Fix CVEs in hydrator-plugins via Guava dependency bump#1995
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Guava dependency version in pom.xml to 32.0.0-android. The review feedback correctly advises against hardcoding the version directly, which bypasses the central <guava.version> property. Additionally, the reviewer recommends using the -jre flavor (specifically 32.0.1-jre) instead of -android to prevent compilation or runtime issues from missing Java 8+ APIs and to avoid a known Windows issue in version 32.0.0.
| <groupId>com.google.guava</groupId> | ||
| <artifactId>guava</artifactId> | ||
| <version>${guava.version}</version> | ||
| <version>32.0.0-android</version> |
There was a problem hiding this comment.
Hardcoding the version here bypasses the <guava.version> property defined in the <properties> block (line 101), which is currently set to 13.0.1. This leaves an outdated and highly vulnerable version property in the POM, which could still be referenced by other submodules or profiles, defeating the CVE remediation.\n\nAdditionally, please use the -jre flavor (e.g., 32.0.1-jre) instead of -android. The -android flavor is designed for Java 7 and Android environments and lacks Java 8+ APIs, whereas this project compiles with Java 8. Furthermore, version 32.0.0 has a known issue on Windows that is resolved in 32.0.1.\n\nRecommendation:\n1. Update the <guava.version> property at line 101 to 32.0.1-jre.\n2. Keep using the property reference ${guava.version} here.
| <version>32.0.0-android</version> | |
| <version>${guava.version}</version> |
| <groupId>com.google.guava</groupId> | ||
| <artifactId>guava</artifactId> | ||
| <version>31.1-jre</version> | ||
| <version>32.0.0-android</version> |
There was a problem hiding this comment.
Please use the -jre flavor (e.g., 32.0.1-jre) instead of -android. The previous version used in this profile was 31.1-jre, and switching to -android may cause compilation or runtime issues due to missing Java 8+ APIs. Additionally, version 32.0.0 has known issues on Windows that are resolved in 32.0.1.
| <version>32.0.0-android</version> | |
| <version>32.0.1-jre</version> |
sidhdirenge
force-pushed
the
jetski/fix-cve-jul1-hydrator
branch
from
a27adb9 to
f5684ff
Compare
1 participant
Bumped guava dependency to 32.0.0-android for CVE remediation and verified build success across 35 submodules.