[hawkff]

Docs-only dependency and maintenance audit.

Key findings:

• Current pinned starifly/sing-box core lacks Hysteria2 Gecko min/max packet-size fields.
• Native Mieru work can reuse existing plugin-based MieruBean / MieruFmt / buildMieruConfig.
• Security follow-ups identified:
  • SnakeYAML unsafe subscription parsing
  • WebDAV credential/http policy
  • appendHttpProxy/local inbound auth risk
  • swapped geosite/geoip fallback URLs
• Build/toolchain mismatches documented.

No functional app changes in this PR.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8137114e-66ff-4525-9bcc-fafb8cdb33ff

📥 Commits

Reviewing files that changed from the base of the PR and between 9154efc and fa0a93f.

📒 Files selected for processing (1)

• docs/maintenance/dependency-audit.md

---

📝 Walkthrough

Summary by CodeRabbit

Documentation

• Added comprehensive dependency audit documentation recording app identity, Android build stack configuration, and dependency inventory along with relevant security and stability considerations to support ongoing maintenance planning.

Walkthrough

Adds a new file docs/maintenance/dependency-audit.md recording a full dependency audit for the maintenance/dependency-audit branch. It documents app identity, Android build stack versions, app and core Go dependency matrices, security findings, feature readiness blockers, recommended follow-up branches, acceptance criteria, and open verification items.

Changes

Dependency Audit Documentation

Layer / File(s)	Summary
App identity and build stack docs/maintenance/dependency-audit.md	Records the audit header with branch/base metadata, current package/version/signing identity with fork-compatibility caveats, and an Android build toolchain table (Gradle, AGP, Kotlin, KSP, SDK, NDK, build tools) showing current vs. latest-safe-target versions.
App and core dependency matrices docs/maintenance/dependency-audit.md	Documents the app-layer Android dependency matrix with risk annotations (YAML-adjacent libraries, okhttp alpha stability, Room/kryo migration sensitivity) and the core Go dependency section covering sing-box/libneko pinned commits, Go toolchain compatibility, and the confirmed Gecko/Hysteria2 obfs capability gap at the pinned commit.
Security findings, feature readiness, and follow-up plan docs/maintenance/dependency-audit.md	Documents four security-sensitive findings (SnakeYAML unsafe deserialization, WebDAV plaintext/http:// acceptance, LAN-exposure auth coupling, swapped geosite/geoip fallback URLs), DNS/routing informational defaults, feature-readiness blockers for Hysteria2 Gecko obfs and Mieru, MasterDnsVPN sidecar plan, ordered recommended update branches, acceptance criteria, and open items to verify before version bumps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

A rabbit checked the deps one day,
And wrote it all in markdown's way.
SnakeYAML lurks, WebDAV leaks,
The geoip URL swap speaks! 🐇
Now audit scrolls stand proud and bright,
Every version pinned just right.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[hawkff]

@coderabbitai full review

Please verify this PR is documentation-only and that the branch does not contain functional code, generated files, AppleDouble files, or unrelated formatting churn.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

REPO="hawkff/NekoBoxForAndroid"
PR=1

echo "=== PR metadata ==="
gh pr view "$PR" --repo "$REPO" --json title,state,baseRefName,headRefName,additions,deletions,changedFiles

echo ""
echo "=== Changed files ==="
gh pr diff "$PR" --repo "$REPO" --name-only

echo ""
echo "=== Commits ==="
gh pr view "$PR" --repo "$REPO" --json commits --jq '.commits[] | "\(.oid[0:8]) \(.messageHeadline)"'

echo ""
echo "=== Full diff (stat) ==="
gh pr diff "$PR" --repo "$REPO" -- --stat 2>/dev/null || true

Length of output: 993

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

REPO="hawkff/NekoBoxForAndroid"
PR=1

echo "=== Full diff ==="
gh pr diff "$PR" --repo "$REPO"

Length of output: 14949

---

---

@hawkff — review complete. Here is the full analysis:

---

Branch hygiene verification ✅

Check	Result
Files changed	1 — docs/maintenance/dependency-audit.md (new file, 210 additions, 0 deletions)
Functional code (.kt, .java, .gradle, .kts, .sh, .yml)	✅ None touched
Generated files	✅ None
AppleDouble files (.__*)	✅ None
Modifications to existing files	✅ None — net-new file only
Formatting churn on existing sources	✅ None
Commits	8e79da60 docs: add dependency and maintenance audit · fa0a93f5 docs: address review (NDK count, Go mismatch, code fence lang)

The branch is strictly documentation-only. Nothing else landed.

---

Content review

The document is well-structured with concrete file:line citations throughout. All findings are grounded in actual source references.

Accurate and actionable findings:

• SnakeYAML 1.30 / unsafe Yaml().loadAs() — CVE-2022-1471 class correctly identified; the cast-after-construction note is an important clarification that the Map cast does not mitigate the risk.
• WebDAV http:// + plaintext credentials — scheme check at BackupFragment.kt:212-213 and WebDAVSettingsActivity.kt:130 correctly noted.
• LAN inbound / auth coupling — the independent bind vs auth decision is correctly characterised; the note that starifly's existing prompt is a different (shallower) fix is accurate.
• Geosite/geoip URL swap (DataStore.kt:135-136) — clear, isolated, correct. Good candidate for an immediate tiny PR.
• Gecko obfs blocker — confirmed against the actual pinned commit hash (4998428a…); the absence of min_packet_size/max_packet_size in option/hysteria2.go is a real gap.
• okhttp 5.0.0-alpha.3 — correct concern; the 5.x alpha API surface is unstable.
• kryo / Room flagged as migration-sensitive — appropriate caution; serialised user data should never be casually bumped.
• NDK pinned in 3 places — .github/workflows/build.yml:63, .github/workflows/release.yml:65, buildScript/init/env_ndk.sh:13 — accurate count.

One minor precision point — Go toolchain description:

go.mod declares 1.24.x, CI uses ^1.25 — described as a "mismatch"

This is worth a small clarification. In Go 1.21+, the go line in go.mod is the minimum language version, and the toolchain line (toolchain go1.24.9) is a hint, not a hard pin — it is overridden by GOTOOLCHAIN=auto (the default) when the running toolchain is newer. CI using ^1.25 therefore does not necessarily conflict: Go 1.25 satisfies the go 1.24.7 minimum and silently replaces the toolchain hint. The practical consequence is that the module builds with 1.25 features available in CI but only 1.24 features guaranteed by the module declaration — a subtle portability gap, not a hard incompatibility. The existing wording ("Mismatch") is defensible as a flag for review, but a future branch PR should note this distinction when resolving it.

Unchecked acceptance criterion:

• [ ] CI still builds — expected for a docs-only branch with no build-triggering changes; confirm once the PR merges and CI runs on main (or manually trigger a no-op build).

---

Overall: The PR is clean and the audit document is a high-quality, well-cited reference. The recommended branch order (toolchain → geo URL fix → security → core → features) is sensible. Ready to approve.

[approve]