Bump the gradle-minor-and-patch group with 2 updates

[dependabot]

Bumps the gradle-minor-and-patch group with 2 updates: com.google.code.gson:gson and org.apache.httpcomponents:httpclient.

Updates com.google.code.gson:gson from 2.8.9 to 2.14.0

Release notes

Sourced from com.google.code.gson:gson's releases.

Gson 2.14.0

What's Changed

• Add type adapters for java.time classes by @​eamonnmcmanus in google/gson#2948

  When the java.time API is available, Gson automatically can read and write instances of classes like Instant and Duration. The format it uses essentially freezes the JSON representation that ReflectiveTypeAdapterFactory established by default, based on the private fields of java.time classes. That's not a great representation, but it is understandable. Changing it to anything else would break compatibility with systems that are expecting the current format.

  With this change, Gson no longer tries to access private fields of these classes using reflection. So it is no longer necessary to run with --add-opens for these classes on recent JDKs.

• Remove com.google.gson.graph by @​eamonnmcmanus in google/gson#2990.

  This package was not part of any released artifact and depended on Gson internals in potentially problematic ways.

• Validate that strings being parsed as integers consist of ASCII characters by @​eamonnmcmanus in google/gson#2995

  Previously, strings could contain non-ASCII Unicode digits and still be parsed as integers. That's inconsistent with how JSON numbers are treated.

• Fix duplicate key detection when first value is null by @​andrewstellman in google/gson#3006

  This could potentially break code that was relying on the incorrect behaviour. For example, this JSON string was previously accepted but will no longer be: {"foo": null, "foo": bar}.

• Remove Serializable from internal Type implementation classes. by @​eamonnmcmanus in google/gson#3011

  The nested classes ParameterizedTypeImpl, GenericArrayTypeImpl, and WildcardTypeImpl in GsonTypes are implementations of the corresponding types (without Impl) in java.lang.reflect. For some reason, they were serializable, even though the java.lang.reflect implementations are not. Having unnecessarily serializable classes could conceivably have been a security problem if they were part of a larger exploit using serialization. (We do not consider this a likely scenario and do not suggest that you need to update Gson just to get this change.)

• Add LegacyProtoTypeAdapterFactory. by @​eamonnmcmanus in google/gson#3014

  This is not part of any released artifact, but may be of use when trying to fix code that is currently accessing the internals of protobuf classes via reflection.

• Make AppendableWriter do flush and close if delegation object supports by @​MukjepScarlet in google/gson#2925

Other less visible changes

• Add default capacity to EnumTypeAdapter maps by @​MukjepScarlet in google/gson#2959
• refactor: move derived adapters from Gson to TypeAdapters by @​MukjepScarlet in google/gson#2951
• Optimize new Gson() by @​MukjepScarlet in google/gson#2864

New Contributors

• @​ThirdGoddess made their first contribution in google/gson#2944
• @​lmj798 made their first contribution in google/gson#2988
• @​Eng-YasminKotb made their first contribution in google/gson#3005
• @​andrewstellman made their first contribution in google/gson#3006

Full Changelog: google/gson@gson-parent-2.13.2...gson-parent-2.14.0

Gson 2.13.2

The main changes in this release are just newer dependencies.

... (truncated)

Changelog

Sourced from com.google.code.gson:gson's changelog.

Change Log

The change log for versions newer than 2.10 is available only on the GitHub Releases page.

Version 2.10

• Support for serializing and deserializing Java records, on Java ≥ 16. (google/gson#2201)
• Add JsonArray.asList and JsonObject.asMap view methods (google/gson#2225)
• Fix TypeAdapterRuntimeTypeWrapper not detecting reflective TreeTypeAdapter and FutureTypeAdapter (google/gson#1787)
• Improve JsonReader.skipValue() (google/gson#2062)
• Perform numeric conversion for primitive numeric type adapters (google/gson#2158)
• Add Gson.fromJson(..., TypeToken) overloads (google/gson#1700)
• Fix changes to GsonBuilder affecting existing Gson instances (google/gson#1815)
• Make JsonElement conversion methods more consistent and fix javadoc (google/gson#2178)
• Throw UnsupportedOperationException when JsonWriter.jsonValue is not supported (google/gson#1651)
• Disallow JsonObject Entry.setValue(null) (google/gson#2167)
• Fix TypeAdapter.toJson throwing AssertionError for custom IOException (google/gson#2172)
• Convert null to JsonNull for JsonArray.set (google/gson#2170)
• Fixed nullSafe usage. (google/gson#1555)
• Validate TypeToken.getParameterized arguments (google/gson#2166)
• Fix #1702: Gson.toJson creates CharSequence which does not implement toString (google/gson#1703)
• Prefer existing adapter for concurrent Gson.getAdapter calls (google/gson#2153)
• Improve ArrayTypeAdapter for Object[] (google/gson#1716)
• Improve AppendableWriter performance (google/gson#1706)

Version 2.9.1

• Make Object and JsonElement deserialization iterative rather than recursive (google/gson#1912)
• Added parsing support for enum that has overridden toString() method (google/gson#1950)
• Removed support for building Gson with Gradle (google/gson#2081)
• Removed obsolete codegen hierarchy (google/gson#2099)
• Add support for reflection access filter (google/gson#1905)
• Improve TypeToken creation validation (google/gson#2072)
• Add explicit support for float in JsonWriter (google/gson#2130, google/gson#2132)
• Fail when parsing invalid local date (google/gson#2134)

Also many small improvements to javadoc.

Version 2.9.0

The minimum supported Java version changes from 6 to 7.

• Change target Java version to 7 (google/gson#2043)
• Put module-info.class into Multi-Release JAR folder (google/gson#2013)
• Improve error message when abstract class cannot be constructed (google/gson#1814)
• Support EnumMap deserialization (google/gson#2071)
• Add LazilyParsedNumber default adapter (google/gson#2060)
• Fix JsonReader.hasNext() returning true at end of document (google/gson#2061)

... (truncated)

Commits

• 3ff35d6 [maven-release-plugin] prepare release gson-parent-2.14.0
• a3024fd Bump the maven group with 13 updates (#3002)
• 5689ffe Bump the github-actions group across 1 directory with 3 updates (#3018)
• 48db33c Add LegacyProtoTypeAdapterFactory. (#3014)
• 53d703e Update outdated comment regarding serializable types (#3012)
• 0189b72 Remove Serializable from internal Type implementation classes. (#3011)
• f4d371d Fix duplicate key detection when first value is null (#3006)
• 27d9ba1 Fix typo in README (JPMS dependencies section) (#3005)
• 1fa9b7a Validate that strings being parsed as integers consist of ASCII characters (#...
• b7d5954 Add iterator fail-fast tests for LinkedTreeMap.clear() (#2992)
• Additional commits viewable in compare view

Updates org.apache.httpcomponents:httpclient from 4.5.13 to 4.5.14

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Matt (matt-evervault)]

Review summary

Reviewed both dependency bumps in this PR against how they're actually used in the SDK.

Usage review

• gson is only used with plain new Gson() (no GsonBuilder, custom TypeAdapters, @SerializedName, etc.) in HttpHandler for serializing requests and parsing API responses. No model classes hand java.time.* types directly to Gson (an Instant is converted to epoch millis before serialization), so the new default java.time adapters in 2.14.0 have no effect here. One test (WhenPerformingHttpRequestTests) casts a deserialized field to the internal com.google.gson.internal.LinkedTreeMap — confirmed this class still exists and is public in 2.14.0.
• httpclient 4.5.x is only used for standard, unchanged APIs (AuthScope, UsernamePasswordCredentials, CredentialsProvider, HttpRoutePlanner/DefaultProxyRoutePlanner) in the outbound-relay proxy support (ProxyCredentialsProvider, ProxyRoutePlanner, EvervaultService), which are also exposed as public getters for consumers.

Changelog (gson 2.8.9 → 2.14.0): notable changes are stricter duplicate-JSON-key detection, ASCII-only integer parsing validation, removal of the unused/unreleased com.google.gson.graph package, and removal of Serializable from internal Type impls — none of these affect this SDK since it only parses trusted, well-formed responses from Evervault's own API and doesn't touch any of the removed APIs.

Changelog (httpclient 4.5.13 → 4.5.14): a maintenance release (connection-close-on-shutdown fix, subjectAltName handling, cookie domain null-check, proxy CONNECT handling). No API used by this SDK changed. No new CVEs; 4.5.13 already carried the CVE-2020-13956 fix.

Build issue found and fixed: this project has Gradle dependency locking enabled (dependencyLocking { lockAllConfigurations() }), and the original PR only bumped lib/build.gradle without regenerating lib/gradle.lockfile. As-is, the build failed at :lib:compileJava because the lock file still strictly pinned the old versions. I ran gradle :lib:dependencies --write-locks and pushed the resulting lockfile update as a second commit — this also picks up the expected transitive bumps (httpcore 4.4.13→4.4.16, and error_prone_annotations 2.11.0→2.48.0, which is now a direct transitive of gson itself, a compile-time-only annotation artifact).

Test results after the fix: gradle build now compiles and runs cleanly. Of 121 tests, 15 fail — all in EndToEndTests.*, which require live TEST_EV_APP_ID/TEST_EV_API_KEY credentials and network access to the real Evervault API; confirmed these fail identically on master with no changes, so they're a pre-existing environment limitation, not a regression. One additional test (WhenSchedulingAnExecutable.shouldScheduleAnExecutable) is a timing-flaky sleep-based test that passed on 3 consecutive reruns in isolation. All other tests pass, including the Gson (de)serialization and httpclient route-planner suites.

Verdict: Safe to merge with the lockfile fix included. No source code changes were necessary.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​com.google.code.gson/​gson@​2.8.9 ⏵ 2.14.0
	maven/​org.apache.httpcomponents/​httpclient@​4.5.13 ⏵ 4.5.14

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: maven org.apache.httpcomponents:httpclient under MPL-2.0 License: MPL-2.0 - The applicable license policy does not permit this license (5) (mozilla/public-suffix-list.txt) From: lib/gradle.lockfile → maven/org.apache.httpcomponents/httpclient@4.5.14 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.httpcomponents/httpclient@4.5.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report