[AbhishekKumar9984]

Issue :
Resolved security vulnerabilities (CVE-2023-2976 / CVE-2020-8908) associated with older versions of com.google.guava:guava (13.0.1) pulled in directly and transitively via plugin dependencies.

Root Cause :
pom.xml specified com.google.guava:guava version 13.0.1 (and 31.1-jre in the e2e profile), while CDAP and Hadoop dependencies transitively pulled in older versions of Guava.

Fix :

• Upgraded com.google.guava:guava from 13.0.1 to 32.0.0-jre via <guava.version>32.0.0-jre</guava.version> in pom.xml and removed the 31.1-jre override from the e2e profile.
• Excluded transitive com.google.guava:guava from cdap-formats, hydrator-test, cdap-data-pipeline3_2.12, hydrator-common, format-common, hadoop-common, and cdap-e2e-framework.

Testing evidence: https://docs.google.com/spreadsheets/d/1Cw6Z_k3wlks7sAC4-Kg6FTIMRL7-zxLlsJIXvVJLrb8/edit?gid=0#gid=0

[gemini-code-assist]

Code Review

This pull request updates the Guava dependency version to 32.0.0-jre and adds exclusions for Guava across multiple dependencies in pom.xml. However, the selected Guava version (32.0.0-jre) is vulnerable to CVE-2023-2976, which is a local information disclosure vulnerability. It is recommended to upgrade to version 32.1.3-jre or later to mitigate this security risk.

[dheeraj-kholia-cs]

LGTM

[deepika-lalwani123]

Looks fine overall. One nit inline.

[deepika-lalwani123]

Guava jumps from 13 to 32 with no source changes. Please verify against a Guava-32 CDAP build. Please use Guava >= 32.1.3-jre instead of 32.0.0-jre. 32.0.0 has a known regression (temp dir handling), fixed in 32.0.1. Ideally pin it once in dependencyManagement and add a maven-enforcer requireUpperBoundDeps rule rather than per-dependency <exclusion> blocks.