Update dependency com.google.crypto.tink:tink-android to v1.24.0 #24

2026-10-17T04:01:45+02:00

bot commented

2026-10-17 04:01:45 +02:00

This PR contains the following updates:

Package	Type	Update	Change
com.google.crypto.tink:tink-android	dependencies	minor	`1.23.0` → `1.24.0`

Release Notes

tink-crypto/tink-java (com.google.crypto.tink:tink-android)

`v1.24.0`: Tink Java v1.24.0

Tink is a multi-language, cross-platform library that provides simple and
misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.24.0

The complete list of changes since 1.23.0 can be found here.

New Features

APIs which depend on what algorithms are registered now have an overload taking a configuration argument. Using these overloads allows to ensure that behavior is independent of what else is linked in the binary. For example, instead of keysetHandle.getPrimitive(Aead.class), users can now write keysetHandle.getPrimitive(TinkConfig2026.get(), Aead.class). Similary for key generation and serialization of keysets.

The following configs are available: AeadConfig2026 (which does not contain the KMS algorithms; use KmsAeadConfig2026 for those), DeterministicAeadConfig2026, HybridConfig2026, JwtConfig2026, KeyDerivationConfig2026, MacConfig2026, PrfConfig2026, SignatureConfig2026, StreamingAeadConfig2026. In addition, TinkConfig2026 contains all of the above algorithms (except the KMS algorithms). Finally, RegistryConfiguration.java is available to make previous behavior (examining the registered algorithms) explicit.

Finally, the Configuration interface needed to implement new behavior is completely public, and users can implement it themselves.
Added support for JWT ML-DSA signatures.
Added support for MLDSA44-Ed25519-SHA512 and MLDSA65-Ed25519-SHA512 Composite ML-DSA algorithms.
X-Wing HPKE is now also available on Android. In particular, it is available natively on Android 17 (or above), or otherwise on Android 12 (or above) with SDK Extensions version 22 or later.
Added predefined HPKE parameters.
Added the Prehash primitive interface for computing prehashes of messages, to support the prehash-and-sign paradigm (such as ML-DSA External Mu).
Updated 'org.conscrypt:conscrypt-openjdk-uber' to version 2.7.0.

Changes

Changed the named parameter name for SLH-DSA-SHA2-128S with Tink output prefix type from SLH_DSA_SHA2_128S_TINK to SLH_DSA_SHA2_128S for consistency with the other Tink languages.
In SignaturePemKeysetReader, treat Base64 decoding failures like other PEM key parsing errors.
In SignaturePemKeysetReader, continue parsing multi-key PEM bundles after encountering an unparsable key.
In SignaturePemKeysetReader, preserve the parsed RSA public exponent when importing RSA public keys instead of hardcoding 65537 (F4).
Fixed unchecked runtime exceptions in JwkSetConverter.toPublicKeysetHandle and SignatureJwkSetConverter.toPublicKeysetHandle when importing malformed JWK sets, ensuring they consistently throw a GeneralSecurityException.
Validate coordinate lengths against curve field size in JwkSetConverter and SignatureJwkSetConverter.
Fixed unchecked runtime exceptions in JsonKeysetReader.read and JsonKeysetReader.readEncrypted when reading malformed keysets, ensuring they consistently throw an IOException.
AesGcmSiv now uses Conscrypt if it's available on the class path, even if it is not installed. Previously, a Conscrypt provider needed to be installed for it to work.
Enforce canonical Base64url encoding in JwtFormat.strictUrlSafeDecode, preventing signature/MAC malleability from unused trailing bits.
Fixed StreamingAeadSeekableDecryptingChannel.read to always authenticate the final ciphertext segment when reaching the end of the plaintext, ensuring valid empty plaintexts return -1 (EOF) and rejecting truncated or unauthenticated empty trailing segments with an IOException.

Maven:

<dependency>
    <groupId>com.google.crypto.tink</groupId>
    <artifactId>tink</artifactId>
    <version>1.24.0</version>
</dependency>

Gradle:

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.24.0'
}

Bazel:

Using bzlmod

bazel_dep(name = "tink_java")

git_override(
    module_name = "tink_java",
    remote = "https://github.com/tink-crypto/tink-java",
    tag = "v1.24.0",
)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [com.google.crypto.tink:tink-android](https://github.com/tink-crypto/tink-java) | dependencies | minor | `1.23.0` → `1.24.0` | --- ### Release Notes <details> <summary>tink-crypto/tink-java (com.google.crypto.tink:tink-android)</summary> ### [`v1.24.0`](https://github.com/tink-crypto/tink-java/releases/tag/v1.24.0): Tink Java v1.24.0 Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks. **This is Tink Java 1.24.0** The complete list of changes since 1.23.0 can be found [here](https://github.com/tink-crypto/tink-java/compare/v1.23.0...v1.24.0). #### New Features - APIs which depend on what algorithms are registered now have an overload taking a configuration argument. Using these overloads allows to ensure that behavior is independent of what else is linked in the binary. For example, instead of `keysetHandle.getPrimitive(Aead.class)`, users can now write `keysetHandle.getPrimitive(TinkConfig2026.get(), Aead.class)`. Similary for key generation and serialization of keysets. The following configs are available: `AeadConfig2026` (which does not contain the KMS algorithms; use `KmsAeadConfig2026` for those), `DeterministicAeadConfig2026`, `HybridConfig2026`, `JwtConfig2026`, `KeyDerivationConfig2026`, `MacConfig2026`, `PrfConfig2026`, `SignatureConfig2026`, `StreamingAeadConfig2026`. In addition, `TinkConfig2026` contains all of the above algorithms (except the KMS algorithms). Finally, `RegistryConfiguration.java` is available to make previous behavior (examining the registered algorithms) explicit. Finally, the `Configuration` interface needed to implement new behavior is completely public, and users can implement it themselves. - Added support for `JWT ML-DSA` signatures. - Added support for `MLDSA44-Ed25519-SHA512` and `MLDSA65-Ed25519-SHA512` Composite ML-DSA algorithms. - X-Wing HPKE is now also available on Android. In particular, it is available natively on Android 17 (or above), or otherwise on Android 12 (or above) with SDK Extensions version 22 or later. - Added predefined HPKE parameters. - Added the `Prehash` primitive interface for computing prehashes of messages, to support the prehash-and-sign paradigm (such as ML-DSA External Mu). - Updated 'org.conscrypt:conscrypt-openjdk-uber' to version 2.7.0. #### Changes - Changed the named parameter name for SLH-DSA-SHA2-128S with Tink output prefix type from `SLH_DSA_SHA2_128S_TINK` to `SLH_DSA_SHA2_128S` for consistency with the other Tink languages. - In `SignaturePemKeysetReader`, treat Base64 decoding failures like other PEM key parsing errors. - In `SignaturePemKeysetReader`, continue parsing multi-key PEM bundles after encountering an unparsable key. - In `SignaturePemKeysetReader`, preserve the parsed RSA public exponent when importing RSA public keys instead of hardcoding `65537` (`F4`). - Fixed unchecked runtime exceptions in `JwkSetConverter.toPublicKeysetHandle` and `SignatureJwkSetConverter.toPublicKeysetHandle` when importing malformed JWK sets, ensuring they consistently throw a `GeneralSecurityException`. - Validate coordinate lengths against curve field size in `JwkSetConverter` and `SignatureJwkSetConverter`. - Fixed unchecked runtime exceptions in `JsonKeysetReader.read` and `JsonKeysetReader.readEncrypted` when reading malformed keysets, ensuring they consistently throw an `IOException`. - `AesGcmSiv` now uses Conscrypt if it's available on the class path, even if it is not installed. Previously, a Conscrypt provider needed to be installed for it to work. - Enforce canonical Base64url encoding in `JwtFormat.strictUrlSafeDecode`, preventing signature/MAC malleability from unused trailing bits. - Fixed `StreamingAeadSeekableDecryptingChannel.read` to always authenticate the final ciphertext segment when reaching the end of the plaintext, ensuring valid empty plaintexts return `-1` (EOF) and rejecting truncated or unauthenticated empty trailing segments with an `IOException`. ##### Maven: ``` <dependency> <groupId>com.google.crypto.tink</groupId> <artifactId>tink</artifactId> <version>1.24.0</version> </dependency> ``` ##### Gradle: ``` dependencies { implementation 'com.google.crypto.tink:tink-android:1.24.0' } ``` ##### Bazel: ##### Using bzlmod ``` bazel_dep(name = "tink_java") git_override( module_name = "tink_java", remote = "https://github.com/tink-crypto/tink-java", tag = "v1.24.0", ) ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

bot added 1 commit 2026-10-17 04:01:46 +02:00

Update dependency com.google.crypto.tink:tink-android to v1.24.0 2044caeb1a

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/com.google.crypto.tink-tink-android-1.x:renovate/com.google.crypto.tink-tink-android-1.x

git checkout renovate/com.google.crypto.tink-tink-android-1.x

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: helcel/cowspent#24