Description

ghlocaltests

opened on Nov 4, 2026

Issue body actions

Hi team,

Our security scanner reported an issue regarding to old guava libs (32.1.2-jre), even after we have upgrade the dependency in maven.

After some investigations, we found that this lib is introduced from

<graphq-java-<version>.jar>/META-INF/maven/com.google.guava/guava/pom.xml and pom.properties:

groupId=com.google.guava
artifactId=guava
version=32.1.2-jre

  <parent>
    <groupId>com.google.guava</groupId>
    <artifactId>guava-parent</artifactId>
    <version>32.1.2-jre</version>
  </parent>

which will trigger the CVE alert by the scanner.

If possible can this maven directory in MEAT-INF removed ?

Activity

1. bclozel commented on Nov 4, 2026

   

   bclozel

   on Nov 4, 2026

   More actions

   Hello @ghlocaltests

   full disclosure: I'm not a graphql-java maintainer.

   Those META-INF files should be kept because they do reflect the fact that part of guava is being shaded in the graphql-java JAR. Now for the CVE part of this issue, you should have a look at #4498 and #4530 to get a better understanding of the situation. I'm sure the team will reply there in due time.

   I think you can close this issue in favor of the other two.
   Cheers.

Issue actions