From 1b6c1f7be5e401a5a8c99bec1079366fce9237be Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 29 Oct 2026 10:00:07 +0800
Subject: [PATCH] build(deps): [1.18.x] upgrade Guava to 33.7.2-jre

Backport #3743 and #3850 as a direct upgrade from 33.6.0-jre.
Includes Guava's deserialization allocation fix for CVE-2026-102554.

(cherry picked from commit d8d7420e79faea8e20a6a8cf04c3c852d6646dcd)
(cherry picked from commit e00e780e9a1adbb0c5bbd4840e80d69f30c4d43b)

Co-authored-by: Codex <codex@openai.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 88acb65fb0..88e9624ad5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -95,7 +95,7 @@
     <semver.api.version>0.9.33</semver.api.version>
     <slf4j.version>1.7.33</slf4j.version>
     <avro.version>1.11.5</avro.version>
-    <guava.version>33.6.0-jre</guava.version>
+    <guava.version>33.7.2-jre</guava.version>
     <brotli-codec.version>0.1.1</brotli-codec.version>
     <assertj.version>3.27.7</assertj.version>
     <junit.version>5.14.4</junit.version>