This repository was archived by the owner on Jun 30, 2023. It is now read-only.
Repository navigation
This repository was archived by the owner on Jun 30, 2023. It is now read-only.
Dependencies not upgraded #154
Description
Hi,
I see that Google endpoints framework releases do not contain the latest releases of its dependent libraries which have security vulnerabilities.
For. E.g Guava dependency version used is 20 while latest version is 25.1. Also, since guava is based on checker framework which is GPL, won't it affect developers?
Is there an alternative for checker framework which can be used in endpoints framework?
Thanks
Metadata
Metadata
Assignees
Labels
No labels
Activity
tangiel commentedon Jul 31, 2018
The particular library which Guava depends on in the Checker Framework is MIT licensed, so that is not an issue.
tangiel commentedon Aug 2, 2018
So there is an issue in that Guava 21+ requires Java 8, unless you use the
-androiddependency. Right now App Engine still supports Java 7 so we have to support it. But that could also mean classpath conflicts with people who use the Java 8 runtime and the-jredependency. I'm not entirely sure what the best solution is right now.akankshagaur commentedon Aug 4, 2018
Ok,that clarifies the issue. Thanks