# Security Policy

## Supported Versions

We support the past two Go releases (for example, Go 1.17.x and Go 1.18.x when Go 1.18.x is the latest stable release).

See https://go.dev/wiki/Go-Release-Cycle and in particular the
[Release Maintenance](https://go.dev/wiki/Go-Release-Cycle#release-maintenance)
part of that page.

## Reporting a Vulnerability

 * @author Charles Fry
 * @since 10.0
 */
@GwtCompatible
@FunctionalInterface
public interface RemovalListener<K, V> {
  /**
   * Notifies the listener that a removal occurred at some point in the past.
   *
   * <p>This does not always signify that the key is now absent from the cache, as it may have
   * already been re-added.
   */
  // Technically should accept RemovalNotification<? extends K, ? extends V>, but because

 * identical functionality but do not throw {@link IOException}.
 *
 * <p><b>Warning:</b> The caller is responsible for not attempting to read past the end of the
 * array. If any method encounters the end of the array prematurely, it throws {@link
 * IllegalStateException} to signify <i>programmer error</i>. This behavior is a technical violation

        headers =
          headersOf(
            "Last-Modified",
            formatDate(-1, TimeUnit.HOURS)!!,
            "Expires",
            formatDate(1, TimeUnit.HOURS)!!,
          ),
        body = "ABC.1",
      ),
    )
    server.enqueue(
      MockResponse(
        headers =
          headersOf(
            "Last-Modified",
            formatDate(-1, TimeUnit.HOURS)!!,

   * flavors can read old data or data from the other flavor. However, we strongly discourage
   * relying on this, as we have made incompatible changes to serialized forms in the past and
   * expect to do so again, as discussed in https://github.com/google/guava#important-warnings.
   */
  @SuppressWarnings("unused")
  private static final class SerializedForm<V> implements Serializable {

            + "]"
            + "0189["
            + Character.MAX_CODE_POINT
            + "]";
    assertThat(escapeAsString(e, TEST_STRING)).isEqualTo(expected);
  }

  public void testGrowBuffer() { // need to grow past an initial 1024 byte buffer
    StringBuilder input = new StringBuilder();
    StringBuilder expected = new StringBuilder();
    for (int i = 256; i < 1024; i++) {
      input.append((char) i);

            + "]"
            + "0189["
            + Character.MAX_CODE_POINT
            + "]";
    assertThat(escapeAsString(e, TEST_STRING)).isEqualTo(expected);
  }

  public void testGrowBuffer() { // need to grow past an initial 1024 byte buffer
    StringBuilder input = new StringBuilder();
    StringBuilder expected = new StringBuilder();
    for (int i = 256; i < 1024; i++) {
      input.append((char) i);

 *     Object} if any key is acceptable
 * @author Charles Fry
 * @since 10.0
 */
@GwtCompatible
public interface RemovalListener<K, V> {
  /**
   * Notifies the listener that a removal occurred at some point in the past.
   *
   * <p>This does not always signify that the key is now absent from the cache, as it may have
   * already been re-added.
   */
  // Technically should accept RemovalNotification<? extends K, ? extends V>, but because

RUN groupadd -g 1001 buildslave && useradd -m -u 1001 -g buildslave buildslave
RUN mkdir -p /tf/venv
RUN chown -R buildslave:buildslave /tf

# All lines past this point are reset when $CACHEBUSTER is set. We need this
# for Python specifically because we install some nightly packages which are
# likely to change daily.
ARG CACHEBUSTER=0
RUN echo $CACHEBUSTER

you need access credentials for a successful exploit).

If you have not received a reply to your email within 48 hours or you have not heard from the security team
for the past five days please contact the security team directly:

- Primary security coordinator: ******@****.***
- Secondary coordinator: ******@****.***
- If you receive no response: ******@****.***

### Disclosure Process