What the developer wrote
Authored by Craig Raw
upgrade zxing to v3.5.4
What changed, and why it matters
This commit updates the ZXing barcode/QR-code library from version 3.4.0 to 3.5.4 in the project's build file. Library updates often include bug fixes and security patches, but the commit message does not say this is a security fix. Without a vendor advisory or changelog reference, we cannot confirm any specific vulnerability is being fixed, though staying on an older version can leave known issues unpatched.
Treat as a routine maintenance update. Review the ZXing 3.5.4 release notes for any security-relevant fixes and verify the upgrade does not break QR code generation or scanning. No immediate incident response is warranted based solely on this commit.
Security signals we found
Dependency version bump of a widely used QR/barcode library
Older ZXing 3.4.0 predates multiple upstream releases (3.5.x) that may contain fixes
No explicit security claim or CVE reference in commit message
Evidence from the diff
The single-line change in build.gradle bumps the com.google.zxing:javase dependency from 3.4.0 to 3.5.4. ZXing is used for QR code generation/parsing in the wallet. The diff itself is a routine dependency upgrade; no exploit code or vulnerability details are present in the commit. The older 3.4.0 release is known to predate several upstream fixes, but the commit does not identify which, if any, affect Sparrow.
Changed components
build.gradle dependency declarationcom.google.zxing:javase libraryQR code scanning/generation functionalityInspect captured patch +1 / −1
diff --git a/build.gradle b/build.gradle
index 6baea43..52e7f50 100644
--- a/build.gradle
+++ b/build.gradle
@@ -59,7 +59,7 @@ dependencies {
implementation('org.flywaydb:flyway-core:9.22.3')
implementation('org.fxmisc.richtext:richtextfx:0.11.7')
implementation('no.tornado:tornadofx-controls:1.0.4')
- implementation('com.google.zxing:javase:3.4.0') {
+ implementation('com.google.zxing:javase:3.5.4') {
exclude group: 'com.beust', module: 'jcommander'
}
implementation('org.jcommander:jcommander:2.0')
Why this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.