compose-ui 1.3.0 imports protobuf-javalite:3.19.4 which triggers a security alert (CVE-2022-3171) [255545055]

Fixed

Bug

Status Update

No update yet.

Description

lo...@gmail.com

created issue #1

Oct 25, 2022 03:56PM

compose-ui triggers a security alert as it imports inspector.jar which contains protobuf-javalite:3.19.4. Please upgrade the version of protobuf-javalite to at least 3.19.6.

Jetpack Compose version: 1.3.0

Jetpack Compose component(s) used: compose-ui

Steps to Reproduce or Code Sample to Reproduce:

Add compose-ui to a project

Stack trace (if applicable):

ui-1.3.0.aar: inspector.jar/META-INF/maven/com.google.protobuf/protobuf-javalite/pom.xml (pkg:maven/com.google.protobuf/protobuf-javalite@3.19.4, cpe:2.3:a:google:protobuf-java:3.19.4:*:*:*:*:*:*:*, cpe:2.3:a:google:protobuf-javalite:3.19.4:*:*:*:*:*:*:*) : CVE-2022-3171

Comments

cl...@google.com <cl...@google.com> Oct 26, 2022 11:42AM

Assigned to ni...@google.com.

ni...@google.com <ni...@google.com> #2Oct 26, 2022 02:32PM

At least make BottomSheet can be launched from local like AlertDialog. Right now, it's too hard to have multiple BottomSheets on one screen with BottomSheetScaffold.

Message last modified on Oct 26, 2022 02:32PM

jl...@google.com <jl...@google.com> #3Oct 26, 2022 06:30PM

(Maybe I don't where this lives in documentation) I'm looking for a similar behavior in SwiftUI where you can call `.sheet()` to invoke a bottom sheet at any point which overtakes the screen. This behaves just like `.alert` in SwiftUI.

ni...@google.com <ni...@google.com> #4Oct 26, 2022 07:52PM

Re comment#2 and comment#3 - this issue is only tracking the integration of bottom sheets into Navigation Compose so that you can use navController.navigate() to make a bottom sheet appear.

If you'd like to request changes to the ModalBottomSheetLayout and similar APIs, you'll want to file a separate request against Compose.

ni...@google.com <ni...@google.com> #5Dec 15, 2022 08:57PM

Marked as fixed.

Fwiw this change does enable treating bottom sheets more like a window-esque thing, but they definitely won't be local.

[Deleted User] <[Deleted User]> #6Dec 27, 2022 02:21PM

Accompanist now supports this with Navigation Material.

Issue 255545055