Upgrade guava to avoid CWE-379

[t0yv0]

What happened?

https://ossindex.sonatype.org/vulnerability/sonatype-2020-0926?component-type=maven&component-name=com.google.guava%2Fguava&utm_source=ossindex-client&utm_medium=integration&utm_content=1.7.0

Steps to reproduce

Expected Behavior

Actual Behavior

Versions used

No response

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[pawelprazak]

From the upstream issue: google/guava#4011

Updating to Guava 30.0 does not fix this security vulnerability. The method is merely deprecated. There currently exits no fix for this vulnerability.

[t0yv0]

This is very unfortunate. Just skimming through, it looks like there is no way to get rid of the warning that we get when publishing to Maven Central, but we can opt to ignore it. It seems to me our code might not really be vulnerable.

Is there a way to get rid of Guava dependency or this is not practical? If it's not practical we should defer it and ignore the warning for now.

[pawelprazak]

AFAIK gRPC depends on guava, it would also be quite impractical for our code base
what we could do would be to shade the deps, as mentioned while back as a nice to have future change

[t0yv0]

Ah, definitely a problem then. OK let's just keep it in the backlog I'll ignore this warning for now during releases.