v9.2.0 Provides transitive vulnerable dependency maven:com.google.guava:guava:31.1-jre

[hmzgtl16]

CVE-2023-2976 7.1 Files or Directories Accessible to External Parties vulnerability with High severity foun

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[Malnen]

Does anyone know when it will be fixed?

[Chikouni]

UPDATE:
There is another in v9.2.0 : CVE-2024-29025 due from io.netty:netty-codec-http 4.1.107.Final

[cybersokari]

While we wait for this to be resolved, you can override Guava from Firebase Admin SDK with a version that does not have a breaking change.

[jedjebari]

Overriding transitive deps might be dangerous, and should be avoided :-(
Any news on that ?

[yssoe]

https://www.cnbc.com/2024/04/23/google-search-boss-raghavan-warns-employees-of-new-operating-reality.html

Maybe other bosses can take a hint from their colleague.

[lahirumaramba]

Thanks folks, this should be now fixed in the latest release (v9.30)

[AndyCodez]

Thanks folks, this should be now fixed in the latest release (v9.30)

Thanks for the update! But I believe that should read v9.3.0