Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade Guava to the latest version #3931

Closed
elefeint opened this issue Nov 12, 2018 · 3 comments
Closed

Upgrade Guava to the latest version #3931

elefeint opened this issue Nov 12, 2018 · 3 comments
Assignees
Labels
type: process A process-related concern. May include testing, release, or the like.

Comments

@elefeint
Copy link

elefeint commented Nov 12, 2018

Spring Cloud GCP uses google-cloud-bom for the common dependencies. We have recently turned on Snyk vulnerability detection, and it found a deserialization issue with Guava 20.0.
The recommended remediation step is to upgrade to 24.1.1 or higher.

Would it be possible to upgrade Guava version in google-cloud-clients POM?

Spring Cloud GCP tracking issue: spring-attic/spring-cloud-gcp#1207

@chingor13 chingor13 added the type: process A process-related concern. May include testing, release, or the like. label Nov 12, 2018
@sduskis
Copy link
Contributor

sduskis commented Nov 13, 2018

@elharo, can you please chime in?

@garrettjonesgoogle
Copy link
Member

A more recent version of grpc-java is using guava 26.0-android now, so we should bump to that.

@elharo
Copy link
Contributor

elharo commented Nov 14, 2018

I feel like we should upgrade everything or nothing. 26.0-android is likely strictly better but there's more than grpc to fix here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: process A process-related concern. May include testing, release, or the like.
Projects
None yet
Development

No branches or pull requests

5 participants