You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The last time we upgraded guava was back to 2019 (v20->v26) which is 4 years old now. There are also a few (temp file) vulnerabilities since then. In general these vulnerabilities are not exploitable in Beam, as these lib are only used by Beam code, we should upgrade the vendor dependency
What needs to happen?
The last time we upgraded guava was back to 2019 (v20->v26) which is 4 years old now. There are also a few (temp file) vulnerabilities since then. In general these vulnerabilities are not exploitable in Beam, as these lib are only used by Beam code, we should upgrade the vendor dependency
A good candidate is the latest 32.1.2-jre, which is also included in Google Cloud Java lib LTS 5.0: GoogleCloudPlatform/cloud-opensource-java#2343
Issue Priority
Priority: 2 (default / most normal work should be filed as P2)
Issue Components
The text was updated successfully, but these errors were encountered: