From 588d96af722b72b92bbdb78f0de0a479b7b7f86a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 23:14:06 +0000 Subject: [PATCH 1/2] build(deps): bump the gradle-minor-and-patch group with 2 updates Bumps the gradle-minor-and-patch group with 2 updates: [gradle-wrapper](https://github.com/gradle/gradle) and [org.jetbrains.kotlinx:kotlinx-serialization-json](https://github.com/Kotlin/kotlinx.serialization). Updates `gradle-wrapper` from 9.8.1 to 9.8.2 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](https://github.com/gradle/gradle/compare/v9.8.1...v9.8.2) Updates `org.jetbrains.kotlinx:kotlinx-serialization-json` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/Kotlin/kotlinx.serialization/releases) - [Changelog](https://github.com/Kotlin/kotlinx.serialization/blob/master/CHANGELOG.md) - [Commits](https://github.com/Kotlin/kotlinx.serialization/compare/v1.11.0...v1.12.0) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: org.jetbrains.kotlinx:kotlinx-serialization-json dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch ... Signed-off-by: dependabot[bot] --- gradle/libs.versions.toml | 2 +- gradle/wrapper/gradle-wrapper.properties | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 1d37314de..01560bd45 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -16,7 +16,7 @@ appcompat = "1.8.0" core-ktx = "1.19.1" kotlin = "2.4.21" kotlinx-coroutines = "1.11.0" -kotlinx-serialization = "1.11.0" +kotlinx-serialization = "1.12.0" ktor = "3.6.0" lifecycle-extensions = "2.2.0" lifecycle-viewmodel-ktx = "2.11.0" diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties index 2e7bb9fd6..91c4fc64a 100644 --- a/gradle/wrapper/gradle-wrapper.properties +++ b/gradle/wrapper/gradle-wrapper.properties @@ -1,6 +1,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.1-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip networkTimeout=10000 retries=0 retryBackOffMs=500 From 88f25929ce3262aa8f0954f55297a0b34986c327 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enrique=20Lo=CC=81pez=20Man=CC=83as?= Date: Wed, 28 Oct 2026 11:31:30 +0100 Subject: [PATCH 2/2] fix(data): align JSON nesting limit with maxStructuralDepth kotlinx-serialization 1.12.0 caps JSON nesting at 400 by default, which is stricter than the parser's own maxStructuralDepth (512 by default). Configure the Json instance with maxNestingDepth = maxStructuralDepth so checkStructuralDepth stays the single bound on nesting and custom values above 400 are still honoured. --- .../maps/android/data/parser/geojson/GeoJsonParser.kt | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/data/src/main/java/com/google/maps/android/data/parser/geojson/GeoJsonParser.kt b/data/src/main/java/com/google/maps/android/data/parser/geojson/GeoJsonParser.kt index 6f672aaa7..c0e9f4392 100644 --- a/data/src/main/java/com/google/maps/android/data/parser/geojson/GeoJsonParser.kt +++ b/data/src/main/java/com/google/maps/android/data/parser/geojson/GeoJsonParser.kt @@ -15,6 +15,7 @@ */ package com.google.maps.android.data.parser.geojson +import kotlinx.serialization.ExperimentalSerializationApi import kotlinx.serialization.json.Json import kotlinx.serialization.json.JsonElement import kotlinx.serialization.json.JsonNull @@ -29,6 +30,11 @@ public class GeoJsonParser @JvmOverloads public constructor( private val maxInputSize: Long = DEFAULT_MAX_INPUT_SIZE, private val maxStructuralDepth: Int = DEFAULT_MAX_STRUCTURAL_DEPTH, ) { + // kotlinx.serialization enforces its own nesting limit (400 by default since 1.12.0). Align it + // with [maxStructuralDepth] so [checkStructuralDepth] remains the single bound on nesting. + @OptIn(ExperimentalSerializationApi::class) + private val jsonParser = Json { maxNestingDepth = maxStructuralDepth } + public fun parse(inputStream: InputStream): GeoJsonObject? { // Bound the untrusted input *before* materialising it. [Json.parseToJsonElement] reads the // whole document into an in-memory tree, so without these guards a hostile document can @@ -36,7 +42,7 @@ public class GeoJsonParser @JvmOverloads public constructor( // before the [MAX_GEOMETRY_DEPTH] check — which runs on the already-built tree — can act. val json = inputStream.readTextBounded(maxInputSize) checkStructuralDepth(json, maxStructuralDepth) - val jsonElement = Json.parseToJsonElement(json) + val jsonElement = jsonParser.parseToJsonElement(json) return when (jsonElement.jsonObject["type"]?.jsonPrimitive?.content) { "FeatureCollection" -> {