diff --git a/CHANGELOG.md b/CHANGELOG.md index 68bead962..ae5edaa6b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,16 +2,17 @@ ## Pending +## 2.2.2 + ### Update -- fix: prevent DoS attacks in `Federation` by limiting stellar.toml and federation response sizes to 100KB, adding proper timeouts, and handling UTF-8 BOM. -- fix: add stricter validation for Ed25519 Signed Payload. -- fix: replace assert statements with explicit null checks in `Federation` class to ensure validation is not bypassed when assertions are disabled. -- fix: add overflow check in `TimeBounds.expiresAfter()` to prevent integer overflow when timeout is too large. -- fix: add validation for `ManageDataOperation` value length to ensure it does not exceed 64 bytes. -- fix: use `StandardCharsets.UTF_8` explicitly when converting byte arrays to strings to ensure consistent behavior across different platforms. -- refactor: use static initialization for `GsonSingleton` to ensure thread safety. -- fix: use `commons-codec` for hex encoding/decoding in `Util` class to properly validate input and throw clear exceptions for invalid hex strings. -- fix: improve XDR decoding security and correctness. +- fix: add stricter validation for Ed25519 Signed Payload. ([#751](https://github.com/lightsail-network/java-stellar-sdk/pull/751)) +- fix: replace assert statements with explicit null checks in `Federation` class to ensure validation is not bypassed when assertions are disabled. ([#752](https://github.com/lightsail-network/java-stellar-sdk/pull/752)) +- fix: add overflow check in `TimeBounds.expiresAfter()` to prevent integer overflow when timeout is too large. ([#753](https://github.com/lightsail-network/java-stellar-sdk/pull/753)) +- fix: add validation for `ManageDataOperation` value length to ensure it does not exceed 64 bytes. ([#754](https://github.com/lightsail-network/java-stellar-sdk/pull/754)) +- fix: use `StandardCharsets.UTF_8` explicitly when converting byte arrays to strings to ensure consistent behavior across different platforms. ([#756](https://github.com/lightsail-network/java-stellar-sdk/pull/756)) +- refactor: use static initialization for `GsonSingleton` to ensure thread safety. ([#757](https://github.com/lightsail-network/java-stellar-sdk/pull/757)) +- fix: use `commons-codec` for hex encoding/decoding in `Util` class to properly validate input and throw clear exceptions for invalid hex strings. ([#758](https://github.com/lightsail-network/java-stellar-sdk/pull/758)) +- fix: improve XDR decoding security and correctness. ([#759](https://github.com/lightsail-network/java-stellar-sdk/pull/759)) - Add decoding depth limit to prevent stack overflow (default: 200) - Add input length tracking to prevent DoS via oversized allocations - Validate variable-length array/opaque/string sizes before allocation @@ -23,6 +24,7 @@ - Validate boolean/optional flags are strictly 0 or 1 per RFC 4506 - Fix EOF handling in single-byte read - Deprecate unsafe readIntArray/readFloatArray/readDoubleArray methods +- fix: prevent DoS attacks in `Federation` by limiting stellar.toml and federation response sizes to 100KB, adding proper timeouts, and handling UTF-8 BOM. ([#760](https://github.com/lightsail-network/java-stellar-sdk/pull/760)) ## 2.2.1 diff --git a/android_test/app/build.gradle.kts b/android_test/app/build.gradle.kts index 925f3b425..c3602e2e1 100644 --- a/android_test/app/build.gradle.kts +++ b/android_test/app/build.gradle.kts @@ -68,7 +68,7 @@ dependencies { implementation("androidx.compose.material3:material3") // Since we are adding local jar(libs/stellar-sdk.jar) as dependency, // gradle cannot automatically download the required third-party dependencies. - implementation(files("libs/stellar-sdk-2.2.1.jar")) + implementation(files("libs/stellar-sdk-2.2.2.jar")) implementation("com.squareup.okhttp3:okhttp:4.11.0") implementation("com.squareup.okhttp3:okhttp-sse:4.11.0") implementation("com.moandjiezana.toml:toml4j:0.7.2") diff --git a/build.gradle.kts b/build.gradle.kts index 03cd7c8a2..d5c415f68 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -12,7 +12,7 @@ plugins { } group = "network.lightsail" -version = "2.2.1" +version = "2.2.2" java { toolchain { diff --git a/examples/build.gradle.kts b/examples/build.gradle.kts index 6c8e74daa..9cd1ed5e9 100644 --- a/examples/build.gradle.kts +++ b/examples/build.gradle.kts @@ -22,7 +22,7 @@ spotless { dependencies { // Use https://central.sonatype.com/artifact/network.lightsail/stellar-sdk in prod. - implementation("network.lightsail:stellar-sdk:2.2.1") + implementation("network.lightsail:stellar-sdk:2.2.2") testImplementation(platform("org.junit:junit-bom:5.10.0")) testImplementation("org.junit.jupiter:junit-jupiter") } diff --git a/readme.md b/readme.md index 34ed659e1..c12baa8ef 100644 --- a/readme.md +++ b/readme.md @@ -14,13 +14,13 @@ The Java Stellar SDK library provides APIs to build transactions and connect to network.lightsail stellar-sdk - 1.5.1 + 2.2.2 ``` ### Gradle ```groovy -implementation 'network.lightsail:stellar-sdk:1.5.1' +implementation 'network.lightsail:stellar-sdk:2.2.2' ``` You can find instructions on how to install this dependency using alternative package managers [here](https://central.sonatype.com/artifact/network.lightsail/stellar-sdk).