Stuck on an issue?
Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Override on guava still reported on avro-1.8.2.jar (shaded: com.google.guava:guava:11.0.2)
See original GitHub issuedependencyCheck reports a vulnerability on a transitive dependency, and when the version of the transitive dependency is bumped via dependencyOverrides, the problem still shows in the report.
The tool reports a vulnerability (CVE-2018-10237) in guava 11.0.2, because of avro 1,8.2.
Guava was updated to 27.0-jre, from my build.sbt:
dependencyOverrides += "com.google.guava" % "guava" % "27.0-jre"
I’ve added a suppression on cpe:/a:google:guava:11.0.2.
Thanks!
Issue Analytics
- State:
- Created 5 years ago
- Comments:5 (3 by maintainers)
Top Results From Across the Web
apache spark - How to resolve Guava dependency issue ...
When using relocations, shade will rewrite your classes to use a new package named 'repackaged.com.google.common' and will put your version of ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@reidrac Could you tell me which dependency contains the vulnerable guava version so that I can reproduce the issue?
Edit: never mind, you mentioned it in the bug title as well as in the bug report.
Lovely, thanks for the tip!