aws / aws/elastic-load-balancing-tools
A new ProtPro release ?
- Dominant language
- Java
- Stars
- 291
- Forks
- 108
- Avg merge
- 10h 53m
- Merged PRs (30d)
- 1
Description
The [Maven central version of proprot](https://central.sonatype.com/artifact/com.amazonaws.proprot/proprot/1.0) uses an old version of guava which is affected by several vulnerabilities.
```xml
com.google.guava
guava
23.0
```
I see in current `master` a more recent one is used.
See : https://github.com/aws/elastic-load-balancing-tools/blob/e39fb8a6caf535b92280a91b019bf9907cd4c299/proprot/pom.xml#L82-L87
**Is there any plan to release a new version ?** (maybe overkill for just a simple dependency update )
Waiting a release are available, users can still use a more recent version of guava via dependencyManagement :
```xml
com.google.guava
guava
${guava.version}
```
But with not so much guarantee that there will not have some compatibility issue...
(For that ☝️, [this](https://abi-laboratory.pro/?view=timeline&lang=java&l=guava) could help a little but this is no more up to date)
Contributor guide
Research direction
Start with proprot/pom.xml at lines 82-87 and compare its current Guava dependency with the published proprot 1.0 metadata. Confirm the intended dependency version and release entry points before changing anything; done means a new Maven Central release no longer resolves the vulnerable Guava version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, release
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100