scan-gradle-plugin VS play-services-plugins

It's been over a year since the release of the open source Gradle plugin to scan, evaluate, and audit Gradle project dependencies aiming to keep developers safe from any vulnerabilities such libraries could bring: https://github.com/sonatype-nexus-community/scan-gradle-plugin

Android is basically open source at the bare minimum. To use Android in a meaningful way, you need Google Play Services, which are proprietary and have root privileges on most Android phones (allowing Google to collect a lot of private data easily). The only ROMs I know of which utilise Sandboxed Google Play Services are GrapheneOS and ProtonAOSP. microG exists on CalyxOS and /e/ OS, but it will never be as compatible as Google Play Services.

One problem with relying on emulation is that Google has moved a lot of functionality from the open source Android layer to Google Play Services, and they obviously wont publish that on someone else's platform.

https://developers.google.com/android/guides/overview

The main privacy concern with most Android devices is that they usually include Google Play Services.

Here's an overview: https://developers.google.com/android/guides/overview

Yeah, frustrating I know. I actually made a PR 5 months ago (based on another) to introduce the ability to add libraries if they don’t have it included in their POM. Our use case was that we used a web view with local JS files that we needed to attribute to.