fix: mark manifest-declared broadcast receivers as non-exported to prevent other apps from sending spoofed broadcasts

Author: sunil-lakshman

CHANGELOG.md

@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## Version 4.2.1
+
+### Date: 14-Apr-2026
+
+- Security: mark manifest-declared broadcast receivers as non-exported to prevent other apps from sending spoofed broadcasts.
+
 ## Version 4.2.0
 
 ### Date: 02-Mar-2026

contentstack/build.gradle

@@ -7,7 +7,7 @@ plugins {
 ext {
     PUBLISH_GROUP_ID = 'com.contentstack.sdk'
     PUBLISH_ARTIFACT_ID = 'android'
-    PUBLISH_VERSION = '4.2.0'
+    PUBLISH_VERSION = '4.2.1'
 }
 
 android {

contentstack/src/main/AndroidManifest.xml

@@ -10,15 +10,15 @@
         <receiver
             android:name="com.contentstack.sdk.ConnectionStatus"
             android:enabled="true"
-            android:exported="true">
+            android:exported="false">
             <intent-filter>
                 <action android:name="android.net.conn.CONNECTIVITY_CHANGE" />
             </intent-filter>
         </receiver>
         <receiver
             android:name="com.contentstack.sdk.ClearCache"
             android:enabled="true"
-            android:exported="true">
+            android:exported="false">
             <intent-filter>
                 <action android:name="StartContentStackClearingCache" />
             </intent-filter>