From dfa60caa57b173c84dbee0877f03207c56e897e5 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Thu, 29 Oct 2026 23:54:54 +0000
Subject: [PATCH] Update guava to 33.7.2-jre

---
 modello-core/pom.xml | 6 ++++++
 pom.xml              | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/modello-core/pom.xml b/modello-core/pom.xml
index 68c61a48b..4ef078e5c 100644
--- a/modello-core/pom.xml
+++ b/modello-core/pom.xml
@@ -25,6 +25,12 @@
       <artifactId>guice</artifactId>
       <scope>runtime</scope>
     </dependency>
+    <!-- guice 5.1.0 brings in guava 30.1-jre, which has a known vulnerability -->
+    <dependency>
+      <groupId>com.google.guava</groupId>
+      <artifactId>guava</artifactId>
+      <scope>runtime</scope>
+    </dependency>
     <dependency>
       <groupId>org.codehaus.plexus</groupId>
       <artifactId>plexus-utils</artifactId>
diff --git a/pom.xml b/pom.xml
index 831da1be2..d4a09a5ad 100644
--- a/pom.xml
+++ b/pom.xml
@@ -302,6 +302,11 @@
         <artifactId>guice</artifactId>
         <version>5.1.0</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>33.7.2-jre</version>
+      </dependency>
       <dependency>
         <groupId>org.codehaus.plexus</groupId>
         <artifactId>plexus-utils</artifactId>