Skip to content

Remove Guava dependency #112

@marek-parfianowicz

Description

@marek-parfianowicz

Guava is known to have various security vulnerabilities, in practically every major release. Security scanners (like Snyk, Veracode) report an outdated dependency of Guava in OpenClover.

The real usage of Guava in OpenClover is minimal (just a few helper methods, like newHashSet). Instead of constantly updating Guava to please security scanners, remove Guava dependency completely.

clover.jar (shaded: com.google.guava:guava:18.0)
openclover-ant/clover.jar/META-INF/maven/com.google.guava/guava/pom.xml

Metadata

Metadata

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions