Repository navigation
Sec vul: CVE-2023-2976 from google-guava dep #950
Description
Can you update the version of google guava used to 32.0.1 or higher to resolve CVE-2023-2976 for the next release?
https://nvd.nist.gov/vuln/detail/CVE-2023-2976
https://mvnrepository.com/artifact/com.google.googlejavaformat/google-java-format/1.17.0
https://mvnrepository.com/artifact/com.google.guava/guava
Activity
Update Guava version
Update Guava version
Update Guava version
Update Guava version
jaguilar-atl commentedon Aug 3, 2023
It looks like this change is already in the master branch.
https://github.com/google/google-java-format/blob/master/pom.xml#L89
Is there an estimated timeline for when the next release will be?
raghav-deepsource commentedon Aug 7, 2023
It would be great if a patch release can be made for this change, please do expedite it.
gregallen commentedon Sep 21, 2023
Another vote for this - this issue prevents the intellij plugin from being used in a corporate environment
Update Guava version
cushon commentedon Oct 2, 2023
I pushed a release that includes the Guava dependency update: https://github.com/google/google-java-format/releases/tag/v1.18.0
gregallen commentedon Oct 3, 2023
The IntelliJ plugin needs to be updated to use new version and released
It is still referencing 1.17.0
Thanks!