[MINDEXER-126] Remove guava dependency from indexer-core

• Type: Dependency upgrade
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 6.1.0, 6.1.1
• Assignee: Sylwester Lachiewicz
• Reporter: Sylwester Lachiewicz
• Created: 22/Jan/21 22:35
• Updated: 13/Feb/22 08:19
• Resolved: 05/Apr/21 14:52

Description

It suffers from multiple CVEs:

• guava < 24.1.1 is vulnerable to CVE-2018-10237.
• guava < 30.0 is vulnerable to CVE-2020-8908.

Moving to guava 30.1 will require moving to Java 8 so it's actually simpler to just remove the dependency altogether.