From 5ae70feacfda53a660f5ceb37ec5432d7012c685 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Sun, 23 Aug 2026 14:15:21 +0200
Subject: [PATCH] Pin Guava on the test classpath

Guice 5.1.0 resolves Guava 30.1-jre, which CVE-2023-2976 and
CVE-2020-8908 cover. No code here uses Guava; the pin only keeps the
flagged version out. 33.7.1-jre is still Java 8 bytecode.
---
 pom.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pom.xml b/pom.xml
index d089102b..9b4d50d8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -133,6 +133,16 @@
       <version>5.1.0</version>
       <scope>test</scope>
     </dependency>
+    <!-- Guice 5.1.0 drags in Guava 30.1-jre, which CVE-2023-2976 and
+         CVE-2020-8908 cover. Nothing here uses Guava; the pin only keeps
+         the flagged version off the test classpath. 33.7.1-jre is still
+         Java 8 bytecode, so it holds on this line. -->
+    <dependency>
+      <groupId>com.google.guava</groupId>
+      <artifactId>guava</artifactId>
+      <version>33.7.1-jre</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.assertj</groupId>
       <artifactId>assertj-core</artifactId>