Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade guava dependency to v30.0-jre #1184

Merged
merged 1 commit into from
Apr 20, 2021
Merged

Upgrade guava dependency to v30.0-jre #1184

merged 1 commit into from
Apr 20, 2021

Conversation

majk-p
Copy link
Contributor

@majk-p majk-p commented Apr 20, 2021

First of all thanks for providing this great project!
With this PR I want to bump guava. In my project I'm using Snyk vulnerability scanner, that revealed following security issue with current version of minio-java:

Issues with no direct upgrade or patch:
  ✗ Information Disclosure [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415] in com.google.guava:guava@29.0-jre
    introduced by MY_LIBRARY@SOME_VERSION > MY_MINIO_WRAPPER@SOME_VERSION > io.minio:minio@8.2.1 > com.google.guava:guava@29.0-jre
  This issue was fixed in versions: 30.0-android, 30.0-jre

More details on Guava vulnerability: https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415

@majk-p
Copy link
Contributor Author

majk-p commented Apr 20, 2021

@harshavardhana @vadmeste can you please have a look?

@balamurugana balamurugana changed the title Bump guava to 30.0-jre Upgrade guava dependency to v30.0-jre Apr 20, 2021
@harshavardhana harshavardhana merged commit 8363592 into minio:master Apr 20, 2021
@majk-p
Copy link
Contributor Author

majk-p commented Apr 20, 2021

Thank you for merging! Can we please have this released?

@majk-p
Copy link
Contributor Author

majk-p commented Apr 22, 2021

@harshavardhana @balamurugana when can we see this released?

@harshavardhana
Copy link
Member

@harshavardhana @balamurugana when can we see this released?

Soon @majk-p

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@harshavardhana harshavardhana harshavardhana approved these changes

@balamurugana balamurugana balamurugana approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@majk-p @harshavardhana @balamurugana