From f251114a046da5c1d1830c2e951c6c9b74017bf4 Mon Sep 17 00:00:00 2001
From: Slawomir Jaranowski <s.jaranowski@gmail.com>
Date: Sat, 11 Oct 2025 12:44:16 +0200
Subject: [PATCH] Use direct dependencies for guava

dependencyManagement are not transitive in Maven 3.x
---
 pom.xml | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/pom.xml b/pom.xml
index 53a8a9e..f31ec9e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -35,18 +35,14 @@
     <project.build.outputTimestamp>2025-08-18T20:50:45Z</project.build.outputTimestamp>
   </properties>
 
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>com.google.guava</groupId>
-        <artifactId>guava</artifactId>
-        <!-- overwrite due to CVE-2023-2976 in Guice transitive dependencies -->
-        <version>33.5.0-jre</version>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
-
   <dependencies>
+    <!-- use direct dependency to override version such dependencyManagement are not transitive in Maven 3.x -->
+    <dependency>
+      <groupId>com.google.guava</groupId>
+      <artifactId>guava</artifactId>
+      <!-- overwrite due to CVE-2023-2976 in Guice transitive dependencies -->
+      <version>33.5.0-jre</version>
+    </dependency>
     <dependency>
       <groupId>org.eclipse.sisu</groupId>
       <artifactId>org.eclipse.sisu.plexus</artifactId>