-
Notifications
You must be signed in to change notification settings - Fork 17
Closed
Description
Guava is known to have various security vulnerabilities, in practically every major release. Security scanners (like Snyk, Veracode) report an outdated dependency of Guava in OpenClover.
The real usage of Guava in OpenClover is minimal (just a few helper methods, like newHashSet). Instead of constantly updating Guava to please security scanners, remove Guava dependency completely.
clover.jar (shaded: com.google.guava:guava:18.0)
openclover-ant/clover.jar/META-INF/maven/com.google.guava/guava/pom.xml