From 108c6c8e47d270311e0019766a1717d0ccb277af Mon Sep 17 00:00:00 2001 From: Ovi Trif Date: Tue, 18 Aug 2026 13:11:29 +0200 Subject: [PATCH] fix: consume vss-client 0.5.23 Bump vss-client-android to 0.5.23 so unauthenticated VSS encryption is rejected in the library. Related: synonymdev/audit#55, synonymdev/vss-rust-client-ffi#20 --- changelog.d/next/1164.security.md | 1 + gradle/libs.versions.toml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog.d/next/1164.security.md diff --git a/changelog.d/next/1164.security.md b/changelog.d/next/1164.security.md new file mode 100644 index 000000000..b345a98bf --- /dev/null +++ b/changelog.d/next/1164.security.md @@ -0,0 +1 @@ +Wallet backups now use VSS 0.5.23, which rejects unauthenticated encryption. diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index b3a2a7046..d5cfdcbec 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -89,7 +89,7 @@ test-junit-ext = { module = "androidx.test.ext:junit", version = "1.3.0" } test-mockito-kotlin = { module = "org.mockito.kotlin:mockito-kotlin", version = "6.2.2" } test-robolectric = { module = "org.robolectric:robolectric", version = "4.16.1" } test-turbine = { group = "app.cash.turbine", name = "turbine", version = "1.2.1" } -vss-client = { module = "com.synonym:vss-client-android", version = "0.5.21" } +vss-client = { module = "com.synonym:vss-client-android", version = "0.5.23" } webkit = { module = "androidx.webkit:webkit", version = "1.16.0" } work-runtime-ktx = { module = "androidx.work:work-runtime-ktx", version = "2.11.0" } zxing = { module = "com.google.zxing:core", version = "3.5.4" }