I am maintaining and Android app that now suffers from an unsafe X509 TrustManager implementation. Since the app doesn't make any HTTPS calls except through dependencies, one of the dependencies is causing the issue.
The problem is that I don't know what any of these dependencies are for (there are ~20) except for one, which is a simple "social (Facebook, Twitter) button" library. I looked through the source code of that one, because it was small enough, and it's not the issue.
Some of the dependencies are packaged through Maven so I can't browse their source, and some of them are no longer on Github (the library was OS, but eventually scrapped).
Many of the dependencies make HTTP(S) requests, which is causing the X509TrustManager error. How can I figure out which one is causing the error without having the source?