search

sonatype / ossindex-public

Sonatype OSS Index - Public
Apache License 2.0
6 stars 9 forks source link

Upgrade Guava to address security vulnerabilities #25

Closed ndonewar closed 3 years ago

ndonewar commented 3 years ago

This PR upgrades Guava to the latest compatible Android version.

Note: the comment in the pom.xml file regarding Guava 20.x and Java 7 is no longer applicable due to changes in the Guava project. According to the Guava docs:

Guava comes in two flavors.

  • The JRE flavor requires JDK 1.8 or higher.
  • If you need support for JDK 1.7 or Android, use the Android flavor.

This project maintains a bom pom.xml, so the version is added only there for consistency. The bom/pom.xml previously declared version 28.0-jre but that was omitted for conflict with 20.0:

[INFO] |  +- (com.google.guava:guava:jar:28.1-jre:compile - version managed from 20.0; omitted for conflict with 20.0)

This PR does not change the support for Java 7. The project uses the Maven Enforcer plugin to ensure compatibility with Java 7, which passes with 29.0-android. For manual verification, it failed with version 29.0-jre.