com.google.guava:guava library version update
MaskedRedstonerProZ opened this issue · 2 comments
The current version of guava contained in the project contains a vulnerability (CVE-2023-2976). As that has been fixed in a later version of guava, I believe said later version should be integrated into the Truth project. Something which I believe to be able and am willing to do as my contribution to the project.
I believe that Truth 1.2.0 depends on Guava 33.0.0, which is not vulnerable. Can you point me to where you're seeing another version?
Apologies sir, my IDE failed to notify me of a new update in the truth library, the vulnerable guava version is seen in truth 1.1.3, as such, I assumed it was the latest one, and didn't notice the releases. I will try to figure out what the issue is, and why my IDE didn't flag truth 1.1.3 as outdated and update it, I will also close this issue if you don't mind