googleapis / googleapis/google-api-java-client

EOL Status of OpenCensus Jars and Request for Migration

Open
#2,584 3 comments 1 reaction 0 assignees View on GitHub
priority: p3 type: bug
Dominant language
Java
Stars
1.5k
Forks
772
Avg merge
1h 44m
Merged PRs (30d)
1

Description

As part of our ongoing security initiatives, our team is conducting regular checks on all third-party dependency jars bundled within our product. Our objective is to ensure that we are using the most up-to-date libraries and to avoid including any components that have reached **end-of-life (EOL) status**.

During a recent review, we observed that some of the Android Enterprise dependencies we use **_opencensus-api_** and **_opencensus-contrib-http-util_** jars are outdated.
Dependancies for these jars : google-http-client.jar

Based on the release history of opencensus-api, it appears the library has not been updated in the **past three years since Apr 29, 2022 (version 0.31.1)**
[https://mvnrepository.com/artifact/io.opencensus/opencensus-api](https://mvnrepository.com/artifact/io.opencensus/opencensus-api)
[https://mvnrepository.com/artifact/io.opencensus/opencensus-contrib-http-util](https://mvnrepository.com/artifact/io.opencensus/opencensus-contrib-http-util)

Given the implications this has on our security posture, we would like to understand if there are any plans to:
Upgrade Google google-http-client.jar independent of this jar?

We would greatly appreciate any guidance or timeline you can provide regarding this.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.