Skip to content

Update Tink library#313

Merged
oharsta merged 1 commit intoOpenConext:mainfrom
Stephan-Kok:master
Feb 3, 2026
Merged

Update Tink library#313
oharsta merged 1 commit intoOpenConext:mainfrom
Stephan-Kok:master

Conversation

@Stephan-Kok
Copy link
Contributor

For solving the following warning during boot. I have update the old tink library to it newest available version.

The warning:

As of 2022/09/29 (release 21.7) makeExtensionsImmutable should not be called from protobuf gencode. If you are seeing this message, your gencode is vulnerable to a denial of service attack. You should regenerate your code using protobuf 25.6 or later. Use the latest version that meets your needs. However, if you understand the risks and wish to continue with vulnerable gencode, you can set the system property `-Dcom.google.protobuf.use_unsafe_pre22_gencode` on the command line to silence this warning. You also can set `-Dcom.google.protobuf.error_on_unsafe_pre22_gencode` to throw an error instead. See security vulnerability: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2

The current version 1.6.0 is discontinued and started with a new project from the old codebase at version 1.8: https://github.com/tink-crypto/tink-java/releases. I have updated the think library to its newest version 1.20.0

I have read through the release notes and there weren't any breaking changes, only performance and security improvements.

I have tested the application locally on the 'kennisnet' dev environment and encryption still seems to work as expected.

Side note:
I also removed the CVE-2021-22569 overwrite since the newest version uses the latest version of protobuf so the override is no longer necessary.

@codecov
Copy link

codecov bot commented Feb 3, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.93%. Comparing base (8f634b8) to head (1a4b5c8).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff            @@
##               main     #313   +/-   ##
=========================================
  Coverage     89.93%   89.93%           
  Complexity      664      664           
=========================================
  Files            86       86           
  Lines          2414     2414           
  Branches        274      274           
=========================================
  Hits           2171     2171           
  Misses          129      129           
  Partials        114      114           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Stephan-Kok Stephan-Kok requested a review from oharsta February 3, 2026 14:42
@oharsta oharsta merged commit c376a5d into OpenConext:main Feb 3, 2026
3 checks passed
@github-project-automation github-project-automation bot moved this from New to Delivered in OpenConext-oidcng Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Delivered

Development

Successfully merging this pull request may close these issues.

2 participants