[A-EDev]

Summary

parseEntry accepted a negative seq or epoch.n (the reference requires at least 0, Flow Desktop reads them as unsigned). One such entry held from a WebDAV folder or a LAN peer made resolveForks return no chain at all, hiding the whole roster. Both are now refused as malformed. Found by a 20,000-case fork property.

Related issue

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• ./gradlew :app:assembleGithubDebug: not run locally, no app code outside sync2 changed; CI builds the APK
• ./gradlew --offline :app:testGithubDebugUnitTest --tests 'io.github.aedev.flow.sync2.*' --tests 'io.github.aedev.flow.sync.*': 158 sync2 and 162 sync tests, 0 failures. New RosterTest case: before, resolveForks returned []; after, the entry is refused and the chain resolves
• ./gradlew --offline ktlintCheck: passed
• I manually tested the affected behavior on an Android device or emulator.

Test device and Android version: not device-tested

Risk and compatibility

No behaviour change for valid entries.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources.
• Dependency and lockfile changes are intentional and limited to this PR.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.