[BUG]: guava依赖漏洞传递
Open
Beginner friendly
bug
- Dominant language
- Java
- Stars
- 4.8k
- Forks
- 860
- PR merge metrics
- No merged PRs in 30d
Description
### 平台
macOS
### Jdk版本
jdk25
### SpringBoot版本
4.1.0
### DynamicTp版本
1.2.2
### 配置中心类型
无
### 配置中心版本
无
### 问题描述
升级到已修复的guava版本 或者去掉31.1-jre
### 复现步骤
无
### 其他信息
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by searching the dependency configuration for the 31.1-jre property and inspect how Guava is brought in transitively. Update to a fixed Guava version or remove the property as appropriate, then verify the resolved dependency no longer contains the reported vulnerability.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100