fix: pin safe Guava version in aggregate BOM #42

2026-10-29T21:06:35Z

KofTwentyTwo commented

2026-10-29 21:06:35 +00:00

(Migrated from github.com)

Pin Guava 33.7.2-jre and include it in the BOM consumer guard to remediate CVE-2026-102554.

Validation: reactor verification, core/full service smoke, packaged integration and exact-image scan passed; zero HIGH/CRITICAL findings. GHCR bootstrap, publication and visibility changes are outside this PR.

Pin Guava 33.7.2-jre and include it in the BOM consumer guard to remediate CVE-2026-102554. Validation: reactor verification, core/full service smoke, packaged integration and exact-image scan passed; zero HIGH/CRITICAL findings. GHCR bootstrap, publication and visibility changes are outside this PR.

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/guava-security-20261029:fix/guava-security-20261029

git checkout fix/guava-security-20261029

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-all#42