What the developer wrote
Authored by Craig Raw
upgrade gson to v2.13.2
What changed, and why it matters
This commit updates the Google Gson library used by the Sparrow Wallet project from version 2.9.1 to 2.13.2. Gson is a widely-used library that converts Java objects to and from JSON data. Upgrading a dependency across several minor and patch versions often includes bug fixes and security fixes, but the commit message itself does not say this is a security update. Without a vendor statement or a known CVE tied to this specific upgrade, we cannot confirm it fixes a specific vulnerability, though it is a prudent maintenance change.
Treat this as routine dependency maintenance. Review the Gson release notes between 2.9.1 and 2.13.2 to identify any security-relevant fixes, and verify the upgraded version passes existing tests. No immediate incident response is warranted based solely on this commit.
Security signals we found
Dependency version bump of a widely-used serialization library (Gson)
Large version gap (2.9.1 -> 2.13.2) suggests potential accumulation of fixes, possibly including security fixes
No explicit security context, CVE reference, or advisory link in commit message
Evidence from the diff
The change is a single-line dependency bump in build.gradle: com.google.code.gson:gson is upgraded from 2.9.1 to 2.13.2. Gson 2.10 through 2.13.2 introduced multiple changes, including deserialization hardening and fixes for edge cases in reflection-based type handling. The diff provides no direct evidence of a security flaw in Sparrow Wallet itself, nor does it identify a specific CVE being remediated. The upgrade is consistent with routine dependency hygiene that may incidentally close known Gson issues, but the commit does not disclose which ones.
Changed components
build.gradle dependency declarationcom.google.code.gson:gson libraryInspect captured patch +1 / −1
diff --git a/build.gradle b/build.gradle
index b99f401..ba54d6d 100644
--- a/build.gradle
+++ b/build.gradle
@@ -45,7 +45,7 @@ dependencies {
implementation(project(':drongo'))
implementation(project(':lark'))
implementation('com.google.guava:guava:33.5.0-jre')
- implementation('com.google.code.gson:gson:2.9.1')
+ implementation('com.google.code.gson:gson:2.13.2')
implementation('com.h2database:h2:2.1.214')
implementation('com.zaxxer:HikariCP:7.0.2') {
exclude group: 'org.slf4j'
Why this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.