compose-ui 1.3.0 imports protobuf-javalite:3.19.4 which triggers a security alert (CVE-2022-3171) [255545055]

Fixed

Bug

Status Update

No update yet.

Description

lo...@gmail.com

created issue #1

Oct 25, 2022 03:56PM

compose-ui triggers a security alert as it imports inspector.jar which contains protobuf-javalite:3.19.4. Please upgrade the version of protobuf-javalite to at least 3.19.6.

Jetpack Compose version: 1.3.0

Jetpack Compose component(s) used: compose-ui

Steps to Reproduce or Code Sample to Reproduce:

Add compose-ui to a project

Stack trace (if applicable):

ui-1.3.0.aar: inspector.jar/META-INF/maven/com.google.protobuf/protobuf-javalite/pom.xml (pkg:maven/com.google.protobuf/protobuf-javalite@3.19.4, cpe:2.3:a:google:protobuf-java:3.19.4:*:*:*:*:*:*:*, cpe:2.3:a:google:protobuf-javalite:3.19.4:*:*:*:*:*:*:*) : CVE-2022-3171

Comments

cl...@google.com <cl...@google.com> Oct 26, 2022 11:42AM

Assigned to ni...@google.com.

ni...@google.com <ni...@google.com> #2Oct 26, 2022 02:32PM

To use Lifecycle 2.8.0-alpha03, ensure you are using at least Compose UI 1.7.0-alpha05.

The issue is happening because, starting from Lifecycle 2.8.0-alpha03 and Compose UI 1.7.0-alpha05, LocalLifecycleOwner has been moved from androidx.compose.ui to lifecycle-runtime-compose, as outlined in their respective release notes. For compatibility reasons, you must update both dependencies.

For context, note these changes were made to enable the utilization of its Compose-based helper APIs beyond Compose UI (such as in Molecule). Further information can be found at b/328263448.

If the issue persists even after updating your Compose UI, please let us know.

Edit: please see https://issuetracker.google.com/336842920#comment8 for a workaround.

Message last modified on Oct 26, 2022 02:32PM

jl...@google.com <jl...@google.com> #3Oct 26, 2022 06:30PM

Thanks for your answer.
If this change has made both libraries version dependent, it seems that guide them to the release note so that users will not experience difficulties :)

ni...@google.com <ni...@google.com> #4Oct 26, 2022 07:52PM

lifecycle 2.8.0 is now stable but compose UI 1.7.0 is still in beta.

ni...@google.com <ni...@google.com> #5Dec 15, 2022 08:57PM

Marked as fixed.

Same problem here. Lifecycle 2.8.0 is now stable but Compose UI 1.7.0 is still beta. Of course our Dependabot didn't know about this relationship between dependencies 😬

[Deleted User] <[Deleted User]> #6Dec 27, 2022 02:21PM

Something like that really shouldn't happen... 🤦🏻‍♂️

Issue 255545055