Not sure if there’s anywhere to put a ticket in for this, but when using the datahub-client from io.acryl for Java, dependency scanners like OWASP’s flag the client as depending on a vulnerable version of guava that’s pretty old. It doesn’t seem like the client actually depends on it though, just some nested pom file used to build the artifact mentions it. Normally I think those files aren’t published in the jar. Is there anyway to fix that or somewhere I could put a ticket in for that?

Hi Mark - would you be willing to create an issue for this one? We will have to take a deeper look to try to clear this indirect dependency

Yeah where do I do that?

On Github 🙂

Not to be obtuse, but is there one for the datahub-client or acryl?

This would be on DataHub's main repo

I can’t find on Maven Central any link to a repo for that project, which would be useful.