Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump Guava to 32.1.3-jre to avoid vulnerability #8812

Closed

Conversation

Marinofull
Copy link

@Marinofull Marinofull commented Feb 9, 2024

Overview

Fix #8811
This PR also updates the error-prone to meet the required version seen in Guava Dependencies

Proposed Changes

Guava 31.1 was vulnerable. And 31.1.3 can be applied since gradle 8+ is used

@hoisie
Copy link
Contributor

hoisie commented Feb 12, 2024

Hi @Marinofull thanks for this PR.

A few months ago we had Guava auto-updated to 32.x (#8547), and the problem was that it forced projects that use Robolectric to update to at least Gradle 7.x.

See:
google/guava#6612
google/guava#6801

@Marinofull
Copy link
Author

Marinofull commented Feb 12, 2024

@hoisie thanks. But Robolectric master version uses gradle 8 now, correct?

@Marinofull
Copy link
Author

I see now, it will force not only Robolectric, but any project using it to upgrade. And since the latest version of agp compatible with gradle is agp 7.4.2 any project using it will also be vulnerable to this same issue, not because of guava only, but because of its other dependencies such as agp 7.4.2. In this case, I think we can close this PR, and upgrade when agp 7 became deprecated

@hoisie
Copy link
Contributor

hoisie commented Feb 13, 2024

What do you think @utzcoz? Maybe we should just go along with the rest of the ecosystem which has probably already upgraded past Gradle 6?

@utzcoz
Copy link
Member

utzcoz commented Feb 13, 2024

Maybe we should just go along with the rest of the ecosystem which has probably already upgraded past Gradle 6?

At least, I know there is a large user that can't use AGP 7.x.

@Marinofull Marinofull closed this Apr 5, 2024
@MGaetan89
Copy link
Contributor

At least, I know there is a large user that can't use AGP 7.x.

@utzcoz do you have some insights about why they can't update AGP/Gradle?

According the Gradle's Release end-of-life Policy, Gradle 8.x is the currently supported version, Gradle 7.x only receives critical bugfixes, and older versions are no longer supported.
As Gradle 8.0 has been released in February 2023, over one year ago, maybe it could make sense to reconsider this (depending on the blockers provided above)?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Guava Dependancy is vulnerable to insecure use of temporary directory
4 participants