GHSA-xxph-c9ww-hj94
The advisories a survey carries survive only in its brief's rendered list of affected locations, and that list stops after a fixed number of entries without the count above it changing — so what a survey was seen to carry is what fitted.
The package it is raised against
Seen against com.google.guava:guava.