Skip to content

guava fixes #683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AbhishekKumar9984 wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

guava fixes #683

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions cloudsql-mysql-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,11 @@
<artifactId>mysql-plugin</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>${guava.version}</version>
</dependency>
Comment on lines +85 to +89

@gemini-code-assist gemini-code-assist Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version of com.google.guava:guava is already managed in the parent POM's <dependencyManagement> section. Specifying the version here is redundant and can be safely removed to simplify dependency management.

    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
    </dependency>


<!-- test dependencies -->
<dependency>
Expand Down
2 changes: 1 addition & 1 deletion cloudsql-postgresql-plugin/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>31.0.1-jre</version>
<version>${guava.version}</version>
</dependency>
Comment on lines 85 to 89

@gemini-code-assist gemini-code-assist Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version of com.google.guava:guava is already managed in the parent POM's <dependencyManagement> section. Specifying the version here is redundant and can be safely removed to simplify dependency management.

    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
    </dependency>

<!-- test dependencies -->
<dependency>
Expand Down
6 changes: 3 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@
<!-- version properties -->
<cdap.version>6.11.0</cdap.version>
<cdap.plugin.version>2.13.1</cdap.plugin.version>
<guava.version>13.0.1</guava.version>
<guava.version>32.0.0-jre</guava.version>

@gemini-code-assist gemini-code-assist Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

Guava version 32.0.0-jre is vulnerable to CVE-2023-2976 (local information disclosure via default temporary directory). It is highly recommended to use a secure version such as 32.1.3-jre (or at least 32.0.1-jre) to mitigate this vulnerability.

Suggested change
<guava.version>32.0.0-jre</guava.version>
<guava.version>32.1.3-jre</guava.version>

<hadoop.version>3.3.6</hadoop.version>
<hsql.version>2.2.4</hsql.version>
<junit.version>4.13</junit.version>
Expand Down Expand Up @@ -613,7 +613,7 @@
<properties>
<testSourceLocation>src/e2e-test/java</testSourceLocation>
<TEST_RUNNER>TestRunner.java</TEST_RUNNER>
<guava.version>32.1.2-jre</guava.version>
<guava.version>32.0.0-jre</guava.version>

@gemini-code-assist gemini-code-assist Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

To maintain consistency and avoid using a vulnerable version of Guava, please align this version with the main guava.version property (e.g., 32.1.3-jre).

Suggested change
<guava.version>32.0.0-jre</guava.version>
<guava.version>32.1.3-jre</guava.version>

</properties>
<build>
<testResources>
Expand Down Expand Up @@ -713,7 +713,7 @@
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>31.1-jre</version>
<version>${guava.version}</version>
</dependency>
</dependencies>
</dependencyManagement>
Expand Down
Loading