DESCRIBE THE ISSUE IN DETAIL:

Gradle 8.4 now requires a more recent XML parser to be used, otherwise the build may fail if the "build logic has dependencies on old XML parsers that don't support secure parsing". (see CVE-2023-42445 for more info)

For instance, trying to use v0.49.0 of the Gradle Versions plugin (the version that fixes this issue) with Gradle 8.4 and the most recent version of AGP (8.3.0-alpha07) still fails with the following exception:

...
 - org.jetbrains.kotlinx:kotlinx-serialization-core
The exception that is the cause of unresolved state: org.gradle.internal.resolve.ModuleVersionResolveException: Could not resolve org.jetbrains.kotlinx:kotlinx-serialization-core:+.
Required by:
    project :data:serialization:android
Caused by: org.gradle.internal.resolve.ModuleVersionResolveException: Failed to list versions for org.jetbrains.kotlinx:kotlinx-serialization-core.
Caused by: org.gradle.api.resources.ResourceException: Unable to load Maven meta-data from https://repo.maven.apache.org/maven2/org/jetbrains/kotlinx/kotlinx-serialization-core/maven-metadata.xml.
	at org.gradle.api.internal.artifacts.repositories.maven.MavenMetadataLoader.load(MavenMetadataLoader.java:54)
	at org.gradle.api.internal.artifacts.repositories.maven.MavenVersionLister.listVersions(MavenVersionLister.java:48)
	at org.gradle.api.internal.artifacts.repositories.metadata.DefaultMavenPomMetadataSource.listModuleVersions(DefaultMavenPomMetadataSource.java:86)
	<truncated>
	... 223 more
Caused by: org.xml.sax.SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants/property/accessExternalSchema' is not recognized.
	at org.apache.xerces.parsers.AbstractSAXParser.getProperty(Unknown Source)
	at org.apache.xerces.jaxp.SAXParserImpl$JAXPSAXParser.setProperty(Unknown Source)
	at org.apache.ivy.util.XMLHelper.newSAXParser(XMLHelper.java:92)
	at org.apache.ivy.util.XMLHelper.parse(XMLHelper.java:170)
	at org.apache.ivy.util.XMLHelper.parse(XMLHelper.java:149)
	at org.apache.ivy.util.XMLHelper.parse(XMLHelper.java:144)
	at org.apache.ivy.util.XMLHelper.parse(XMLHelper.java:138)
	at org.gradle.api.internal.artifacts.repositories.maven.MavenMetadataLoader$2.doExecute(MavenMetadataLoader.java:77)
	at org.gradle.api.internal.artifacts.repositories.maven.MavenMetadataLoader$2.doExecute(MavenMetadataLoader.java:74)
	at org.gradle.internal.ErroringAction.execute(ErroringAction.java:36)
	... 228 more

(see https://pastebin.com/NA8CFmW3 for a full log)

Running the buildEnvironment task reveals that AGP uses an old XML parser, Xerces - see this build scan and (ben-manes/gradle-versions-plugin#814) for more info

STEPS TO REPRODUCE:

Use Gradle 8.4 + AGP 8.3.0-alpha07

Add v0.49.0 of the Gradle Versions plugin:

plugins {
  id("com.github.ben-manes.versions") version "0.49.0"
}

Run the dependencyUpdates task with the --info and --stacktrace flags

Note the exception:

...<truncated>...
Caused by: org.xml.sax.SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants /property/accessExternalSchema' is not recognized.

A workaround is to add the following properties to the gradle.properties file:

systemProp.javax.xml.parsers.SAXParserFactory=com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl
systemProp.javax.xml.transform.TransformerFactory=com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl
systemProp.javax.xml.parsers.DocumentBuilderFactory=com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl

ATTACH SCREENSHOTS/RECORDINGS OF THE ISSUE

ATTACH LOG FILES (Select Help > Show Log in Files, or Show Log in Finder on a Mac)

IMPORTANT: Please read https://developer.android.com/studio/report-bugs.html carefully and supply all required information.

Android Studio Iguana | 2023.2.1 Canary 7
Build #AI-232.9921.47.2321.10905494, built on October 5, 2023
Runtime version: 17.0.8+0-17.0.8b1000.22-10799086 x86_64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o.
macOS 12.6.5
GC: G1 Young Generation, G1 Old Generation
Memory: 2048M
Cores: 4
Metal Rendering is ON
Registry:
    external.system.auto.import.disabled=true
    debugger.new.tool.window.layout=true
    ide.text.editor.with.preview.show.floating.toolbar=false
    ide.instant.shutdown=false
    documentation.show.toolbar=true
    ide.experimental.ui=true

Non-Bundled Plugins:
    com.intellij.ideolog (222.1.0.0)
    com.jetbrains.packagesearch.intellij-plugin (232.9921.28)
    com.intellij.mermaid (0.0.15+IJ.232)
    com.obroom.plugin.smartsearch (2023.1.1)
    idea.plugin.protoeditor (232.9559.10)
    com.wakatime.intellij.plugin (14.2.2)
    com.dsoftware.ghtoolbar (1.13.4)
    kotest-plugin-intellij (1.3.69-IC-232-EAP-SNAPSHOT)

Version of Gradle Plugin: 8.3.0-alpha07
Version of Gradle: 8.4
Version of Java: 17
OS: macOS 12.6.5

Issue 306301014

Links (9)

Issue metadata