Repository navigation
guava fixes - #683
guava fixes#683AbhishekKumar9984 wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates the Guava dependency version across multiple POM files to use the ${guava.version} property. The review feedback points out that specifying the version in the submodules is redundant due to parent dependency management. Additionally, the selected Guava version (32.0.0-jre) is vulnerable to CVE-2023-2976, and it is recommended to upgrade to a secure version like 32.1.3-jre and ensure consistency across all profiles.
| <dependency> | ||
| <groupId>com.google.guava</groupId> | ||
| <artifactId>guava</artifactId> | ||
| <version>${guava.version}</version> | ||
| </dependency> |
There was a problem hiding this comment.
The version of com.google.guava:guava is already managed in the parent POM's <dependencyManagement> section. Specifying the version here is redundant and can be safely removed to simplify dependency management.
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
</dependency>
| <dependency> | ||
| <groupId>com.google.guava</groupId> | ||
| <artifactId>guava</artifactId> | ||
| <version>31.0.1-jre</version> | ||
| <version>${guava.version}</version> | ||
| </dependency> |
There was a problem hiding this comment.
The version of com.google.guava:guava is already managed in the parent POM's <dependencyManagement> section. Specifying the version here is redundant and can be safely removed to simplify dependency management.
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
</dependency>
| <cdap.version>6.11.0</cdap.version> | ||
| <cdap.plugin.version>2.13.1</cdap.plugin.version> | ||
| <guava.version>13.0.1</guava.version> | ||
| <guava.version>32.0.0-jre</guava.version> |
There was a problem hiding this comment.
Guava version 32.0.0-jre is vulnerable to CVE-2023-2976 (local information disclosure via default temporary directory). It is highly recommended to use a secure version such as 32.1.3-jre (or at least 32.0.1-jre) to mitigate this vulnerability.
| <guava.version>32.0.0-jre</guava.version> | |
| <guava.version>32.1.3-jre</guava.version> |
| <testSourceLocation>src/e2e-test/java</testSourceLocation> | ||
| <TEST_RUNNER>TestRunner.java</TEST_RUNNER> | ||
| <guava.version>32.1.2-jre</guava.version> | ||
| <guava.version>32.0.0-jre</guava.version> |
No description provided.