Lint plugin uses vulnerable jgit version (CVE-2025-4949) #434
Description
The Gradle Lint plugin currently depends on a version of jgit that is affected by CVE-2025-4949.
This vulnerability has already been addressed in newer jgit versions (7.2.1 and 6.10.1), but the fix has not been backported to the 5.x series of jgit, which is no longer maintained.
The Gradle project itself has tracked the issue and fixed it here: jgit CVE-2025-4949 #33929