Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,17 @@

## Pending

## 2.2.2

### Update
- fix: prevent DoS attacks in `Federation` by limiting stellar.toml and federation response sizes to 100KB, adding proper timeouts, and handling UTF-8 BOM.
- fix: add stricter validation for Ed25519 Signed Payload.
- fix: replace assert statements with explicit null checks in `Federation` class to ensure validation is not bypassed when assertions are disabled.
- fix: add overflow check in `TimeBounds.expiresAfter()` to prevent integer overflow when timeout is too large.
- fix: add validation for `ManageDataOperation` value length to ensure it does not exceed 64 bytes.
- fix: use `StandardCharsets.UTF_8` explicitly when converting byte arrays to strings to ensure consistent behavior across different platforms.
- refactor: use static initialization for `GsonSingleton` to ensure thread safety.
- fix: use `commons-codec` for hex encoding/decoding in `Util` class to properly validate input and throw clear exceptions for invalid hex strings.
- fix: improve XDR decoding security and correctness.
- fix: add stricter validation for Ed25519 Signed Payload. ([#751](https://github.com/lightsail-network/java-stellar-sdk/pull/751))
- fix: replace assert statements with explicit null checks in `Federation` class to ensure validation is not bypassed when assertions are disabled. ([#752](https://github.com/lightsail-network/java-stellar-sdk/pull/752))
- fix: add overflow check in `TimeBounds.expiresAfter()` to prevent integer overflow when timeout is too large. ([#753](https://github.com/lightsail-network/java-stellar-sdk/pull/753))
- fix: add validation for `ManageDataOperation` value length to ensure it does not exceed 64 bytes. ([#754](https://github.com/lightsail-network/java-stellar-sdk/pull/754))
- fix: use `StandardCharsets.UTF_8` explicitly when converting byte arrays to strings to ensure consistent behavior across different platforms. ([#756](https://github.com/lightsail-network/java-stellar-sdk/pull/756))
- refactor: use static initialization for `GsonSingleton` to ensure thread safety. ([#757](https://github.com/lightsail-network/java-stellar-sdk/pull/757))
- fix: use `commons-codec` for hex encoding/decoding in `Util` class to properly validate input and throw clear exceptions for invalid hex strings. ([#758](https://github.com/lightsail-network/java-stellar-sdk/pull/758))
- fix: improve XDR decoding security and correctness. ([#759](https://github.com/lightsail-network/java-stellar-sdk/pull/759))
- Add decoding depth limit to prevent stack overflow (default: 200)
- Add input length tracking to prevent DoS via oversized allocations
- Validate variable-length array/opaque/string sizes before allocation
Expand All @@ -23,6 +24,7 @@
- Validate boolean/optional flags are strictly 0 or 1 per RFC 4506
- Fix EOF handling in single-byte read
- Deprecate unsafe readIntArray/readFloatArray/readDoubleArray methods
- fix: prevent DoS attacks in `Federation` by limiting stellar.toml and federation response sizes to 100KB, adding proper timeouts, and handling UTF-8 BOM. ([#760](https://github.com/lightsail-network/java-stellar-sdk/pull/760))

## 2.2.1

Expand Down
2 changes: 1 addition & 1 deletion android_test/app/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ dependencies {
implementation("androidx.compose.material3:material3")
// Since we are adding local jar(libs/stellar-sdk.jar) as dependency,
// gradle cannot automatically download the required third-party dependencies.
implementation(files("libs/stellar-sdk-2.2.1.jar"))
implementation(files("libs/stellar-sdk-2.2.2.jar"))
implementation("com.squareup.okhttp3:okhttp:4.11.0")
implementation("com.squareup.okhttp3:okhttp-sse:4.11.0")
implementation("com.moandjiezana.toml:toml4j:0.7.2")
Expand Down
2 changes: 1 addition & 1 deletion build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ plugins {
}

group = "network.lightsail"
version = "2.2.1"
version = "2.2.2"

java {
toolchain {
Expand Down
2 changes: 1 addition & 1 deletion examples/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ spotless {

dependencies {
// Use https://central.sonatype.com/artifact/network.lightsail/stellar-sdk in prod.
implementation("network.lightsail:stellar-sdk:2.2.1")
implementation("network.lightsail:stellar-sdk:2.2.2")
testImplementation(platform("org.junit:junit-bom:5.10.0"))
testImplementation("org.junit.jupiter:junit-jupiter")
}
Expand Down
4 changes: 2 additions & 2 deletions readme.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,13 @@ The Java Stellar SDK library provides APIs to build transactions and connect to
<dependency>
<groupId>network.lightsail</groupId>
<artifactId>stellar-sdk</artifactId>
<version>1.5.1</version>
<version>2.2.2</version>
</dependency>
```

### Gradle
```groovy
implementation 'network.lightsail:stellar-sdk:1.5.1'
implementation 'network.lightsail:stellar-sdk:2.2.2'
```

You can find instructions on how to install this dependency using alternative package managers [here](https://central.sonatype.com/artifact/network.lightsail/stellar-sdk).
Expand Down
Loading