Closed donat closed 11 months ago
What are the plans for producing a new release with updated dependencies?
The 3.1.7 release locks in an older version of guava:
The older versions have CVEs:
https://www.cvedetails.com/cve/CVE-2023-2976/
We'd really like to avoid that in SimRel.
The dependency version range is a mere convention in the codebase, the implementation doesn't have any special requirements to guava versions. We'll look into this.
@donat
Thanks! It's highly unfortunate that the guava tends to do major increments extremely regularly such that upper bounds are kind of unhelpful, but then again, you never know if some API was indeed broken by their latest changes. Compounding that annoyance with the fact that guava is the most likely bundle to cause wiring problems, it's really very annoying. But such is life...
I'd be happy to update Guava asap, but I don't see a newer version in the Orbit update sites.
Note that Orbit has been restructured:
https://github.com/orgs/eclipse-orbit/discussions/49
So you should look here:
https://download.eclipse.org/tools/orbit/simrel/orbit-aggregation/
The release is now available:
https://download.eclipse.org/tools/orbit/simrel/orbit-aggregation/release/4.29.0
You can inspect the raw contents of the repo like this:
https://download.eclipse.org/justj/?file=tools/orbit/simrel/orbit-aggregation/release/4.29.0/plugins
The latest master
branch uses the latest Guava + Spock 2 + Groovy 3.
It will require updating the tests to use Spock 2 + Groovy 3+. We should aim for Groovy 4.