Skip to content

[Bug]: Upgrade to Guava 32+ to fix CVE-2023-2976 #7525

@ppalaga

Description

@ppalaga

Module

Core

Testcontainers version

1.19.0

Using the latest Testcontainers version?

Yes

Host OS

any

Host Arch

any

Docker version

irelevant

What happened?

I hope my understanding is correct that the shaded org/testcontainers/shaded/com/google/common/io/FileBackedOutputStream.class file in org.testcontainers:testcontainers:1.19.0 comes from guava 30.1.1-jre:
https://github.com/testcontainers/testcontainers-java/blob/1.19.0/build.gradle#L8

Guava versions >= 1.0, < 32.0.0 suffer from CVE-2023-2976 alias google/guava#2575

It would be nice to upgrade the shaded Guava and release

Relevant log output

No response

Additional Information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions