From 2ef728656802eb63d8f32fa601eee10df1480495 Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Tue, 10 Nov 2026 14:06:34 +0530 Subject: [PATCH 1/3] [NAPP-244] Fix jackson and java-jwt CVEs (ESD-71218) Bump com.auth0:java-jwt 4.6.1 -> 4.6.2 and the jackson-bom pin 2.22.2 -> 2.22.4, and declare jackson-core / jackson-databind directly (explicit 2.22.4) so Maven consumers and POM-only scanners also resolve the patched version. java-jwt 4.6.2 still pulls Jackson 2.22.3, which is affected by CVE-2026-110879. Addresses CVE-2026-85473 (java-jwt), CVE-2026-89425 and CVE-2026-89407 (jackson-core), CVE-2026-91776, CVE-2026-91777 and CVE-2026-110879 (jackson-databind). Co-Authored-By: Claude --- guardian/build.gradle | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/guardian/build.gradle b/guardian/build.gradle index 733f105..c8d3df4 100644 --- a/guardian/build.gradle +++ b/guardian/build.gradle @@ -167,9 +167,13 @@ dependencies { implementation 'com.squareup.okhttp3:okhttp' implementation 'com.squareup.okhttp3:logging-interceptor' // JWT signing/verification - implementation 'com.auth0:java-jwt:4.6.1' - // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt) - implementation platform('com.fasterxml.jackson:jackson-bom:2.22.2') + implementation 'com.auth0:java-jwt:4.6.2' + // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt). + // Declared directly, with an explicit version, so Maven consumers (nearest-wins) and POM-only + // scanners also resolve the patched version. Keep these in sync with the BOM above. + implementation platform('com.fasterxml.jackson:jackson-bom:2.22.4') + implementation 'com.fasterxml.jackson.core:jackson-core:2.22.4' + implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4' testImplementation 'com.squareup.okhttp3:mockwebserver' // Mockito From ac45b8118b2c2c35441088d7f165dc7370f5ba05 Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Wed, 11 Nov 2026 16:06:31 +0530 Subject: [PATCH 2/3] [NAPP-244] Add Security entry to the 0.11.3 CHANGELOG section Prepare release does not rewrite an existing CHANGELOG entry (correction mode), so record the jackson / java-jwt CVE fixes here and update the date. Co-Authored-By: Claude --- CHANGELOG.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b3b040..168a028 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,11 @@ # Change Log -## [0.11.3](https://github.com/auth0/Guardian.Android/tree/0.11.3) (2026-10-21) +## [0.11.3](https://github.com/auth0/Guardian.Android/tree/0.11.3) (2026-11-11) [Full Changelog](https://github.com/auth0/Guardian.Android/compare/0.11.2...0.11.3) +**Security** +- Bump `com.auth0:java-jwt` from `4.6.1` to `4.6.2` and update the `com.fasterxml.jackson:jackson-bom` pin from `2.22.2` to `2.22.4`, and declare `jackson-core` and `jackson-databind` directly so every consumer resolves the patched version. Addresses CVE-2026-85473 in `java-jwt`, CVE-2026-89425 and CVE-2026-89407 in `jackson-core`, and CVE-2026-91776, CVE-2026-91777 and CVE-2026-110879 in `jackson-databind`. + **Changed** - Release/0.11.2 (see [PR](https://github.com/auth0/Guardian.Android/pull/158)) - GHA CI/CD implementation (see [PR](https://github.com/auth0/Guardian.Android/pull/159)) From 5f4612d5abc579ad2f7ed0c9c18ec370b6277e2c Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Wed, 11 Nov 2026 16:11:33 +0530 Subject: [PATCH 3/3] [NAPP-244] Add PRs merged since the 0.11.3 CHANGELOG entry was generated #188, #202, #204, #205 and #206 landed after the entry was drafted on Oct 21. Co-Authored-By: Claude --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 168a028..4a69ea3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,11 @@ - Initial release pipeline (see [PR](https://github.com/auth0/Guardian.Android/pull/161)) - Fix signing secret name, add coverage to release test job, remove secret debugging (see [PR](https://github.com/auth0/Guardian.Android/pull/164)) - NAPP-173: merge the release PR before tagging and publishing (see [PR](https://github.com/auth0/Guardian.Android/pull/168)) +- Release pipeline fixes from the first live releases (Android side of NAPP-177 to NAPP-186) (see [PR](https://github.com/auth0/Guardian.Android/pull/202)) +- Bump the actions group across 1 directory with 3 updates (see [PR](https://github.com/auth0/Guardian.Android/pull/188)) +- Bump ruby/setup-ruby from 1.331.0 to 1.335.0 in the actions group (see [PR](https://github.com/auth0/Guardian.Android/pull/204)) +- [NAPP-167] Fix the Guardian.Android sample app so it compiles and is ready for integration tests (see [PR](https://github.com/auth0/Guardian.Android/pull/206)) +- chore: move OpsLevel ownership to authn_-_native_apps (see [PR](https://github.com/auth0/Guardian.Android/pull/205)) ## [0.11.2](https://github.com/auth0/Guardian.Android/tree/0.11.2) (2026-10-01) [Full Changelog](https://github.com/auth0/Guardian.Android/compare/0.11.1...0.11.2)