Róbert Papp

We can rule out part of 2. with https://github.com/cashapp/paparazzi/compare/gpowell/sample-widget-render-extension?expand=1

Note that all of those vulnerabilities are patched in the corresponding latest libs. So maybe exposing newer versions of those transitive deps from paparazzi is a solution?

@jrodbx no, I think I was talking about the transitive deps ("corresponding"), so: [30.4.0-alpha08](https://mvnrepository.com/artifact/com.android.tools/sdk-common/30.4.0-alpha08) has a table showing * gson 2.8.6 (1 vul) -> 2.9.1 (0 vul), and if you...

Based on the above, my idea would be ```patch api deps.tools.common +// gson and xercesImpl is included because deps.tools.common is using vulnerable transitive dependencies, see https://github.com/cashapp/paparazzi/issues/363 +api deps.transitive.gson // depending...

I was just curious and wanted to see what's this, I don't have authority here 😅. Maintainers, I hope my review helped to move this along / prioritize it.

@geoff-powell the minThumbnailSize is not the minimum, it's exactly that height. It'll up/downscale. https://github.com/cashapp/paparazzi/compare/gpowell/sample-widget-render-extension?expand=1

This is still valid in 1.0 albeit in a slightly different way. Consider this extension: ```kotlin class ConstrainedSizeRenderExtension( @Dimension(unit = Dimension.DP) private val width: Float, @Dimension(unit = Dimension.DP) private val...

(I tried working around this by setting DeviceConfig, but it failed fast as I can't do it per-test.)

Point 4 would still make this practically unusable (the core of this report), as the that tiny cut-out (custom device screen) would be upscaled to 1000px wasting screen space, brain...

After some guessing and running `javac -X`, I managed to work around it by adding ``` // Workaround for https://github.com/cashapp/paparazzi/issues/362. "-Xlint:-classfile", ``` but obviously this just hides the problem (and...