From 1600c1414fda030e49a6394d93f65403d3b8eff6 Mon Sep 17 00:00:00 2001
From: Joan Viladrosa <joan@moderne.io>
Date: Wed, 12 Jul 2023 16:30:02 +0200
Subject: [PATCH] Suppress CVE-2023-2976 (#598)

---
 suppressions.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/suppressions.xml b/suppressions.xml
index 4a604e05..e61fb99c 100644
--- a/suppressions.xml
+++ b/suppressions.xml
@@ -59,4 +59,12 @@
         <packageUrl regex="true">^pkg:maven/io\.micrometer\.prometheus/prometheus\-rsocket\-client@.*$</packageUrl>
         <cve>CVE-2019-3826</cve>
     </suppress>
+    <suppress until="2023-07-28Z">
+        <notes><![CDATA[
+            file name: guava-31.1-jre.jar
+            Reverted in https://github.com/openrewrite/rewrite-python/commit/f487df7dabb8588ae2edb17e31ff7b8ba3ffc133 because Guava 32 introduces gradle module metadata which causes downstream breakage in build plugins.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@31.1-jre$</packageUrl>
+        <cve>CVE-2023-2976</cve>
+    </suppress>
 </suppressions>