EOL Status of OpenCensus Jars and Request for Migration

[sharmila-shree]

As part of our ongoing security initiatives, our team is conducting regular checks on all third-party dependency jars bundled within our product. Our objective is to ensure that we are using the most up-to-date libraries and to avoid including any components that have reached end-of-life (EOL) status.

During a recent review, we observed that some of the Android Enterprise dependencies we use opencensus-api and opencensus-contrib-http-util jars are outdated.
Dependancies for these jars : google-http-client.jar

Based on the release history of opencensus-api, it appears the library has not been updated in the past three years since Apr 29, 2022 (version 0.31.1)
https://mvnrepository.com/artifact/io.opencensus/opencensus-api
https://mvnrepository.com/artifact/io.opencensus/opencensus-contrib-http-util

Given the implications this has on our security posture, we would like to understand if there are any plans to:
Upgrade Google google-http-client.jar independent of this jar?

We would greatly appreciate any guidance or timeline you can provide regarding this.

[ldetmer]

hi @sharmila-shree at this time we do not plan on removing opencensus libraries from our SDK. If you need immediate assistance with this issue please open a support ticket.

[sharmila-shree]

@ldetmer Is there any plan to use any alternatives for this jar? Or is it possible to get the opencensus jar upgraded?

[NeilPickles]

Any update on this our security tools are now blocking us from using this without deviations.