From 7ef52bcc5b02e1b3d7c91bd8b64ccda29b3077e8 Mon Sep 17 00:00:00 2001 From: Kai Cilliers Date: Tue, 13 Jan 2026 13:53:47 +0200 Subject: [PATCH] Resolve vulnerability from Firebase SDK - https://www.mend.io/vulnerability-database/CVE-2025-67735?utm_source=Jetbrains --- .../kotlin/chirp.kotlin-common.gradle.kts | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/build-logic/src/main/kotlin/chirp.kotlin-common.gradle.kts b/build-logic/src/main/kotlin/chirp.kotlin-common.gradle.kts index d81b9ed..655276d 100644 --- a/build-logic/src/main/kotlin/chirp.kotlin-common.gradle.kts +++ b/build-logic/src/main/kotlin/chirp.kotlin-common.gradle.kts @@ -35,3 +35,22 @@ tasks.withType { tasks.withType { useJUnitPlatform() } + +configurations.all { + resolutionStrategy.eachDependency { + // Force Netty to safe version (fixes CVE-2025-55163, CVE-2025-67735) + if (requested.group == "io.netty") { + useVersion("4.2.9.Final") + } + + // Force gRPC Netty to patched version (Firebase SDK transitive fix) + if (requested.group == "io.grpc" && requested.name == "grpc-netty-shaded") { + useVersion("1.75.0") + } + + // Force commons-lang3 to patched version + if (requested.group == "org.apache.commons" && requested.name == "commons-lang3") { + useVersion("3.18.0") + } + } +}