[AbhishekKumar9984]

Issue :
Resolved security vulnerabilities (CVE-2023-2976 / CVE-2020-8908) associated with older versions of com.google.guava:guava (13.0.1 / 31.x) pulled in directly and transitively across database plugins.

Root Cause :
Root and submodule POMs referenced older Guava versions (13.0.1, 31.0.1-jre, 31.1-jre), and CDAP, Hadoop, and CloudSQL socket-factory dependencies transitively brought in conflicting older versions of Guava causing compilation and test issues.

Fix :

• Upgraded <guava.version> to 32.0.0-jre in root pom.xml, cloudsql-mysql-plugin/pom.xml, and cloudsql-postgresql-plugin/pom.xml.
• Excluded transitive com.google.guava:guava from cdap-api, cdap-etl-proto, cdap-etl-api, cdap-data-pipeline3_2.12, hydrator-test, hydrator-common, cdap-test, cdap-unit-test, hadoop-common, cdap-e2e-framework, mysql-socket-factory-connector-j-8, and postgres-socket-factory.
• Updated <cdap.version> from 6.11.0 to 6.12.0-SNAPSHOT.

Ticket ID : https://buganizer.corp.google.com/issues/470299023

[gemini-code-assist]

Code Review

This pull request updates the Guava dependency version across multiple POM files to use the ${guava.version} property. The review feedback points out that specifying the version in the submodules is redundant due to parent dependency management. Additionally, the selected Guava version (32.0.0-jre) is vulnerable to CVE-2023-2976, and it is recommended to upgrade to a secure version like 32.1.3-jre and ensure consistency across all profiles.

[gemini-code-assist]

The version of com.google.guava:guava is already managed in the parent POM's <dependencyManagement> section. Specifying the version here is redundant and can be safely removed to simplify dependency management.

    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
    </dependency>