As part of our ongoing security initiatives, our team is conducting regular checks on all third-party dependency jars bundled within our product. Our objective is to ensure that we are using the most up-to-date libraries and to avoid including any components that have reached end-of-life (EOL) status.
During a recent review, we observed that some of the Android Enterprise dependencies we use opencensus-api and opencensus-contrib-http-util jars are outdated.
Dependancies for these jars : google-http-client.jar
Based on the release history of opencensus-api, it appears the library has not been updated in the past three years since Apr 29, 2022 (version 0.31.1)
https://mvnrepository.com/artifact/io.opencensus/opencensus-api
https://mvnrepository.com/artifact/io.opencensus/opencensus-contrib-http-util
Given the implications this has on our security posture, we would like to understand if there are any plans to:
Upgrade Google google-http-client.jar independent of this jar?
We would greatly appreciate any guidance or timeline you can provide regarding this.
As part of our ongoing security initiatives, our team is conducting regular checks on all third-party dependency jars bundled within our product. Our objective is to ensure that we are using the most up-to-date libraries and to avoid including any components that have reached end-of-life (EOL) status.
During a recent review, we observed that some of the Android Enterprise dependencies we use opencensus-api and opencensus-contrib-http-util jars are outdated.
Dependancies for these jars : google-http-client.jar
Based on the release history of opencensus-api, it appears the library has not been updated in the past three years since Apr 29, 2022 (version 0.31.1)
https://mvnrepository.com/artifact/io.opencensus/opencensus-api
https://mvnrepository.com/artifact/io.opencensus/opencensus-contrib-http-util
Given the implications this has on our security posture, we would like to understand if there are any plans to:
Upgrade Google google-http-client.jar independent of this jar?
We would greatly appreciate any guidance or timeline you can provide regarding this.