From 6114af85691eb70bab2a0d843f4e813d03523f85 Mon Sep 17 00:00:00 2001
From: thugrock7 <polapragada.yashwant@gmail.com>
Date: Thu, 29 Oct 2026 14:23:15 +0530
Subject: [PATCH 1/3] bump deps to patch CVE's

---
 build.gradle.kts                           | 2 +-
 otel-extensions/build.gradle.kts           | 1 +
 shaded-protobuf-java-util/build.gradle.kts | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index c6f56663..54d2d687 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -65,7 +65,7 @@ subprojects {
         "opentelemetry_gradle_plugin" to "1.33.0-alpha",
         "byte_buddy" to "1.12.10",
         "slf4j" to "2.0.7",
-        "jackson" to "2.18.11"
+        "jackson" to "2.18.12"
     ))
   }
 
diff --git a/otel-extensions/build.gradle.kts b/otel-extensions/build.gradle.kts
index 65681bc1..3cdc84d0 100644
--- a/otel-extensions/build.gradle.kts
+++ b/otel-extensions/build.gradle.kts
@@ -75,6 +75,7 @@ dependencies {
     // fix vulnerability
     constraints {
         api("com.google.code.gson:gson:2.8.9")
+        api("com.google.guava:guava:33.7.2-jre")
     }
 
     testImplementation("io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:${versions["opentelemetry"]}")
diff --git a/shaded-protobuf-java-util/build.gradle.kts b/shaded-protobuf-java-util/build.gradle.kts
index 14a49a13..2044d190 100644
--- a/shaded-protobuf-java-util/build.gradle.kts
+++ b/shaded-protobuf-java-util/build.gradle.kts
@@ -9,6 +9,7 @@ dependencies {
     // fix vulnerability
     constraints {
         implementation("com.google.code.gson:gson:2.8.9")
+        implementation("com.google.guava:guava:33.7.2-jre")
     }
 }
 

From cdac174c4e45f4043999ce6f3d78712ba1cb3947 Mon Sep 17 00:00:00 2001
From: thugrock7 <polapragada.yashwant@gmail.com>
Date: Thu, 29 Oct 2026 16:59:11 +0530
Subject: [PATCH 2/3] demote guava

---
 otel-extensions/build.gradle.kts           | 1 -
 shaded-protobuf-java-util/build.gradle.kts | 1 -
 2 files changed, 2 deletions(-)

diff --git a/otel-extensions/build.gradle.kts b/otel-extensions/build.gradle.kts
index 3cdc84d0..65681bc1 100644
--- a/otel-extensions/build.gradle.kts
+++ b/otel-extensions/build.gradle.kts
@@ -75,7 +75,6 @@ dependencies {
     // fix vulnerability
     constraints {
         api("com.google.code.gson:gson:2.8.9")
-        api("com.google.guava:guava:33.7.2-jre")
     }
 
     testImplementation("io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:${versions["opentelemetry"]}")
diff --git a/shaded-protobuf-java-util/build.gradle.kts b/shaded-protobuf-java-util/build.gradle.kts
index 2044d190..14a49a13 100644
--- a/shaded-protobuf-java-util/build.gradle.kts
+++ b/shaded-protobuf-java-util/build.gradle.kts
@@ -9,7 +9,6 @@ dependencies {
     // fix vulnerability
     constraints {
         implementation("com.google.code.gson:gson:2.8.9")
-        implementation("com.google.guava:guava:33.7.2-jre")
     }
 }
 

From f1d7b06e7ce2a7a2ae0c2ff323eb85afd4976f0c Mon Sep 17 00:00:00 2001
From: thugrock7 <polapragada.yashwant@gmail.com>
Date: Thu, 29 Oct 2026 17:12:14 +0530
Subject: [PATCH 3/3] demote jackson

---
 build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index 54d2d687..c6f56663 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -65,7 +65,7 @@ subprojects {
         "opentelemetry_gradle_plugin" to "1.33.0-alpha",
         "byte_buddy" to "1.12.10",
         "slf4j" to "2.0.7",
-        "jackson" to "2.18.12"
+        "jackson" to "2.18.11"
     ))
   }