Update kogito-build/kogito-dependencies-bom/pom.xml

Co-authored-by: Ricardo Zanini <[email protected]>
apache · Jul 7, 2023 · 1fd503e · 1fd503e
1 parent c35cb15
commit 1fd503e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/kogito-build/kogito-dependencies-bom/pom.xml b/kogito-build/kogito-dependencies-bom/pom.xml
@@ -127,7 +127,7 @@
 
   <dependencyManagement>
     <dependencies>
-      <!-- Guava should not be used directly by Kogito, here we are managing it to override dependency added by GRPC -->
+      <!-- Guava should not be used directly by Kogito, here we are managing it to override dependency added by GRPC to fix this CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976 -->
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>