[AbhishekKumar9984]

Issue :
Resolved security vulnerabilities (CVE-2023-2976 / CVE-2020-8908) associated with older versions of com.google.guava:guava (13.0.1) pulled in directly and transitively via plugin dependencies.

Root Cause :
pom.xml specified <guava.version>13.0.1</guava.version>, and hydrator-common, hydrator-test, and cdap-data-pipeline3_2.12 transitively brought in an older, vulnerable version of Guava.

Fix :

• Upgraded <guava.version> from 13.0.1 to 32.0.0-jre in pom.xml.
• Excluded transitive com.google.guava:guava from io.cdap.plugin:hydrator-common, io.cdap.cdap:hydrator-test, and io.cdap.cdap:cdap-data-pipeline3_2.12.
• Updated <cdap.version> from 6.8.0 to 6.12.0-SNAPSHOT and <hadoop.version> from 2.3.0 to 3.3.6.

Testing evidence: https://docs.google.com/spreadsheets/d/1Cw6Z_k3wlks7sAC4-Kg6FTIMRL7-zxLlsJIXvVJLrb8/edit?gid=0#gid=0

[gemini-code-assist]

Code Review

This pull request updates dependency versions in pom.xml, including upgrading CDAP, Guava, and Hadoop, and adds exclusions for Guava in several dependencies. The review feedback points out that the selected Guava version (32.0.0-jre) has a known security vulnerability (CVE-2023-2976) and recommends upgrading to 32.1.3-jre instead.

[dheeraj-kholia-cs]

LGTM

[deepika-lalwani123]

This depends on cdapio/cdap#16279. The currently published 6.12.0-SNAPSHOT still has Guava 13, so this PR cannot be validated or merged until that PR merges and CDAP (and Twill) are published. Please call out the dependency in the PR description.

[deepika-lalwani123]

The Hadoop 2.3 -> 3.3.6 bump is unrelated to the Guava upgrade and is a large runtime change. Please move it to a separate PR.

[deepika-lalwani123]

Guava jumps from 13 to 32 with no source changes. Please run the tests against a Guava-32 CDAP to confirm binary compatibility (hydrator-common/format-* were built on Guava 13). Please use Guava >= 32.1.3-jre instead of 32.0.0-jre. 32.0.0 has a known regression (temp dir handling), fixed in 32.0.1. Ideally pin it once in dependencyManagement and add a maven-enforcer requireUpperBoundDeps rule rather than per-dependency <exclusion> blocks.