From 72a6eac05ab16c53164db0014fbc63318480f8ad Mon Sep 17 00:00:00 2001
From: Jim Bethancourt <jimbethancourt@gmail.com>
Date: Fri, 3 Jul 2026 08:37:05 -0500
Subject: [PATCH] Update more vulnerable dependencies

---
 cli/pom.xml                         |  5 -----
 codebase-graph-builder/pom.xml      |  7 +++++++
 effort-ranker/pom.xml               |  7 +++++++
 graph-algorithms/pom.xml            |  1 -
 pom.xml                             |  6 ++----
 refactor-first-maven-plugin/pom.xml | 20 +++++++++++++++-----
 6 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/cli/pom.xml b/cli/pom.xml
index 8867f524..68fa21e4 100644
--- a/cli/pom.xml
+++ b/cli/pom.xml
@@ -34,11 +34,6 @@
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-simple</artifactId>
         </dependency>
-        <!-- Needed to suppress CVE-2023-2976 in maven-core:3.9.9 -->
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-core</artifactId>
diff --git a/codebase-graph-builder/pom.xml b/codebase-graph-builder/pom.xml
index 7078de06..025700e6 100644
--- a/codebase-graph-builder/pom.xml
+++ b/codebase-graph-builder/pom.xml
@@ -34,6 +34,13 @@
             <groupId>org.jgrapht</groupId>
             <artifactId>jgrapht-core</artifactId>
         </dependency>
+
+        <!-- Addresses CVE-2026-40984 introduced through rewrite-core 8.86.0 -->
+        <dependency>
+            <groupId>io.micrometer</groupId>
+            <artifactId>micrometer-core</artifactId>
+            <version>1.10.0</version>
+        </dependency>
         <dependency>
             <groupId>org.openrewrite</groupId>
             <artifactId>rewrite-java-21</artifactId>
diff --git a/effort-ranker/pom.xml b/effort-ranker/pom.xml
index c9e76c26..3fcaa1a1 100644
--- a/effort-ranker/pom.xml
+++ b/effort-ranker/pom.xml
@@ -19,6 +19,13 @@
             <artifactId>codebase-graph-builder</artifactId>
         </dependency>
 
+        <!-- commons-lang3 needed to address CVE-2025-48924
+         introduced through pmd-java 7.0.0-rc4-->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.18.0</version>
+        </dependency>
         <dependency>
             <groupId>net.sourceforge.pmd</groupId>
             <artifactId>pmd-java</artifactId>
diff --git a/graph-algorithms/pom.xml b/graph-algorithms/pom.xml
index 275d281e..87ee6d6a 100644
--- a/graph-algorithms/pom.xml
+++ b/graph-algorithms/pom.xml
@@ -34,7 +34,6 @@
         <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
-            <version>33.4.8-jre</version>
         </dependency>
     </dependencies>
     
diff --git a/pom.xml b/pom.xml
index 1bb70db2..df81bf15 100644
--- a/pom.xml
+++ b/pom.xml
@@ -189,12 +189,10 @@
                 <version>2.18.8</version>
             </dependency>
 
-            <!-- Needed to suppress CVE-2023-2976-->
-            <!-- Guava 33.2.1-jre is used by maven-core -->
             <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava</artifactId>
-                <version>33.4.0-jre</version>
+                <version>33.6.0-jre</version>
             </dependency>
 
             <dependency>
@@ -449,7 +447,7 @@
                     <plugin>
                         <groupId>org.owasp</groupId>
                         <artifactId>dependency-check-maven</artifactId>
-                        <version>12.1.0</version>
+                        <version>12.2.2</version>
                         <configuration>
                             <failBuildOnCVSS>8.0</failBuildOnCVSS>
                         </configuration>
diff --git a/refactor-first-maven-plugin/pom.xml b/refactor-first-maven-plugin/pom.xml
index 8863b349..55b0aae5 100644
--- a/refactor-first-maven-plugin/pom.xml
+++ b/refactor-first-maven-plugin/pom.xml
@@ -26,11 +26,6 @@
         </dependency>
 
         <!-- Maven Reporting -->
-        <!-- Needed to suppress CVE-2023-2976 in maven-core-->
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
         <!-- Needed to suppress CVE-2024-36124 in maven-core-->
         <dependency>
             <groupId>org.iq80.snappy</groupId>
@@ -42,6 +37,21 @@
             <artifactId>maven-core</artifactId>
         </dependency>
 
+        <!-- commons-beanutils needed to suppress CVE-2025-48734
+         introduced through maven-reporting-impl 4.0.0-->
+        <dependency>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+            <version>1.11.0</version>
+        </dependency>
+
+        <!-- commons-lang3 needed to suppress CVE-2025-48924
+        introduced through maven-reporting-impl 4.0.0-->
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.18.0</version>
+        </dependency>
         <dependency>
             <groupId>org.apache.maven.reporting</groupId>
             <artifactId>maven-reporting-impl</artifactId>