googleapis / googleapis/google-oauth-java-client
Update Guava dependency to address security vulnerabilities (CVE-2020-8908, GHSA-7g45-4rm6-3mm3)
Open
- Dominant language
- Java
- Stars
- 661
- Forks
- 284
- PR merge metrics
- No merged PRs in 30d
Description
**Issue**: Vulnerable Guava dependency in google-oauth-client 1.39.0
**Current**: Ships with Guava 31.1-android (vulnerable)
**Recommended**: Update to Guava 32.0.1-android or newer
**Vulnerabilities**:
- CVE-2020-8908 (CVSS 3.3)
- GHSA-7g45-4rm6-3mm3 (CVSS 5.5)
**Impact**: Forces developers to manually override transitive dependencies for security compliance.
**Request**: Please update Guava dependency in next release.
Contributor guide
Assessment
This issue has not been assessed yet.