Sec vul: CVE-2023-2976 from google-guava dep

[amaciejk]

Can you update the version of google guava used to 32.0.1 or higher to resolve CVE-2023-2976 for the next release?

https://nvd.nist.gov/vuln/detail/CVE-2023-2976
https://mvnrepository.com/artifact/com.google.googlejavaformat/google-java-format/1.17.0
https://mvnrepository.com/artifact/com.google.guava/guava

[jaguilar-atl]

It looks like this change is already in the master branch.
https://github.com/google/google-java-format/blob/master/pom.xml#L89

Is there an estimated timeline for when the next release will be?

[raghav-deepsource]

It would be great if a patch release can be made for this change, please do expedite it.

[gregallen]

Another vote for this - this issue prevents the intellij plugin from being used in a corporate environment

[cushon]

I pushed a release that includes the Guava dependency update: https://github.com/google/google-java-format/releases/tag/v1.18.0

[gregallen]

The IntelliJ plugin needs to be updated to use new version and released

It is still referencing 1.17.0

Thanks!