From 0dac715d3e3916e7abc634f56becb5ef1e74c29d Mon Sep 17 00:00:00 2001
From: James Maes <jmaes@dmdbrands.com>
Date: Thu, 29 Oct 2026 16:05:16 -0500
Subject: [PATCH] fix: pin safe Guava version in aggregate BOM

Pin Guava 33.7.2-jre and include it in the BOM consumer guard to remediate CVE-2026-102554.

Validation: reactor verification, core/full service smoke, packaged integration and exact-image scan passed; zero HIGH/CRITICAL findings. GHCR bootstrap, publication and visibility changes are outside this PR.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
---
 qqq-all-bom-test/pom.xml | 5 +++++
 qqq-all-bom/pom.xml      | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/qqq-all-bom-test/pom.xml b/qqq-all-bom-test/pom.xml
index 6b0b939..1d758c8 100644
--- a/qqq-all-bom-test/pom.xml
+++ b/qqq-all-bom-test/pom.xml
@@ -51,6 +51,11 @@
    <!-- One versionless dependency per artifact the BOM manages, so resolving this -->
    <!-- module's test classpath resolves each of them. StackBomTest fails if one is missing. -->
    <dependencies>
+      <dependency>
+         <groupId>com.google.guava</groupId>
+         <artifactId>guava</artifactId>
+         <scope>test</scope>
+      </dependency>
       <!-- QQQ modules, qqq-esb, and qqq-frontend-next (from qqq-bom-pom) -->
       <dependency>
          <groupId>com.kingsrook.qqq</groupId>
diff --git a/qqq-all-bom/pom.xml b/qqq-all-bom/pom.xml
index 76f7a07..e5ac46c 100644
--- a/qqq-all-bom/pom.xml
+++ b/qqq-all-bom/pom.xml
@@ -37,6 +37,7 @@
       <h2.version>2.4.240</h2.version>
       <artemis.version>2.57.0</artemis.version>
       <rabbitmq-jms.version>3.9.0</rabbitmq-jms.version>
+      <guava.version>33.7.2-jre</guava.version>
    </properties>
 
    <profiles>
@@ -79,6 +80,12 @@
 
    <dependencyManagement>
       <dependencies>
+         <!-- Keep authentication and Google clients on the fixed Guava runtime. -->
+         <dependency>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+            <version>${guava.version}</version>
+         </dependency>
          <!-- QQQ modules and qqq-esb. -->
          <dependency>
             <groupId>com.kingsrook.qqq</groupId>
-- 
2.54.0