[Bug]: Upgrade to Guava 32+ to fix CVE-2023-2976

[ppalaga]

Module

Core

Testcontainers version

1.19.0

Using the latest Testcontainers version?

Yes

Host OS

any

Host Arch

any

Docker version

irelevant

What happened?

I hope my understanding is correct that the shaded org/testcontainers/shaded/com/google/common/io/FileBackedOutputStream.class file in org.testcontainers:testcontainers:1.19.0 comes from guava 30.1.1-jre:
https://github.com/testcontainers/testcontainers-java/blob/1.19.0/build.gradle#L8

Guava versions >= 1.0, < 32.0.0 suffer from CVE-2023-2976 alias google/guava#2575

It would be nice to upgrade the shaded Guava and release

Relevant log output

No response

Additional Information

No response

[eddumelendez]

Hi @ppalaga, that guava version is used by japicmp plugin for gradle configuration purposes. The shaded guava library is coming from https://github.com/docker-java/docker-java which is not being used anymore.

[eddumelendez]

#7534 should fix it but will take a look in more detail once I'm back from vacation.

[eddumelendez]

you can also exclude it and it should be fine

[ppalaga]

#7534 should fix it but will take a look in more detail once I'm back from vacation.

Thanks, I have built #7534 and the output of javap -c FileBackedOutputStream.class embedded in testcontainers ressembles the one from guava 32.1.2-jre.

When can we expect a release with the above fix?