Repository navigation
Android: add Solana and Bitcoin extensions, remove oidc module, bump nimbus-jose-jwt - #64
Open
jerry-payward wants to merge 3 commits into
Open
jerry-payward wants to merge 3 commits into
jerry-payward wants to merge 3 commits into
Conversation
Delete magic/ext/oidc and its settings entry. Drop the OpenID login button, inputs, handler and strings from the example app, along with the magic-ext-oidc dependency. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Mirrors @magic-ext/solana and @magic-ext/bitcoin, and the iOS SDK change. Pass SolanaConfiguration and BitcoinConfiguration to the Magic constructor, then use magic.solana and magic.bitcoin (null unless configured). Solana methods send an object for params, which web3j's Request cannot hold, so RpcProvider gets an internal sendAsync for that. Bytes use the mgbox typed-array format. Also stop RpcProvider from deleting every escaped newline from the message. That changed any multi-line text to sign (for example a Sign-In With Solana message). The newlines came from the wrapped base64 in the URL params, so the params are now encoded with NO_WRAP. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
9.31 is affected by CVE-2023-52428 and CVE-2025-53864. Both are fixed in 10.10. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
jerry-payward
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@magic-ext/solanaand@magic-ext/bitcoinand the iOS SDK.Magictakes anextensionslist, and exposesmagic.solanaandmagic.bitcoin.magic/ext/oidcmodule and its OpenID login UI and dependency in the example app.nimbus-jose-jwtfrom 9.31 to 10.10, which fixes CVE-2023-52428 and CVE-2025-53864.Solana and Bitcoin details
ObjectParamsRequestand an internal object-paramssendAsyncinRpcProvider, because Solana and Bitcoin send an object asparamsand web3j'sRequestonly takes a list. The existing list path is unchanged.TypedArraycarries the mgbox typed-array wire format through a Gson@JsonAdapter.extin the URL options.RpcProvider: it ran.replace("\\n", "")over the whole message, which deleted newlines from text to sign. The relayer URL now usesBase64.NO_WRAPinstead.4.8.8-android.4.12.3-androidis published without a dependency list and does not compile with the SDK, so it would be a breaking change.Testing
:magic:coreunit tests pass (17 new and 1 existing).:magic:core:assembleRelease,:magic:ext:oauthand:exampleassemble.revealPrivateKey, and the DPoP signing with the new nimbus. The example app was not run on a device and has no Solana or Bitcoin screens yet.Notes
link.magic:magic-ext-oidcartifact stays on Maven Central. This PR only stops the repo from building it.🤖 Generated with Claude Code