Update Guava version - currently the latest released version 3.3.2 mentions Guava version that has known vulnerability.
Closed this issue · 2 comments
michaelszymczak commented
The currently released artifact (3.3.2) mentions (./META-INF/maven/com.google.guava/guava/pom.xml) the version 31.1-jre of guava that has a know vulnerability https://www.cve.org/CVERecord?id=CVE-2023-2976.
It would be great to update it to the latest version of guava that fixed it (e.g. 32.0.1-jre)
cpovirk commented
Released and in Maven Central.
[edit: OK, the Maven Central browsing wasn't showing it when I posted. But the release appeared in the metadata, which is what counts IIUC.]
michaelszymczak commented
Indeed, the latest release 3.3.3 fetches the latest Guava, many thanks for the quick turnaround!