Repository navigation
guava fixes - #683
guava fixes#683AbhishekKumar9984 wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Guava dependency version across multiple POM files to use the ${guava.version} property. The review feedback points out that specifying the version in the submodules is redundant due to parent dependency management. Additionally, the selected Guava version (32.0.0-jre) is vulnerable to CVE-2023-2976, and it is recommended to upgrade to a secure version like 32.1.3-jre and ensure consistency across all profiles.
fixes3 fixes34 fixes343
2a7fcbb to
f10f18c
Compare
deepika-lalwani123
left a comment
deepika-lalwani123
left a comment
There was a problem hiding this comment.
This depends on cdapio/cdap#16279. The currently published 6.12.0-SNAPSHOT still has Guava 13, so this PR cannot be validated or merged until that PR merges and CDAP (and Twill) are published. Please call out the dependency in the PR description.
|
@deepika-lalwani123 Updated the PR description to explicitly call out the dependency on cdapio/cdap#16279, and addressed all inline review comments. |
Depends on: cdapio/cdap#16279
Issue :
Resolved security vulnerabilities (CVE-2023-2976 / CVE-2020-8908) associated with older versions of
com.google.guava:guava(13.0.1/31.x) pulled in directly and transitively across database plugins.Root Cause :
Root and submodule POMs referenced older Guava versions (
13.0.1,31.0.1-jre,31.1-jre), and CDAP, Hadoop, and CloudSQL socket-factory dependencies transitively brought in conflicting older versions of Guava causing compilation and test issues.Fix :
<guava.version>to32.0.0-jreand pinnedcom.google.guava:guavain root<dependencyManagement>(removing redundant submodule version overrides and thee2e-testsprofile override).maven-enforcer-plugin(requireUpperBoundDeps) forcom.google.guava:guava.<cdap.version>from6.11.0to6.12.0-SNAPSHOT.Testing evidence: https://docs.google.com/spreadsheets/d/1Cw6Z_k3wlks7sAC4-Kg6FTIMRL7-zxLlsJIXvVJLrb8/edit?gid=0#gid=0