Vulnerabilities from dependencies: CVE-2023-2976 CVE-2020-8908

[VenkatJey]

Thanks for stopping by to let us know something could be better!

Summary:
The google-http-client version 1.45.0 has known vulnerabilities due to dependencies. Specifically:

• CVE-2023-2976: [Brief description of CVE-2023-2976]
• CVE-2020-8908: [Brief description of CVE-2020-8908]

Impact:
These vulnerabilities may raise security issue

Steps to Reproduce:

Suggested Fix:
1.45.0 is the latest version

Additional Information:

• Version: 1.45.0

Making sure to follow these steps will guarantee the quickest resolution possible.

Thanks!
Venkateswari

[burkedavison]

Upgrading Guava is currently blocked on maintaining Java 7 support. Marking this ticket for discussion.
Note that the vulnerabilities are "Moderate" and "Low" in severity.