From b6d4cd1e55b9a0e44f63dac7d4c85a0948639de4 Mon Sep 17 00:00:00 2001
From: "opensearch-trigger-bot[bot]"
 <98922864+opensearch-trigger-bot[bot]@users.noreply.github.com>
Date: Wed, 23 Aug 2023 14:48:45 -0700
Subject: [PATCH] exclude <v32 version of google guava dependency from google
 java format and add google guava 32.0.1 to resolve CVE CVE-2023-2976 (#1094)
 (#1095)

(cherry picked from commit 778e7ce6d377f1bb3e0fbf3f2ed3a7a360c2f76f)

Signed-off-by: Surya Sashank Nistala <snistala@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 core/build.gradle | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/build.gradle b/core/build.gradle
index 5b10e8e07..bd9d45a70 100644
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -14,7 +14,10 @@ dependencies {
     api "org.jetbrains.kotlin:kotlin-stdlib-jdk8:${kotlin_version}"
     implementation "com.cronutils:cron-utils:9.1.6"
     api "org.opensearch.client:opensearch-rest-client:${opensearch_version}"
-    implementation 'com.google.googlejavaformat:google-java-format:1.10.0'
+    implementation('com.google.googlejavaformat:google-java-format:1.10.0')  {
+        exclude group: 'com.google.guava'
+    }
+    implementation 'com.google.guava:guava:32.0.1-jre'
     api "org.opensearch:common-utils:${common_utils_version}@jar"
     implementation 'commons-validator:commons-validator:1.7'