aws / aws/elastic-load-balancing-tools

A new ProtPro release ?

Open
#73 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
291
Forks
108
Avg merge
10h 53m
Merged PRs (30d)
1

Description

The [Maven central version of proprot](https://central.sonatype.com/artifact/com.amazonaws.proprot/proprot/1.0) uses an old version of guava which is affected by several vulnerabilities.

```xml


com.google.guava
guava
23.0


```

I see in current `master` a more recent one is used.
See : https://github.com/aws/elastic-load-balancing-tools/blob/e39fb8a6caf535b92280a91b019bf9907cd4c299/proprot/pom.xml#L82-L87

**Is there any plan to release a new version ?** (maybe overkill for just a simple dependency update )

Waiting a release are available, users can still use a more recent version of guava via dependencyManagement :
```xml



com.google.guava
guava
${guava.version}



```
But with not so much guarantee that there will not have some compatibility issue...
(For that ☝️, [this](https://abi-laboratory.pro/?view=timeline&lang=java&l=guava) could help a little but this is no more up to date)

Contributor guide

Open the contributing guide

Research direction

Start with proprot/pom.xml at lines 82-87 and compare its current Guava dependency with the published proprot 1.0 metadata. Confirm the intended dependency version and release entry points before changing anything; done means a new Maven Central release no longer resolves the vulnerable Guava version.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, release
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.