[jaime-jmebot]

Problem

The library declares Guava 31.1-jre, but neither its production sources nor its examples use Guava. This unnecessarily adds its transitive dependencies to consumers. The declared version matches advisories for Guava temporary-file/directory helpers (CVE-2020-8908 and CVE-2023-2976); no call to those helpers was found in this project.

Change

Remove the unused implementation dependency and its generated-template comment. Keep the public Commons Math dependency and Java settings unchanged.

Validation

• Native Gradle 7.6 build on Java 11: library check and example compilation pass; no repository tests were present.
• Native runtime graph contains Commons Math 3.6.1 and no Guava.
• A separately compiled smoke using the native library classes/classpath passes a 21-to-42 state transition and exactly one start/finish callback.
• Patch applies cleanly to upstream 76c8fb0.

This reduces dependency exposure; it does not establish that an application was exploitable. Consumers using Guava directly should declare it themselves.

This automated PR is part of the jMonkeyEngine community library quality check.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}