You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@arrow.apache.org by li...@apache.org on 2023/06/15 13:09:20 UTC
[arrow-cookbook] branch main updated: [Java] Bump guava from 30.1.1-jre to 32.0.0-jre in /java/source/demo (#312)
This is an automated email from the ASF dual-hosted git repository.
lidavidm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-cookbook.git
The following commit(s) were added to refs/heads/main by this push:
new ccb48f9 [Java] Bump guava from 30.1.1-jre to 32.0.0-jre in /java/source/demo (#312)
ccb48f9 is described below
commit ccb48f9ab3e656221520ac72feffdd8725f6c159
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Thu Jun 15 09:09:14 2023 -0400
[Java] Bump guava from 30.1.1-jre to 32.0.0-jre in /java/source/demo (#312)
Bumps [guava](https://github.com/google/guava) from 30.1.1-jre to
32.0.0-jre.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/guava/releases">guava's
releases</a>.</em></p>
<blockquote>
<h2>32.0.0</h2>
<h3>Maven</h3>
<pre lang="xml"><code><dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>32.0.0-jre</version>
<!-- or, for Android: -->
<version>32.0.0-android</version>
</dependency>
</code></pre>
<h3>Jar files</h3>
<ul>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/guava/32.0.0-jre/guava-32.0.0-jre.jar">32.0.0-jre.jar</a></li>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/guava/32.0.0-android/guava-32.0.0-android.jar">32.0.0-android.jar</a></li>
</ul>
<p>Guava requires <a
href="https://github.com/google/guava/wiki/UseGuavaInYourBuild#what-about-guavas-own-dependencies">one
runtime dependency</a>, which you can download here:</p>
<ul>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar">failureaccess-1.0.1.jar</a></li>
</ul>
<h3>Javadoc</h3>
<ul>
<li><a
href="http://guava.dev/releases/32.0.0-jre/api/docs/">32.0.0-jre</a></li>
<li><a
href="http://guava.dev/releases/32.0.0-android/api/docs/">32.0.0-android</a></li>
</ul>
<h3>JDiff</h3>
<ul>
<li><a href="http://guava.dev/releases/32.0.0-jre/api/diffs/">32.0.0-jre
vs. 31.1-jre</a></li>
<li><a
href="http://guava.dev/releases/32.0.0-android/api/diffs/">32.0.0-android
vs. 31.1-android</a></li>
<li><a
href="http://guava.dev/releases/32.0.0-android/api/androiddiffs/">32.0.0-android
vs. 32.0.0-jre</a></li>
</ul>
<h3>Changelog</h3>
<h4>Security fixes</h4>
<ul>
<li>Reimplemented <code>Files.createTempDir</code> and
<code>FileBackedOutputStream</code> to further address CVE-2020-8908 (<a
href="https://redirect.github.com/google/guava/issues/4011">#4011</a>)
and CVE-2023-2976 (<a
href="https://redirect.github.com/google/guava/issues/2575">#2575</a>).
(feb83a1c8f)</li>
</ul>
<p>While CVE-2020-8908 was officially closed when we deprecated
<code>Files.createTempDir</code> in <a
href="https://github.com/google/guava/releases/tag/v30.0">Guava
30.0</a>, we've heard from users that even recent versions of Guava have
been listed as vulnerable in <em>other</em> databases of security
vulnerabilities. In response, we've reimplemented the method (and the
very rarely used <code>FileBackedOutputStream</code> class, which had a
similar issue) to eliminate the insecure behavior entirely. This change
could technically affect users in a number of different ways (discussed
under "Incompatible changes" below), but in practice, the only
problem users are likely to encounter is with Windows. If you are using
those APIs under Windows, you should skip 32.0.0 and go straight to <a
href="https://github.com/google/guava/releases/tag/v32.0.1">32.0.1</a>
which fixes the problem. (Unfortunately, we didn't think of the Windows
problem until after the release. And while we <a
href="https://github.com/google/guava#important-warnings">warn that
<code>common.io</code> in particular may not work under Windows</a>, we
didn't intend to regress support.) Sorry for the trouble.</p>
<h4>Incompatible changes</h4>
<p>Although this release bumps Guava's major version number, it makes
<strong>no binary-incompatible changes to the <code>guava</code>
artifact</strong>.</p>
<p>One change could cause issues for Widows users, and a few other
changes could cause issues for users in more usual situations:</p>
<ul>
<li><strong>The new implementations of <code>Files.createTempDir</code>
and <code>FileBackedOutputStream</code> <a
href="https://redirect.github.com/google/guava/issues/6535">throw an
exception under Windows</a>.</strong> This is fixed in <a
href="https://github.com/google/guava/releases/tag/v32.0.1">32.0.1</a>.
Sorry for the trouble.</li>
<li>This release makes a binary-incompatible change to a
<code>@Beta</code> API in the <strong>separate artifact</strong>
<code>guava-testlib</code>. Specifically, we changed the return type of
<code>TestingExecutors.sameThreadScheduledExecutor</code> to
<code>ListeningScheduledExecutorService</code>. The old return type was
a package-private class, which caused the Kotlin compiler to produce
warnings. (dafaa3e435)</li>
<li>This release <em>adds</em> two methods to the Android flavor of
Guava: <code>Invokable.getAnnotatedReturnType()</code> and
<code>Parameter.getAnnotatedType()</code>. Those methods do not work
under an Android VM; we added them only to help our tests of the Android
flavor (since we also run those tests under a JRE). Android VMs tolerate
such methods as long as the app does not call them or perform reflection
on them, and builds tolerate them because of our new Proguard
configurations (discussed below). Thus, we expect no impact to most
users. However, we could imagine build problems for users who have set
up their own build system for the Android flavor of Guava. Please report
any problems so that we can judge how safely we might be able to add
other methods to the Android flavor in the future, such as APIs that use
Java 8 classes like <code>Stream</code>.
(b30e73cfa81ad15c1023c17cfd083255a3df0105)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/google/guava/commits">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/apache/arrow-cookbook/network/alerts).
</details>
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
---
java/source/demo/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/java/source/demo/pom.xml b/java/source/demo/pom.xml
index 376db3a..a22606e 100644
--- a/java/source/demo/pom.xml
+++ b/java/source/demo/pom.xml
@@ -95,7 +95,7 @@
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
- <version>30.1.1-jre</version>
+ <version>32.0.0-jre</version>
</dependency>
<dependency>
<groupId>io.substrait</groupId>