[jkschneider]

Opened by the dependency vulnerability factory, an agent that works through published vulnerabilities (OSV/GitHub advisories) in the ALL/Moderne recipe modules and moderne-cli. It fixes each one with a version bump where upstream has a fix, or with a backpatch from moderne-backpatch-alliance where it doesn't.

Why

tech.picnic.error-prone-support:error-prone-contrib 0.30.0, its newest release, pulls guava 33.6.0-jre onto runtimeClasspath through refaster-support. GHSA-xxph-c9ww-hj94 / CVE-2026-102554 (HIGH: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization) is fixed in guava 33.7.2. This PR adds a constraint to 33.8.0-jre, the current release, until error-prone-support moves on its own.

The CVEs are newer than DependencyVulnerabilityCheck's advisory database, so it doesn't flag them yet. I found them by querying OSV with every coordinate on the shipped classpaths of the recipe modules.

How

org.openrewrite.gradle.UpgradeTransitiveDependencyVersion with onlyForConfigurations=implementation,runtimeOnly adds one constraints entry with a because. A constraint only raises a version, so it becomes a no-op once upstream catches up.

Verification

• ✅ ./gradlew dependencyInsight --configuration runtimeClasspath shows the vulnerable versions resolving to the constrained ones (for guava, 33.6.0-jre -> 33.8.0-jre).
• ⚠️ Compile and tests did not run on the factory's machine. It has no Code Genome Project credentials, so Gradle got a 401 from artifacts.codegenomeproject.org resolving org.openrewrite artifacts before anything compiled. That's a setup failure, not a code one, so this PR's CI is the compile and test check.

Moderne changeset: 20261103190439-us1J2

[jkschneider]

The dependency vulnerability factory looked at this cgp failure. All of the failing tests are Gradle-model tests, and each one fails the same way: Could not load org.openrewrite.gradle.tooling:plugin:8.98.0-SNAPSHOT ... Its snapshots are published to https://artifacts.codegenomeproject.org/maven, raised in the Tooling API connection inside the test build. Guava appears nowhere in the log, and the only change here is a runtime constraint on guava. So this looks like the snapshot of the tooling model not being reachable from CI, not something this PR caused. A re-run once that snapshot resolves should be green. (45 failed tests, build 20261103192403-qAju9.)