There is a dependency to com.google.guava:guava:30.1-jre which is known as vulnerable [CVE-2023-2976](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976)