What the developer wrote
Authored by Craig Raw
upgrade guava and commons-lang3
What changed, and why it matters
This commit simply updates two common helper libraries (Guava and Apache Commons Lang3) to newer versions in the project's build file. It does not change any application code. Such updates are often done to pick up bug fixes or security fixes in those libraries, but the commit message does not say this is a security fix, and no specific vulnerability is mentioned.
Verify whether the old versions (Guava 33.0.0-jre and commons-lang3 3.7) are affected by known CVEs relevant to Sparrow Wallet's usage, and confirm the new versions resolve them. Treat this as a maintenance update unless a specific vulnerability is confirmed.
Security signals we found
Dependency version bump for widely-used utility libraries
No application code changes
No explicit security rationale in commit message or diff
No CVE or advisory referenced in commit materials
Evidence from the diff
The commit bumps com.google.guava:guava from 33.0.0-jre to 33.5.0-jre and org.apache.commons:commons-lang3 from 3.7 to 3.19.0 in build.gradle. No source code changes are included. The diff is a routine dependency version update with no explicit security context provided by the vendor.
Changed components
build.gradle dependency declarationscom.google.guava:guavaorg.apache.commons:commons-lang3Inspect captured patch +2 / −2
diff --git a/build.gradle b/build.gradle
index 4afa528..b9e2a2c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -45,7 +45,7 @@ dependencies {
//Any changes to the dependencies must be reflected in the module definitions below!
implementation(project(':drongo'))
implementation(project(':lark'))
- implementation('com.google.guava:guava:33.0.0-jre')
+ implementation('com.google.guava:guava:33.5.0-jre')
implementation('com.google.code.gson:gson:2.9.1')
implementation('com.h2database:h2:2.1.214')
implementation('com.zaxxer:HikariCP:4.0.3') {
@@ -100,7 +100,7 @@ dependencies {
implementation('com.sparrowwallet:tern:1.0.6')
implementation('io.reactivex.rxjava2:rxjava:2.2.15')
implementation('io.reactivex.rxjava2:rxjavafx:2.2.2')
- implementation('org.apache.commons:commons-lang3:3.7')
+ implementation('org.apache.commons:commons-lang3:3.19.0')
implementation('org.apache.commons:commons-compress:1.27.1')
implementation('net.sourceforge.streamsupport:streamsupport:1.7.0')
implementation('com.github.librepdf:openpdf:1.3.30')
Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.