[AbhishekKumar9984]

Depends on: cdapio/cdap#16279

Issue :
Resolved security vulnerabilities (CVE-2023-2976 / CVE-2020-8908) associated with older versions of com.google.guava:guava (13.0.1) pulled in directly and transitively via plugin dependencies.

Root Cause :
pom.xml specified <guava.version>13.0.1</guava.version>, and hydrator-common, hydrator-test, and cdap-data-pipeline3_2.12 transitively brought in an older, vulnerable version of Guava.

Fix :

• Upgraded <guava.version> from 13.0.1 to 32.0.0-jre, pinned com.google.guava:guava in <dependencyManagement>, and added maven-enforcer-plugin (requireUpperBoundDeps).
• Updated <cdap.version> from 6.8.0 to 6.12.0-SNAPSHOT.

Testing evidence: https://docs.google.com/spreadsheets/d/1Cw6Z_k3wlks7sAC4-Kg6FTIMRL7-zxLlsJIXvVJLrb8/edit?gid=0#gid=0

[gemini-code-assist]

Code Review

This pull request updates dependency versions in pom.xml, including upgrading CDAP, Guava, and Hadoop, and adds exclusions for Guava in several dependencies. The review feedback points out that the selected Guava version (32.0.0-jre) has a known security vulnerability (CVE-2023-2976) and recommends upgrading to 32.1.3-jre instead.

[dheeraj-kholia-cs]

LGTM

[deepika-lalwani123]

This depends on cdapio/cdap#16279. The currently published 6.12.0-SNAPSHOT still has Guava 13, so this PR cannot be validated or merged until that PR merges and CDAP (and Twill) are published. Please call out the dependency in the PR description.

[AbhishekKumar9984]

@deepika-lalwani123 Updated the PR description to call out the dependency on cdapio/cdap#16279, and addressed all inline review comments.