-
Notifications
You must be signed in to change notification settings - Fork 29
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Updated Guice to 7.0.0 and Guava to 32.1.2 #216
Conversation
In general the changes look good to me. However, the maven build does not succeed i I change the target to Also the maven build now has some provision warnings:
However, everything still seems to work as expected so maybe we can ignore them for now. |
@tortmayr I tried a bit around and found a solution for the failing maven build. We can add The provisioning warnings I can't figure out, the message tells that there is a dependency on 9.4, which is no longer available, but I can't find where the Version is defined. The 9.5 is included in the Repository as expected. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me.
With the optional dependency everything works as expected.
Let`s ignore the provision warnings for now.
Currently, Guice 5 and Guava up to 31 is used in the GLSP Server and Eclipse Integration
These Guava Versions are affected by CVE-2023-2976 classified as a high security risk.
This could be mitigated by updating to Guava 32.0.1 or higher (32.1.2 is part of the 2023-09 SimRel)
The Issue is that Guice 5 has an upper limit of Guava 31 and so an Update to Guice 6 or 7 is necessary.
Xtext already did this update to Guice 7, which is now part of the SimRel
The drawback is that an update to Guice 7 requires changing from javax.inject to jakarta.inject.
Besides that, there are probably no breaking changes that affect GLSP.
The current situation makes is very complicated to use Xtext and GLSP in the same runtime.