Sulkta-OSS/straw

Fork 0

Update kotlin [SECURITY] #30

Open

renovate wants to merge 1 commit from renovate/kotlin into main

renovate commented

2026-09-07 23:24:44 -07:00

Member

This PR contains the following updates:

Package	Type	Update	Change
org.jetbrains.kotlin:kotlin-gradle-plugin (source)	dependencies	minor	`2.3.21` → `2.4.20`
org.jetbrains.kotlin.plugin.serialization	plugin	minor	`2.3.21` → `2.4.21`
org.jetbrains.kotlin.plugin.parcelize	plugin	minor	`2.3.21` → `2.4.21`
org.jetbrains.kotlin.multiplatform	plugin	minor	`2.3.21` → `2.4.21`
org.jetbrains.kotlin.jvm	plugin	minor	`2.3.21` → `2.4.21`
org.jetbrains.kotlin.plugin.compose	plugin	minor	`2.3.21` → `2.4.21`
org.jetbrains.kotlin:kotlin-test (source)	dependencies	minor	`2.3.21` → `2.4.21`

JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

CVE-2026-53914 / GHSA-r937-wjx7-w2jp

More information

Details

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

Severity

CVSS Score: 6.7 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [org.jetbrains.kotlin:kotlin-gradle-plugin](https://kotlinlang.org/) ([source](https://github.com/JetBrains/kotlin)) | dependencies | minor | `2.3.21` → `2.4.20` | | org.jetbrains.kotlin.plugin.serialization | plugin | minor | `2.3.21` → `2.4.21` | | org.jetbrains.kotlin.plugin.parcelize | plugin | minor | `2.3.21` → `2.4.21` | | org.jetbrains.kotlin.multiplatform | plugin | minor | `2.3.21` → `2.4.21` | | org.jetbrains.kotlin.jvm | plugin | minor | `2.3.21` → `2.4.21` | | org.jetbrains.kotlin.plugin.compose | plugin | minor | `2.3.21` → `2.4.21` | | [org.jetbrains.kotlin:kotlin-test](https://kotlinlang.org/) ([source](https://github.com/JetBrains/kotlin)) | dependencies | minor | `2.3.21` → `2.4.21` | --- ### JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution [CVE-2026-53914](https://nvd.nist.gov/vuln/detail/CVE-2026-53914) / [GHSA-r937-wjx7-w2jp](https://github.com/advisories/GHSA-r937-wjx7-w2jp) <details> <summary>More information</summary> #### Details In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata #### Severity - CVSS Score: 6.7 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-53914](https://nvd.nist.gov/vuln/detail/CVE-2026-53914) - [https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6](https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6) - [https://github.com/JetBrains/kotlin](https://github.com/JetBrains/kotlin) - [https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1](https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1) - [https://www.jetbrains.com/privacy-security/issues-fixed](https://www.jetbrains.com/privacy-security/issues-fixed) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r937-wjx7-w2jp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-09-07 23:24:44 -07:00

chore(deps): update kotlin to v2.4.20 [security] 1b378065b6

renovate force-pushed renovate/kotlin from 1b378065b6 to b9dfab7d86

2026-10-08 23:48:20 -07:00

Compare

renovate changed title from ~~chore(deps): update kotlin to v2.4.20 [security]~~ to chore(deps): update kotlin [security]

2026-10-08 23:48:40 -07:00

renovate force-pushed renovate/kotlin from b9dfab7d86 to 1e2054c100

2026-10-22 23:16:01 -07:00

Compare

renovate force-pushed renovate/kotlin from 1e2054c100 to f9174af927

2026-10-23 23:18:27 -07:00

Compare

renovate changed title from ~~chore(deps): update kotlin [security]~~ to Update kotlin [SECURITY]

2026-10-24 23:16:48 -07:00

renovate force-pushed renovate/kotlin from f9174af927 to 9bccecc648

2026-10-24 23:16:49 -07:00

Compare

renovate force-pushed renovate/kotlin from 9bccecc648 to e57374e207

2026-10-26 23:18:47 -07:00

Compare

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/kotlin:renovate/kotlin

git checkout renovate/kotlin

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Sulkta-OSS/straw#30

No description provided.

Rows
Columns