Skip to content

fix(deps): update dependency com.google.guava:guava to v32 [security] - #42

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/maven-com.google.guava-guava-vulnerability
Open

fix(deps): update dependency com.google.guava:guava to v32 [security]#42
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/maven-com.google.guava-guava-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Apr 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
com.google.guava:guava 31.1-jre → 32.0.0-jre age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Guava vulnerable to insecure use of temporary directory

CVE-2023-2976 / GHSA-7g45-4rm6-3mm3

More information

Details

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Severity

  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Information Disclosure in Guava

CVE-2020-8908 / GHSA-5mg8-w23w-74h3

More information

Details

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

Severity

  • CVSS Score: 3.3 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

google/guava (com.google.guava:guava)

v32.0.0: 32.0.0

Compare Source

Maven
<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.0-jre</version>
  <!-- or, for Android: -->
  <version>32.0.0-android</version>
</dependency>
Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc
JDiff
Changelog
Security fixes

While CVE-2020-8908 was officially closed when we deprecated Files.createTempDir in Guava 30.0, we've heard from users that even recent versions of Guava have been listed as vulnerable in other databases of security vulnerabilities. In response, we've reimplemented the method (and the very rarely used FileBackedOutputStream class, which had a similar issue) to eliminate the insecure behavior entirely. This change could technically affect users in a number of different ways (discussed under "Incompatible changes" below), but in practice, the only problem users are likely to encounter is with Windows. If you are using those APIs under Windows, you should skip 32.0.0 and go straight to 32.0.1 which fixes the problem. (Unfortunately, we didn't think of the Windows problem until after the release. And while we warn that common.io in particular may not work under Windows, we didn't intend to regress support.) Sorry for the trouble.

Incompatible changes

Although this release bumps Guava's major version number, it makes no binary-incompatible changes to the guava artifact.

One change could cause issues for Widows users, and a few other changes could cause issues for users in more usual situations:

  • The new implementations of Files.createTempDir and FileBackedOutputStream throw an exception under Windows. This is fixed in 32.0.1. Sorry for the trouble.
  • guava-gwt now requires GWT 2.10.0.
  • This release makes a binary-incompatible change to a @Beta API in the separate artifact guava-testlib. Specifically, we changed the return type of TestingExecutors.sameThreadScheduledExecutor to ListeningScheduledExecutorService. The old return type was a package-private class, which caused the Kotlin compiler to produce warnings. (dafaa3e)
  • This release adds two methods to the Android flavor of Guava: Invokable.getAnnotatedReturnType() and Parameter.getAnnotatedType(). Those methods do not work under an Android VM; we added them only to help our tests of the Android flavor (since we also run those tests under a JRE). Android VMs tolerate such methods as long as the app does not call them or perform reflection on them, and builds tolerate them because of our new Proguard configurations (discussed below). Thus, we expect no impact to most users. However, we could imagine build problems for users who have set up their own build system for the Android flavor of Guava. Please report any problems so that we can judge how safely we might be able to add other methods to the Android flavor in the future, such as APIs that use Java 8 classes like Stream. (b30e73c)
  • This release removes various APIs from the guava-gwt. This affects only users of GWT. The APIs we removed are Enums, Sets.complementOf, and the Enum*BiMap classes' keyType() and valueType() methods. These changes prepare for the removal of reflective enum-related APIs from J2CL. If one of these changes causes you problems as a GWT user, let us know. (c3a155d, 09db2c2, 3de12be)
  • The new implementations of Files.createTempDir and FileBackedOutputStream are annotated as @J2ObjCIncompatible. If you need to use them under J2ObjC, contact us. (56dc928)
  • Because the new version of Files.createTempDir restricts permissions to the current user, it could break any caller that relies on letting other users access the directory.
  • The new versions of Files.createTempDir and FileBackedOutputStream throw an exception if they can't create the directory or file securely. Aside from the accidental Windows bug discussed above, this is possible only under Android Ice Cream Sandwich, a very old version of Android that is the oldest one we test Guava with.
Other changes
  • Removed @Beta from almost all APIs. For details, see the bottom of the release notes. At this point, it's probably simpler to look at a list of APIs that still are @Beta, such as this list for guava-jre. Most of the remaining @Beta APIs are in graph and hash.
  • Enhanced the Guava jar to include Proguard configurations that are picked up automatically by the Android Gradle Plugin. This should help with warnings that were promoted to errors in Android Gradle Plugin 8.x. (aeba1e1)
  • Enhanced the Guava jar to include information about method parameters in its class files. If you use static analyzers that look at method-parameter names, you may see new warnings or errors if they are now able to detect mismatches. But mostly, you may see better tooltips and autocompletion in IDEs. (59d174c)
  • Improved nullness annotations on a few classes.
  • Modified classes with "serial proxies" to declare exception-throwing readObject methods, in accordance with best practice. (e62d6a0)
  • collect: Fixed Maps.newHashMapWithExpectedSize to stop allocating maps that were larger than they needed to be. (6ad621e)
  • collect: Made various APIs work J2CL: Maps.immutableEnumMap+toImmutableEnumMap, EnumMultiset, CollectorTester. Previously, the APIs were present but failed at runtime. (b62c88e, 23ff918, 852a7d3)
  • collect: Optimized memory usage for Interner and MapMaker. (a2e8f3c)
  • graph: Changed directed graphs to reject attempts to add undirected edges. (76260d9)
  • io: Added BaseEncoding.ignoreCase() to support case-insensitive decoding. (9c1e5de)
  • net: Added HttpHeaders constants:
  • net: Added the MediaType constant for JWT. (f942fd2)
  • primitives: Added rotate() for arrays of all primitive types. (cd338fa, 6e9057d)
  • util.concurrent: Changed AbstractFuture to run interruptTask() just before afterDone(). Until this change, it ran slightly earlier than that: We used to run it before unblocking any pending get() calls, and now we run it after. (b337be6)
  • util.concurrent: Fixed some cases in which we could catch InterruptedException but fail to restore the interrupt bit. (8f0350a)
@Beta removal list
  • base: Utf8 (211907c)
  • base: more APIs (b0cc461)
  • collect: Multimaps.asMap(...) (df0081f)
  • collect: FluentIterable APIs (73b2f7b)
  • collect: Forwarding[Foo] APIs (9760dbc)
  • collect: ImmutableFoo.Builder.builderWithExpectedSize(...), orderEntriesByValue(...), and Entry-related APIs (61be35c)
  • collect: RangeMap, RangeSet, and friends (fe12c81)
  • collect: more APIs (98820c7, e5e0f66)
  • io: ByteStreams (4897930)
  • io: more APIs (a589256)
  • math: various APIs (912815e)
  • primitives: Longs.tryParse(...) and friends (b3d4856)
  • primitives: UnsignedLongs (b240e8c)
  • primitives: more APIs (fcec25f, ab4302a)
  • reflect: Invokable and some methods in TypeToken (a195f7d)
  • reflect: Parameter (except getAnnotatedType() in guava-android) (b561eb1)
  • testing: various APIs (b331769, 74ad9b8)
  • util.concurrent: FluentFuture (b9a2d58)
  • util.concurrent: Futures (15a0c9f)
  • util.concurrent: Striped (ba8ad69)
  • util.concurrent: various MoreExecutors APIs (a3571b4)
  • util.concurrent: more APIs (bbaf76a)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate
renovate Bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch April 27, 2026 17:49
@renovate renovate Bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch 2 times, most recently from 1c70bca to bcfa94f Compare April 27, 2026 21:25
@renovate
renovate Bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch 2 times, most recently from d79fe13 to 0ec081f Compare May 22, 2026 17:51
@renovate
renovate Bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 0ec081f to 0bee67a Compare July 16, 2026 17:56
@renovate
renovate Bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 0bee67a to 9f83a53 Compare August 11, 2026 23:03
@renovate
renovate Bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 9f83a53 to 4f4a9d3 Compare October 26, 2026 21:00
@renovate
renovate Bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 4f4a9d3 to 246a973 Compare November 2, 2026 18:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants