google-auth-library-java chore(deps): update dependency com.google.guava:guava to v32.1.3-android

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
com.google.guava:guava	`32.0.0-android` -> `32.1.3-android`

Release Notes

google/guava (com.google.guava:guava)

`v32.1.2`: 32.1.2

Compare Source

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.1.2-jre</version>
  <!-- or, for Android: -->
  <version>32.1.2-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

failureaccess-1.0.1.jar

Javadoc

JDiff

Changelog

Removed the section of our Gradle metadata that caused Gradle to report conflicts with listenablefuture. (9ed0fa6)
Changed our Maven project to avoid affecting which version of Mockito our Gradle users see. (71a16d5)
collect: Under J2CL, exposed ImmutableList and ImmutableSet methods copyOf and of for JavaScript usage. (b41968f)
net: Optimized InternetDomainName construction. (3a1d18f, eaa62eb)

`v32.1.1`: 32.1.1

Compare Source

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.1.1-jre</version>
  <!-- or, for Android: -->
  <version>32.1.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

failureaccess-1.0.1.jar

Javadoc

JDiff

Changelog

Fixed our broken Gradle metadata from 32.1.0. Sorry again for the trouble. If you use Gradle, please still read the release notes from that version: You may still see errors from the new checking that the metadata enables, and the release notes discuss how to fix those errors.

We made a mistake in our release script, so the new Gradle metadata (discussed below) has broken version numbers in 32.1.0. Sorry for the trouble and for the need for another quick patch release. We recommend upgrading straight to release 32.1.2, especially if you use Gradle or if you publish a library whose users might use Gradle. Still, read the release notes below if you use Gradle, since the fixed Gradle metadata in 32.1.2 may still require action on your part.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.1.0-jre</version>
  <!-- or, for Android: -->
  <version>32.1.0-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

failureaccess-1.0.1.jar

Javadoc

JDiff

Changelog

Gradle Module Metadata

Warning: We made a mistake in our release script, so this is broken in 32.1.0. We recommend upgrading straight to release 32.1.2, especially if you use Gradle or if you publish a library whose users might use Gradle. Still, read the release notes below if you use Gradle, since the fixed Gradle metadata in 32.1.2 may still require action on your part.

The Gradle team has contributed a metadata file for Guava. If you use Gradle 6 or higher, you will see better handling of two kinds of dependency conflicts, plus another small feature related to our dependencies. As a result of this change, you may see errors, which you can resolve as documented below. If you encounter a problem that isn't documented below, or if the documentation is unclear, please let us know.

If you use Gradle 6 (not 5, not 7+)

You may see an error like this one:

> Could not resolve all artifacts for configuration ':classpath'.
   > Could not resolve com.google.guava:guava:30.1-jre.
     Required by:
         project : > com.google.cloud.tools.jib:com.google.cloud.tools.jib.gradle.plugin:2.8.0 > gradle.plugin.com.google.cloud.tools:jib-gradle-plugin:2.8.0
      > The consumer was configured to find a runtime of a library compatible with Java 15, packaged as a jar, and its dependencies declared externally. However we cannot choose between the following variants of com.google.guava:guava:32.1.1-jre:
          - androidRuntimeElements
          - jreRuntimeElements
        All of them match the consumer attributes:
          - Variant 'androidRuntimeElements' capabilities com.google.collections:google-collections:32.1.1-jre and com.google.guava:guava:32.1.1-jre and com.google.guava:listenablefuture:1.0 declares a runtime of a library compatible with Java 8, packaged as a jar, and its dependencies declared externally:

If you do, you'll need to add something like this to a place where you configure the Java plugins:

sourceSets.all {
  configurations.getByName(runtimeClasspathConfigurationName) {
    attributes.attribute(Attribute.of("org.gradle.jvm.environment", String), "standard-jvm")
  }
  configurations.getByName(compileClasspathConfigurationName) {
    attributes.attribute(Attribute.of("org.gradle.jvm.environment", String), "standard-jvm")
  }
}

If you see an error about a duplicate `ListenableFuture` class

For example:

Execution failed for task ':app:checkDebugDuplicateClasses'.
> A failure occurred while executing com.android.build.gradle.internal.tasks.CheckDuplicatesRunnable
   > Duplicate class com.google.common.util.concurrent.ListenableFuture found in modules jetified-guava-32.1.1-android (com.google.guava:guava:32.1.1-android) and jetified-listenablefuture-1.0 (com.google.guava:listenablefuture:1.0)

This appears to be a Gradle bug.

@mathisdt has provided a workaround:

dependencies {
### dependency definitions here ...
  modules {
    module("com.google.guava:listenablefuture") {
      replacedBy("com.google.guava:guava", "listenablefuture is part of guava")
    }
  }
}

Selecting the appropriate flavor

When Gradle automatically selects the newest version of Guava in your dependency graph, it will now also select the appropriate flavor (-android or -jre) based on whether you project targets Android or not. For example, if you depend on 32.1.0-android and 30.0-jre, Gradle will select 32.1.0-jre. This is the version most likely to be compatible with all your dependencies.

In the unusual event that you need to override Gradle's choice of flavor, you can do so as follows:

dependencies.constraints {
  implementation("com.google.guava:guava") {
    attributes {
      attribute(
        TargetJvmEnvironment.TARGET_JVM_ENVIRONMENT_ATTRIBUTE, 
        objects.named(TargetJvmEnvironment, TargetJvmEnvironment.ANDROID))
    }
  }
}

// If the above leads to a conflict error because there are additional transitive dependencies to Guava, then use:
configurations.all {
  resolutionStrategy.capabilitiesResolution.withCapability("com.google.guava:guava") {
    select(candidates.find { it.variantName.contains("android") })
  }
}

Reporting dependencies that overlap with Guava

If your dependency graph contains the very old google-collections or the hacky listenablefuture, Gradle will now report that those libraries contain duplicates of Guava classes. When this happens, you'll need to tell Gradle to select Guava:

configurations.all {
  resolutionStrategy.capabilitiesResolution.withCapability("com.google.collections:google-collections") {
    select("com.google.guava:guava:0")
  }
  // and/or
  resolutionStrategy.capabilitiesResolution.withCapability("com.google.guava:listenablefuture") {
    select("com.google.guava:guava:0")
  }
}

If that doesn't work, please let us know. And let us know whether our replacedBy workaround or these other workarounds work instead.

Omitting annotations at runtime

One dependency of Guava that is not needed at runtime (j2objc-annotations) is now omitted from the runtime classpath. (We may omit others in the future. See #6606.)

Other changes

collect: Tweaked more nullness annotations. (501a016, 5c23590)
hash: Enhanced crc32c() to use Java's hardware-accelerated implementation where available. (65c7f10)
util.concurrent: Added Duration-based default methods to ListeningExecutorService. (e7714b0)
Began updating Javadoc to focus less on APIs that have been superseded by additions to the JDK. We're also looking to add more documentation that directs users to JDK equivalents for our APIs. Further PRs welcome! (c9efc47, 01dcc2e)
Fixed some problems with using Guava from a Java Agent. (But we don't test that configuration, and we don't know how well we'll be able to keep it working.) (e42d4e8, de62703)
Fixed BootstrapMethodError when using CacheBuilder from a custom system class loader. (As with the previous item, we're not sure how well we'll be able to keep this use case working.) (a667c38)
Suppressed a harmless unusable-by-js warning seen by users of guava-gwt.

`v32.0.1`: 32.0.1

Compare Source

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.1-jre</version>
  <!-- or, for Android: -->
  <version>32.0.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

failureaccess-1.0.1.jar

Javadoc

JDiff

Changelog

io: Fixed Files.createTempDir and FileBackedOutputStream under Windows, which broke as part of the security fix in release 32.0.0. Sorry for the trouble. (fdbf77d)