientInfo.java +++ b/guardian/src/main/java/com/auth0/android/guardian/sdk/ClientInfo.java @@ -8,6 +8,7 @@ import com.google.gson.GsonBuilder; import com.google.gson.annotations.SerializedName; +// Test comment public class ClientInfo { final String name = "Guardian.Android"; final String version = BuildConfig.VERSION_NAME; From 34b9e74b13448231ef86340aecc46f43333d0052 Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Wed, 23 Sep 2026 14:14:14 +0530 Subject: [PATCH 4/7] Update Guardian SDK to use com.auth0:java-jwt:4.6.1+ instead of com.auth0:java-jwt:4.6.0 --- gradle.properties | 1 + guardian/build.gradle | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/gradle.properties b/gradle.properties index fc4980c..05e3f40 100644 --- a/gradle.properties +++ b/gradle.properties @@ -18,6 +18,7 @@ # org.gradle.parallel=true android.defaults.buildfeatures.buildconfig=true android.enableJetifier=true +android.jetifier.ignorelist=bcprov-jdk18on android.nonFinalResIds=false android.nonTransitiveRClass=false android.useAndroidX=true diff --git a/guardian/build.gradle b/guardian/build.gradle index da3c23f..43e0346 100644 --- a/guardian/build.gradle +++ b/guardian/build.gradle @@ -92,9 +92,9 @@ dependencies { implementation 'com.squareup.okhttp3:okhttp' implementation 'com.squareup.okhttp3:logging-interceptor' // JWT signing/verification - implementation 'com.auth0:java-jwt:4.6.0' + implementation 'com.auth0:java-jwt:4.6.1' // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt) - implementation platform('com.fasterxml.jackson:jackson-bom:2.22.1') + implementation platform('com.fasterxml.jackson:jackson-bom:2.22.2') testImplementation 'com.squareup.okhttp3:mockwebserver' // Mockito From 0afdcdad98d1274bdb47b5e240b05aa351bf8569 Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Thu, 1 Oct 2026 15:43:43 +0530 Subject: [PATCH 5/7] Added description for version 0.11.2 in CHANGELOG.md --- .version | 2 +- CHANGELOG.md | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.version b/.version index af88ba8..bc859cb 100644 --- a/.version +++ b/.version @@ -1 +1 @@ -0.11.1 +0.11.2 diff --git a/CHANGELOG.md b/CHANGELOG.md index c405068..137c383 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Change Log +## [0.11.2](https://github.com/auth0/Guardian.Android/tree/0.11.2) (2026-10-01) +[Full Changelog](https://github.com/auth0/Guardian.Android/compare/0.11.1...0.11.2) + +**Security** +- Bump `com.auth0:java-jwt` from `4.6.0` to `4.6.1` and update the `com.fasterxml.jackson:jackson-bom` pin from `2.22.1` to `2.22.2` to address CVE-2026-68497 (High), CVE-2026-83557 (Medium), and CVE-2026-19032 (Medium) flagged in `jackson-databind` (see [PR](https://github.com/auth0/Guardian.Android/pull/157)) + ## [0.11.1](https://github.com/auth0/Guardian.Android/tree/0.11.1) (2026-08-28) [Full Changelog](https://github.com/auth0/Guardian.Android/compare/0.11.0...0.11.1) From 26643e1f8f7cbba9a5e6e15b34c084698832d826 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 13 Oct 2026 19:15:30 +0000 Subject: [PATCH 6/7] chore: sync .version to 1.8.1 --- .version | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.version b/.version index a8839f7..a8fdfda 100644 --- a/.version +++ b/.version @@ -1 +1 @@ -0.11.2 \ No newline at end of file +1.8.1 From a31749fd3b8dcb846a53ea8ffad9b0b27a9e5fc6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 13 Oct 2026 19:19:50 +0000 Subject: [PATCH 7/7] chore: update CHANGELOG for 1.8.1 --- CHANGELOG.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 137c383..2849b52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,16 @@ +## 1.8.1 (2026-10-13) + +## What's Changed +* SEC-71727: fix bouncycastle version by @SerhiiKobezaCapgemini in https://github.com/auth0/Guardian.Android/pull/155 +* Bump java-jwt to 4.6.1 and jackson-bom to 2.22.2 to address CVEs by @arunav-gandhi in https://github.com/auth0/Guardian.Android/pull/157 +* Release/0.11.2 by @arunav-gandhi in https://github.com/auth0/Guardian.Android/pull/158 +* GHA CI/CD implementation by @arunav-gandhi in https://github.com/auth0/Guardian.Android/pull/159 +* Initial release pipeline by @arunav-gandhi in https://github.com/auth0/Guardian.Android/pull/161 +* Fix signing secret name, add coverage to release test job, remove secret debugging by @arunav-gandhi in https://github.com/auth0/Guardian.Android/pull/164 + + +**Full Changelog**: https://github.com/auth0/Guardian.Android/compare/0.11.1...1.8.1 + # Change Log ## [0.11.2](https://github.com/auth0/Guardian.Android/tree/0.11.2) (2026-10-01)