René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Dependency version updates","articleBody":"### Summary\r\n\r\nEven though this is about a Guava vulnerability, because graphql-java shades the Guava library, vulnerabilities-scanning software is flagging graphql-java as also being vulnerable.\r\n\r\nIf I understand correctly, Guava has been updated already in graphql-java, but a \"stable\" release has not been made yet(?).\r\nI am creating this ticket to ask if you could release a patch version including this update.\r\n\r\nThe Guava vulnerability reported at CVE-2023-2976 has been fixed in Guava version 32.0.0.\r\nThe latest stable version of graphql-java seems to be 20.3 as of writing, but that version is using Guava 31.0.1-jre.\r\n\r\nThe CVE is not published as of writing. But it's referenced in Guava's [CHANGELOG](https://github.com/google/guava/releases).\r\n\r\nThe impact of the Guava vulnerability is explained [here](https://github.com/advisories/GHSA-5mg8-w23w-74h3).\r\n","author":{"url":"https://github.com/renatoathaydes","@type":"Person","name":"renatoathaydes"},"datePublished":"2023-06-02T10:11:28.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/3239/graphql-java/issues/3239"}