From 1fd503e975f010b014f2d83d46fec45f4c84b365 Mon Sep 17 00:00:00 2001
From: Francisco Javier Tirado Sarti
 <65240126+fjtirado@users.noreply.github.com>
Date: Fri, 7 Jul 2023 16:14:11 +0200
Subject: [PATCH] Update kogito-build/kogito-dependencies-bom/pom.xml

Co-authored-by: Ricardo Zanini <1538000+ricardozanini@users.noreply.github.com>
---
 kogito-build/kogito-dependencies-bom/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kogito-build/kogito-dependencies-bom/pom.xml b/kogito-build/kogito-dependencies-bom/pom.xml
index 0734942a922..c2eed56bdc8 100644
--- a/kogito-build/kogito-dependencies-bom/pom.xml
+++ b/kogito-build/kogito-dependencies-bom/pom.xml
@@ -127,7 +127,7 @@
 
   <dependencyManagement>
     <dependencies>
-      <!-- Guava should not be used directly by Kogito, here we are managing it to override dependency added by GRPC -->
+      <!-- Guava should not be used directly by Kogito, here we are managing it to override dependency added by GRPC to fix this CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976 -->
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>