Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Lots of vulnerabilities suddenly reported by dependency review action

Open
  • Is something wrong?
#25 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
android, github-actions, java
Domain
ci-cd, mobile-dev, security

Research direction

Start with the dependency-review-action build job and the warning about missing contents: write permission, then reproduce the dependency-graph comparisons using the documented gh api commands. Done means the graph no longer treats the whole project as newly added and CI reports only the relevant dependency changes; separately assess the listed vulnerable versions and AGP update path.

Written by the indexing model from the issue text.

Description

#23 and #24 are failing CI because actions/dependency-review-action is suddenly identifying seventeen vulnerabilities, while it hasn't made note of anything before.

17 vulnerabilities 
  settings.gradle.kts » com.google.protobuf:[email protected] – Protobuf Java vulnerable to Uncontrolled Resource Consumption (high severity)
    ↪ https://github.com/advisories/GHSA-g5ww-5jh7-63cx
  settings.gradle.kts » com.google.protobuf:[email protected] – Protobuf Java vulnerable to Uncontrolled Resource Consumption (high severity)
    ↪ https://github.com/advisories/GHSA-4gg5-vx3j-xwc7
  settings.gradle.kts » com.google.protobuf:[email protected] – protobuf-java has a potential Denial of Service issue (moderate severity)
    ↪ https://github.com/advisories/GHSA-h4h5-3hr4-j3g2
  settings.gradle.kts » io.grpc:[email protected] – Connection confusion in gRPC (high severity)
    ↪ https://github.com/advisories/GHSA-cfgp-2977-2fmm
  settings.gradle.kts » io.grpc:[email protected] – gRPC Reachable Assertion issue (high severity)
    ↪ https://github.com/advisories/GHSA-6628-q6j9-w8vg
  settings.gradle.kts » io.grpc:[email protected] – gRPC connection termination issue (moderate severity)
    ↪ https://github.com/advisories/GHSA-9hxf-ppjv-w6rq
  settings.gradle.kts » io.netty:[email protected] – io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack (high severity)
    ↪ https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
  settings.gradle.kts » org.bitbucket.b_c:[email protected] – jose4j uses weak cryptographic algorithm (high severity)
    ↪ https://github.com/advisories/GHSA-7g24-qg88-p43q
  settings.gradle.kts » org.bitbucket.b_c:[email protected] – Chosen Ciphertext Attack in Jose4j (moderate severity)
    ↪ https://github.com/advisories/GHSA-jgvc-jfgh-rjvv
  settings.gradle.kts » com.google.guava:[email protected] – Guava vulnerable to insecure use of temporary directory (moderate severity)
    ↪ https://github.com/advisories/GHSA-7g45-4rm6-3mm3
  settings.gradle.kts » com.google.guava:[email protected] – Information Disclosure in Guava (low severity)
    ↪ https://github.com/advisories/GHSA-5mg8-w23w-74h3
  settings.gradle.kts » commons-io:[email protected] – Path Traversal and Improper Input Validation in Apache Commons IO (moderate severity)
    ↪ https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
  settings.gradle.kts » io.netty:[email protected] – Local Information Disclosure Vulnerability in io.netty:netty-codec-http (moderate severity)
    ↪ https://github.com/advisories/GHSA-269q-hmxg-m83q
  settings.gradle.kts » io.netty:[email protected] – netty-handler SniHandler 16MB allocation (moderate severity)
    ↪ https://github.com/advisories/GHSA-6mjq-h674-j845
  settings.gradle.kts » org.apache.httpcomponents:[email protected] – Cross-site scripting in Apache HttpClient (moderate severity)
    ↪ https://github.com/advisories/GHSA-7r82-7xv7-xcpj
  settings.gradle.kts » org.bouncycastle:[email protected] – Bouncy Castle For Java LDAP injection vulnerability (moderate severity)
    ↪ https://github.com/advisories/GHSA-hr8g-6v94-x4m9
  settings.gradle.kts » xerces:[email protected] – Infinite Loop in Apache Xerces Java (moderate severity)
    ↪ https://github.com/advisories/GHSA-h65f-jvqw-m9fj
  Error: Dependency review detected vulnerable packages.

Further down in its output, we can see it thinks every dependency across the project was newly added. This is relevant because it "scans your pull requests for dependency changes, and will raise an error if any vulnerabilities or invalid licenses are being introduced." The action's documentation links to the API method it uses, and the following commands reflect the same issue. (first, comparing the PR's head and base, then, using against an earlier commit from main as the base)

$ gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/divviup/divviup-android/dependency-graph/compare/1f3b47777b76b42df52761cb07e306c3376c2b21...ac29b935ba040b0b674b9ca1052a57bff230f0ab | jq -r '.[] | .change_type' | sort | uniq -c
    253 added
$ gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/divviup/divviup-android/dependency-graph/compare/f0fceb030be70309c0a9d7e82df4f19d7726b672...ac29b935ba040b0b674b9ca1052a57bff230f0ab | jq -r '.[] | .change_type' | sort | uniq -c
      5 added
      3 removed

The key difference about the current tip of main is that it was pushed by Dependabot, via a merge command. When the CI ran on it, the following warning was emitted.

Failed to submit dependency graph dependency-graph-reports/ci-build.json.
Please ensure that the 'contents: write' permission is available for the workflow job.
Note that this permission is never available for a 'pull_request' trigger from a repository fork.

This is the same sort of issue we previously had on prio-server, where container images couldn't be pushed from Dependabot's merge commits because secrets weren't provided. To get out of this jam, I could rebase the PR branches back one, so that it has a good base dependency graph to work from, or maybe just re-run the workflow, so that it can successfully run with my github.actor. Based on this blog post we could fix this long-term by specifying permissions explicitly for the build job. Alternately, we could also avoid @dependabot squash and merge, and instead use GitHub's merge and automerge features directly.

Separately, while a lot of the reported vulnerabilities are in build tools only, or are otherwise not applicable to our uses of libraries, it would be nice to get some of these vulnerable dependency versions with fixes available updated. I'm not sure whether there's a good way to update transitive dependencies without the direct dependency itself updating. At any rate, AGP 8.1.3 came out last week, and that may help.

Dominant language
Java
Stars
1
Forks
1
Avg merge
10h 39m
Merged PRs (30d)
17

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from divviup/divviup-android

All issues in divviup/divviup-android

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.