v2.28.1 (#1009)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: davidliu

.changeset/bump-protobuf-javalite.md

@@ -1,5 +1,13 @@
 # client-sdk-android
 
+## 2.28.1
+
+### Patch Changes
+
+- Bumped protobuf-javalite to 3.25.9, which fixes the unbounded parser recursion reported as CVE-2024-7254. - [#1002](https://github.com/livekit/client-sdk-android/pull/1002) ([@adrian-niculescu](https://github.com/adrian-niculescu))
+
+- Fix CachingTokenSource treating a JWT with no exp as still valid, so a token that never expires stays cached forever. Require exp; keep nbf optional. - [#1008](https://github.com/livekit/client-sdk-android/pull/1008) ([@SashaMIT](https://github.com/SashaMIT))
+
 ## 2.28.0
 
 ### Minor Changes

.changeset/token-source-require-exp.md

@@ -49,7 +49,7 @@ LiveKit for Android is available as a Maven package.
 ```groovy title="build.gradle"
 ...
 dependencies {
-  def livekit_version = "2.28.0"
+  def livekit_version = "2.28.1"
 
   implementation "io.livekit:livekit-android:$livekit_version"
 
@@ -60,7 +60,7 @@ dependencies {
   implementation "io.livekit:livekit-android-track-processors:$livekit_version"
 
   // Snapshots of the latest development version are available at:
-  // implementation "io.livekit:livekit-android:2.28.1-SNAPSHOT"
+  // implementation "io.livekit:livekit-android:2.28.2-SNAPSHOT"
 }
 ```
 

CHANGELOG.md

@@ -33,7 +33,7 @@ kapt.use.worker.api=true
 ###############################################################
 
 GROUP=io.livekit
-VERSION_NAME=2.28.0
+VERSION_NAME=2.28.1
 
 POM_DESCRIPTION=LiveKit Android SDK, WebRTC Rooms
 

README.md

@@ -1,6 +1,6 @@
 {
   "name": "client-sdk-android",
-  "version": "2.28.0",
+  "version": "2.28.1",
   "repository": "https://github.com/livekit/client-sdk-android.git",
   "license": "Apache License 2.0",
   "private": true,