[cb-kedarborkar]

CHANGELOG

chore: upgrading chargebee-android version and remove vulnerability

SUMMARY

• Upgrading chargebee-android version to and remove vulnerability
• Upgraded Play Billing Library 8

FUNCTIONAL AUTOMATION CHANGES PR

• Yes
  • If Yes, PR :
• No
  • If No, Reason: no functional changes

AUTOMATION TEST REPORT URL

NA

AREAS OF IMPACT

Android in app purchase as there is a billing library upgrade involved

TYPE OF CHANGE

• 🐞 Bugfix
• 🌟 Feature
• ✨ Enhancement
• 🧪 Unit Test Cases
• 📔 Documentation
• ⚙️ Chore - Build Related / Configuration / Others

DOCUMENTATION

NA

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 2998bf8b-03f8-451a-8a0c-a3316c767844

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[snyk-io]

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (1)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
⛔	Secrets	0	1	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

Detected a generic secret, which could lead to unauthorized access and sensitive data exposure.

⚠️ 1 location in this file

CWE-798: Generic Secret Key | Learn more about this vulnerability

Details and remediation

Why this is dangerous

Attackers can discover hardcoded credentials in source code to gain unauthorized access, escalate privileges, steal data, or disrupt services. If you reuse credentials across systems or environments, the impact increases.

Immediate action

• Treat hardcoded credentials as compromised.
• Remove the credentials from the code.
• Rotate or revoke the credential and update all affected systems.
• Store the new secret in a secrets manager or vault, or inject the secret using environment variables at runtime.

Preventing future exposure

• Do not hardcode secrets.
• Use pre-commit hooks and automated secrets scanning to prevent accidental commits.
• Use secrets management tools, such as vaulting, environment injection, or secure configuration.
• Use least-privilege credentials and strong salted hashes for stored passwords.
• Add secure authentication practices to the development workflow.

You can view, fix, and ignore this issue in the Snyk Web UI