Update Guava dependency to address security vulnerabilities (CVE-2020-8908, GHSA-7g45-4rm6-3mm3) #1171
Description
Issue: Vulnerable Guava dependency in google-oauth-client 1.39.0
Current: Ships with Guava 31.1-android (vulnerable)
Recommended: Update to Guava 32.0.1-android or newer
Vulnerabilities:
- CVE-2020-8908 (CVSS 3.3)
- GHSA-7g45-4rm6-3mm3 (CVSS 5.5)
Impact: Forces developers to manually override transitive dependencies for security compliance.
Request: Please update Guava dependency in next release.