chore(deps): bump the gradle-minor-and-patch group across 1 directory with 3 updates by dependabot[bot] · Pull Request #57 · evervault/evervault-java

dependabot · 2026-08-27T06:25:32Z

Bumps the gradle-minor-and-patch group with 3 updates in the / directory: com.google.code.gson:gson, com.google.guava:guava and org.bouncycastle:bcprov-jdk18on.

Updates com.google.code.gson:gson from 2.8.9 to 2.14.0

Release notes

Sourced from com.google.code.gson:gson's releases.

Gson 2.14.0

What's Changed

Add type adapters for java.time classes by @eamonnmcmanus in google/gson#2948

When the java.time API is available, Gson automatically can read and write instances of classes like Instant and Duration. The format it uses essentially freezes the JSON representation that ReflectiveTypeAdapterFactory established by default, based on the private fields of java.time classes. That's not a great representation, but it is understandable. Changing it to anything else would break compatibility with systems that are expecting the current format.

With this change, Gson no longer tries to access private fields of these classes using reflection. So it is no longer necessary to run with --add-opens for these classes on recent JDKs.

Remove com.google.gson.graph by @eamonnmcmanus in google/gson#2990.

This package was not part of any released artifact and depended on Gson internals in potentially problematic ways.

Validate that strings being parsed as integers consist of ASCII characters by @eamonnmcmanus in google/gson#2995

Previously, strings could contain non-ASCII Unicode digits and still be parsed as integers. That's inconsistent with how JSON numbers are treated.

Fix duplicate key detection when first value is null by @andrewstellman in google/gson#3006

This could potentially break code that was relying on the incorrect behaviour. For example, this JSON string was previously accepted but will no longer be: {"foo": null, "foo": bar}.

Remove Serializable from internal Type implementation classes. by @eamonnmcmanus in google/gson#3011

The nested classes ParameterizedTypeImpl, GenericArrayTypeImpl, and WildcardTypeImpl in GsonTypes are implementations of the corresponding types (without Impl) in java.lang.reflect. For some reason, they were serializable, even though the java.lang.reflect implementations are not. Having unnecessarily serializable classes could conceivably have been a security problem if they were part of a larger exploit using serialization. (We do not consider this a likely scenario and do not suggest that you need to update Gson just to get this change.)

Add LegacyProtoTypeAdapterFactory. by @eamonnmcmanus in google/gson#3014

This is not part of any released artifact, but may be of use when trying to fix code that is currently accessing the internals of protobuf classes via reflection.

Make AppendableWriter do flush and close if delegation object supports by @MukjepScarlet in google/gson#2925

Other less visible changes

Add default capacity to EnumTypeAdapter maps by @MukjepScarlet in google/gson#2959

refactor: move derived adapters from Gson to TypeAdapters by @MukjepScarlet in google/gson#2951

Optimize new Gson() by @MukjepScarlet in google/gson#2864

New Contributors

@ThirdGoddess made their first contribution in google/gson#2944

@lmj798 made their first contribution in google/gson#2988

@Eng-YasminKotb made their first contribution in google/gson#3005

@andrewstellman made their first contribution in google/gson#3006

Full Changelog: google/gson@gson-parent-2.13.2...gson-parent-2.14.0

Gson 2.13.2

The main changes in this release are just newer dependencies.

... (truncated)

Changelog

Sourced from com.google.code.gson:gson's changelog.

Change Log

The change log for versions newer than 2.10 is available only on the GitHub Releases page.

Version 2.10

Support for serializing and deserializing Java records, on Java ≥ 16. (google/gson#2201)

Add JsonArray.asList and JsonObject.asMap view methods (google/gson#2225)

Fix TypeAdapterRuntimeTypeWrapper not detecting reflective TreeTypeAdapter and FutureTypeAdapter (google/gson#1787)

Improve JsonReader.skipValue() (google/gson#2062)

Perform numeric conversion for primitive numeric type adapters (google/gson#2158)

Add Gson.fromJson(..., TypeToken) overloads (google/gson#1700)

Fix changes to GsonBuilder affecting existing Gson instances (google/gson#1815)

Make JsonElement conversion methods more consistent and fix javadoc (google/gson#2178)

Throw UnsupportedOperationException when JsonWriter.jsonValue is not supported (google/gson#1651)

Disallow JsonObject Entry.setValue(null) (google/gson#2167)

Fix TypeAdapter.toJson throwing AssertionError for custom IOException (google/gson#2172)

Convert null to JsonNull for JsonArray.set (google/gson#2170)

Fixed nullSafe usage. (google/gson#1555)

Validate TypeToken.getParameterized arguments (google/gson#2166)

Fix #1702: Gson.toJson creates CharSequence which does not implement toString (google/gson#1703)

Prefer existing adapter for concurrent Gson.getAdapter calls (google/gson#2153)

Improve ArrayTypeAdapter for Object[] (google/gson#1716)

Improve AppendableWriter performance (google/gson#1706)

Version 2.9.1

Make Object and JsonElement deserialization iterative rather than recursive (google/gson#1912)

Added parsing support for enum that has overridden toString() method (google/gson#1950)

Removed support for building Gson with Gradle (google/gson#2081)

Removed obsolete codegen hierarchy (google/gson#2099)

Add support for reflection access filter (google/gson#1905)

Improve TypeToken creation validation (google/gson#2072)

Add explicit support for float in JsonWriter (google/gson#2130, google/gson#2132)

Fail when parsing invalid local date (google/gson#2134)

Also many small improvements to javadoc.

Version 2.9.0

The minimum supported Java version changes from 6 to 7.

Change target Java version to 7 (google/gson#2043)

Put module-info.class into Multi-Release JAR folder (google/gson#2013)

Improve error message when abstract class cannot be constructed (google/gson#1814)

Support EnumMap deserialization (google/gson#2071)

Add LazilyParsedNumber default adapter (google/gson#2060)

Fix JsonReader.hasNext() returning true at end of document (google/gson#2061)

... (truncated)

Commits

3ff35d6 [maven-release-plugin] prepare release gson-parent-2.14.0
a3024fd Bump the maven group with 13 updates (#3002)
5689ffe Bump the github-actions group across 1 directory with 3 updates (#3018)
48db33c Add LegacyProtoTypeAdapterFactory. (#3014)
53d703e Update outdated comment regarding serializable types (#3012)
0189b72 Remove Serializable from internal Type implementation classes. (#3011)
f4d371d Fix duplicate key detection when first value is null (#3006)
27d9ba1 Fix typo in README (JPMS dependencies section) (#3005)
1fa9b7a Validate that strings being parsed as integers consist of ASCII characters (#...
b7d5954 Add iterator fail-fast tests for LinkedTreeMap.clear() (#2992)
Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-android to 33.7.1-android

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven
<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  
  <version>33.7.1-android</version>
</dependency>
Jar files

33.7.1-jre.jar

33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

failureaccess-1.0.3.jar

Javadoc

33.7.1-jre

33.7.1-android

JDiff

33.7.1-jre vs. 33.7.0-jre

33.7.1-android vs. 33.7.0-android

33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven
<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  
</tr></table>

... (truncated)

Commits

See full diff in compare view

Updates org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85.2

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

... (truncated)

Commits

See full diff in compare view

socket-security · 2026-08-27T06:36:04Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
maven/com.google.guava/guava@33.6.0-android ⏵ 33.7.1-android	^-7
maven/com.google.code.gson/gson@2.8.9 ⏵ 2.14.0
maven/org.bouncycastle/bcprov-jdk18on@1.84 ⏵ 1.85.2		⁺⁷⁵

View full report

socket-security · 2026-08-27T06:36:06Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: maven `org.bouncycastle:bcprov-jdk18on` under Bouncy Castle Licence License: Bouncy Castle Licence - This license classifier is not allowed by the applicable policy (Maven pom file) From: lib/gradle.lockfile → `maven/org.bouncycastle/bcprov-jdk18on@1.85.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore maven/org.bouncycastle/bcprov-jdk18on@1.85.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

… with 3 updates Bumps the gradle-minor-and-patch group with 3 updates in the / directory: [com.google.code.gson:gson](https://github.com/google/gson), [com.google.guava:guava](https://github.com/google/guava) and [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java). Updates `com.google.code.gson:gson` from 2.8.9 to 2.14.0 - [Release notes](https://github.com/google/gson/releases) - [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md) - [Commits](google/gson@gson-parent-2.8.9...gson-parent-2.14.0) Updates `com.google.guava:guava` from 33.6.0-android to 33.7.1-android - [Release notes](https://github.com/google/guava/releases) - [Commits](https://github.com/google/guava/commits) Updates `org.bouncycastle:bcprov-jdk18on` from 1.84 to 1.85.2 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) --- updated-dependencies: - dependency-name: com.google.code.gson:gson dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.google.guava:guava dependency-version: 33.7.1-android dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: org.bouncycastle:bcprov-jdk18on dependency-version: 1.85.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

ev-vaultkeeper

Review: Dependabot group bump (gson / guava / bcprov)

Thanks Dependabot. Unfortunately this can't be merged as-is: CI is failing on every JDK in the matrix.

Blocking issue — CI is red on all JDKs

The ci matrix jobs for JDK 8, 11, 16, 17, and 21 all fail at the ./gradlew clean test --info step (each job ends with Process completed with exit code 1). This is a regression introduced by this PR:

master (latest merge commit) is green on all five JDKs.
The previous Dependabot PRs (#42, #44, #48) were green on all five JDKs.
The only delta here is the three dependency bumps (+2 transitive: error_prone_annotations 2.47.0→2.50.0 and jspecify 1.0.0→1.0.1).

Because the failure is identical across every JDK, it's almost certainly a deterministic compile/test failure caused by one of the version bumps rather than flakiness or a JDK-version incompatibility.

Note: I wasn't able to open the detailed test report from the sandbox (the failed_unit_tests artifact and raw job logs redirect to blob storage that is outside the network allowlist), so I can't name the exact failing test. Please open the failing run's logs / failed_unit_tests artifact to confirm which test broke.

Most likely cause (ranked)

gson 2.8.9 → 2.14.0 (highest risk). This skips a lot of minor releases with behavioral changes: the new Strictness API and stricter number/JSON parsing (2.11), a duplicate-key handling change in 2.14 ({"foo": null, "foo": ...} is now rejected), removal of Serializable from the internal Type impls, and new java.time adapters. This SDK also (a) leans on gson's lenient coercion of quoted numbers into numeric fields (TokenResult.expiry is long parsed from "1234567890"; CardData.cvv is int parsed from "123") and (b) references the internal class com.google.gson.internal.LinkedTreeMap directly in WhenPerformingHttpRequestTests. Internal-package usage is fragile across gson upgrades.
bcprov-jdk18on 1.84 → 1.85.2 (crypto). EncryptionService uses the deprecated low-level primitives new GCMBlockCipher(new AESEngine()) and new SHA256Digest(). A behavioral change here would surface in the E2E encrypt/decrypt round-trips.
guava 33.6.0-android → 33.7.1-android (low risk). 33.7.1 specifically fixes the multi-release-manifest regression that 33.7.0 shipped, so this one is probably fine.

Additional: Socket license-policy alert

Socket raised a High severity license policy violation for org.bouncycastle:bcprov-jdk18on@1.85.2 (Bouncy Castle Licence not permitted by the org's policy). Even once CI is green this will need triage (a waiver via @SocketSecurity ignore ... / dashboard, or a policy update).

Suggested next steps

Inspect the failing job's failed_unit_tests artifact / logs to pin down the exact failing test(s).
Consider splitting the gson upgrade into its own PR so the group bump doesn't obscure which dependency broke the build.
Run ./gradlew clean test locally against each bump individually to isolate the culprit.
If the break is the internal LinkedTreeMap usage in tests, migrate that test to a public type (e.g. java.util.Map).

ev-vaultkeeper · 2026-08-31T13:55:25Z

-    implementation 'com.google.code.gson:gson:2.8.9'
-    implementation 'com.google.guava:guava:33.6.0-android'
-    implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.84'
+    implementation 'com.google.code.gson:gson:2.14.0'


Highest-risk change in this PR. Jumping gson 2.8.9 → 2.14.0 crosses several minor releases with behavioral changes (new Strictness/stricter number parsing since 2.11, the 2.14 duplicate-key handling change, removal of Serializable from internal Type impls, new java.time adapters). This SDK relies on lenient quoted-number coercion (e.g. TokenResult.expiry:long from "1234567890", CardData.cvv:int from "123") and on the internal com.google.gson.internal.LinkedTreeMap in WhenPerformingHttpRequestTests. Please confirm the failing test(s) here — and consider isolating the gson bump in its own PR.

ev-vaultkeeper · 2026-08-31T13:55:25Z

-    implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.84'
+    implementation 'com.google.code.gson:gson:2.14.0'
+    implementation 'com.google.guava:guava:33.7.1-android'
+    implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.85.2'


bcprov-jdk18on 1.84 → 1.85.2 is a crypto bump; EncryptionService uses the deprecated new GCMBlockCipher(new AESEngine()) / new SHA256Digest() primitives, so any behavior change would hit the E2E encrypt/decrypt tests. Separately, Socket flagged a High severity license-policy violation for bcprov-jdk18on@1.85.2 (Bouncy Castle Licence not allowed by org policy) that will need triage/waiver.

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 27, 2026

dependabot Bot requested a review from a team as a code owner August 27, 2026 06:25

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 27, 2026

dependabot Bot force-pushed the dependabot/gradle/gradle-minor-and-patch-c77af03fbe branch from 77d7fd8 to ccad880 Compare August 27, 2026 11:20

Matt (matt-evervault) requested a review from Evervault Bot (evervault-dependencies) August 31, 2026 13:46

Empty

13c4d01

Matt (matt-evervault) approved these changes Aug 31, 2026

View reviewed changes

Matt (matt-evervault) merged commit 4c8e706 into master Aug 31, 2026
14 checks passed

dependabot Bot deleted the dependabot/gradle/gradle-minor-and-patch-c77af03fbe branch August 31, 2026 13:54

ev-vaultkeeper Bot reviewed Aug 31, 2026

View reviewed changes

ev-vaultkeeper Bot removed the request for review from Evervault Bot (evervault-dependencies) August 31, 2026 13:55

Navigation Menu

Uh oh!

chore(deps): bump the gradle-minor-and-patch group across 1 directory with 3 updates - #57

chore(deps): bump the gradle-minor-and-patch group across 1 directory with 3 updates#57
Matt (matt-evervault) merged 2 commits into
masterfrom
dependabot/gradle/gradle-minor-and-patch-c77af03fbe

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

ev-vaultkeeper Bot left a comment

Uh oh!

ev-vaultkeeper Bot Aug 31, 2026

Uh oh!

ev-vaultkeeper Bot Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Gson 2.14.0

What's Changed

Other less visible changes

New Contributors

Gson 2.13.2

Change Log

Version 2.10

Version 2.9.1

Version 2.9.0

33.7.1

Maven

Jar files

Javadoc

JDiff

Changelog

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Maven

Uh oh!

socket-security Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

ev-vaultkeeper Bot left a comment

Choose a reason for hiding this comment

Review: Dependabot group bump (gson / guava / bcprov)

Blocking issue — CI is red on all JDKs

Most likely cause (ranked)

Additional: Socket license-policy alert

Suggested next steps

Uh oh!

ev-vaultkeeper Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

ev-vaultkeeper Bot Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading

socket-security Bot commented Aug 27, 2026 •

edited

Loading

socket-security Bot commented Aug 27, 2026 •

edited

Loading