Closed yeikel closed 1 year ago
Thanks for reporting. We will look into it.
@yeikel Just out of curiosity: What tool is that screenshot from? Currently that dependency is only used for tests, so I will look into getting it out of the artifact jar.
@yeikel Just out of curiosity: What tool is that screenshot from? Currently that dependency is only used for tests, so I will look into getting it out of the artifact jar.
The screenshot is from the "Quarantined Component View" of Nexus IQ Server
See https://help.sonatype.com/fw/next-gen-firewall-features/quarantined-component-view
I am encountering this while running the Maven plugin because this is a transitive dependency
CVE-2023-2976 is considered a
High risk CVSS score
and even if it is not exploitable it is still not allowed in my environmentUpgrading to Guava
32.0.0-jre
should fix it. See https://github.com/google/guava/releases/tag/v32.0.0Additional context :
https://github.com/google/guava/releases/tag/v32.0.0