Repository navigation
fix(deps): upgrade guava from 31.1-jre to 33.7.2-jre - #1116
abhishekj720 wants to merge 3 commits into
Conversation
Fixes two vulnerabilities: - CVE-2023-2976 (CVSS 3.3): FileBackedOutputStream creates temporary files in the default Java temp directory with permissions accessible to other local users. Fixed in guava 32.0.0-jre. - CVE-2026-102554 (CVSS 8.2): Deserialization of crafted streams via CompactHashMap, CompactHashSet, and MapMakerInternalMap allows an attacker to force oversized heap allocation leading to OutOfMemoryError. Fixed in guava 33.7.2-jre. Upgrading directly to 33.7.2-jre fixes both and also overrides the vulnerable 31.1-jre pulled in transitively by grpc-stub and grpc-protobuf. Guava maintains backward compatibility across its jre variants.
abhishekj720
changed the title
Guava 32+ publishes both jreRuntimeElements and androidRuntimeElements variants. Gradle 6 cannot choose between them for configurations that do not declare the org.gradle.jvm.environment attribute (e.g. the protobuf Gradle plugin's compileProtoPath used by extractIncludeProto). Add a configurations.all block that sets org.gradle.jvm.environment to standard-jvm on all configurations so Gradle always selects the JRE variant. Signed-off-by: abhishek.jha <abhishek.jha@uber.com>
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project check has failed because the head coverage (68.90%) is below the target coverage (85.00%). You can increase the head coverage or adjust the target coverage. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
Signed-off-by: abhishek.jha <abhishek.jha@uber.com>
Code Review ✅ Approved🟡 Medium risk · Upgrading Guava and applying a JVM-environment attribute to all Gradle configurations could alter dependency resolution or expose compatibility issues at runtime. Upgrades Guava from 31.1-jre to 33.7.2-jre to fix CVE-2023-2976 and CVE-2026-102554, and adds a Verification Repos 1 inspected · PRs 1 inspectedFunctional validation No results Rules No rules evaluated Broader impact Repos 1 inspected PRs 1 inspectedCross-repo 1 repository inspected 0 open impacts
Cross-PR 1 PR inspected 0 open impactsFor more verification details, comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
1 participant
Summary
Upgrades
com.google.guava:guavafrom31.1-jreto33.7.2-jre.Guava maintains backward compatibility across its
jrevariants. This also overrides the vulnerable31.1-jrepulled in transitively bygrpc-stubandgrpc-protobuf, clearing those transitive alerts as well.Vulnerabilities fixed
FileBackedOutputStreamcreates temporary files in the default Java temp directory with permissions readable by other local usersCompactHashMap,CompactHashSet, andMapMakerInternalMapallows an attacker to force oversized heap allocations, crashing the JVM withOutOfMemoryErrorType of Change
Data Effect
Detailed Description
Upgrading directly to
33.7.2-jre(rather than the minimum32.0.0-jre) fixes both CVEs in one change. Guava'sjrevariant is backward compatible.The upgrade also transitively replaces the
31.1-jrepulled in byio.grpc:grpc-stubandio.grpc:grpc-protobuf, clearing the guava-related transitive alerts on those packages without requiring a grpc version bump.Impact Analysis
jrevariant line.Testing Plan
Rollout Plan
Standard release. No special rollout required.