Skip to content

v5.55.10

Choose a tag to compare

View all tags
@jamesnrokt jamesnrokt released this 04 Sep 21:43
v5.55.10
dee59ca
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Backports the GoDaddy R1 certificate pin to the 5.55.x line.

GoDaddy has ended DV issuance under its G2 hierarchy, and mParticle endpoints are moving
to leaves issued under GoDaddy TLS Intermediate CA DV - R1v1. Versions before 5.58.0
replace the system trust store with a pinned set whose only usable anchor is the Go Daddy
G2 intermediate, so they cannot build a path to an R1 chain and fail closed — config
fetch is the SDK's first request, so an affected app degrades immediately.

This brings the 5.55.x default pin set to the same six roots as 6.0.4, backporting #504
(5.58.0) and #766 (6.0.3).

Updating

implementation 'com.mparticle:android-core:5.55.10'

Declare android-core explicitly. Kits declare core as a minimum rather than a hard pin,
so bumping only kit versions leaves Gradle resolving the older core and the fix does not
take effect.

Notes

  • Trust is wider than 5.55.9. That version effectively trusted one CA; this one trusts
    five, including Let's Encrypt roots. This matches the upstream set unchanged since
    5.58.0. The expired DO_NOT_TRUST_FiddlerRoot debug anchor is removed.
  • Anyone on 5.58.0 or later already has this fix and needs no action.
Assets 228
Loading