From deb1f9e248a75d3577949206f6bcd52136d9722d Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 26 Jul 2026 18:55:25 +0000
Subject: [PATCH] DO NOT MERGE: add GPL + vulnerable deps to test
 dependency-review gates

Co-Authored-By: Andreas Igel <andreas.igel@computacenter.com>
---
 example/pom.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/example/pom.xml b/example/pom.xml
index a1ad407a..235a304f 100644
--- a/example/pom.xml
+++ b/example/pom.xml
@@ -57,6 +57,20 @@
       <version>${jackson-databind.version}</version>
     </dependency>
 
+    <!-- DO NOT MERGE: intentionally added to exercise the dependency-review gates. -->
+    <!-- GPL-2.0 licensed -> should trip the license gate. -->
+    <dependency>
+      <groupId>com.mysql</groupId>
+      <artifactId>mysql-connector-j</artifactId>
+      <version>9.1.0</version>
+    </dependency>
+    <!-- Log4Shell (CVE-2021-44228, critical) -> should trip the severity gate. -->
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-core</artifactId>
+      <version>2.14.1</version>
+    </dependency>
+
   </dependencies>