[dependabot]

Bumps com.google.guava:guava from 33.7.2-jre to 33.8.0-jre.

Release notes

Sourced from com.google.guava:guava's releases.

33.8.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.8.0-jre</version>
  <!-- or, for Android: -->
  <version>33.8.0-android</version>
</dependency>

Jar files

• 33.8.0-jre.jar
• 33.8.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.8.0-jre
• 33.8.0-android

JDiff

• 33.8.0-jre vs. 33.7.2-jre
• 33.8.0-android vs. 33.7.2-android
• 33.8.0-android vs. 33.8.0-jre

Changelog

• collect: Enhanced HashBiMap and LinkedHashMultimap.ValueSet to defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3506)
• collect: Accidentally changed a few methods in ForwardingMap.StandardValues to be final. No Google-internal or GitHub-public code appears to be affected, but we will fix this in the next release. If it causes you problems, let us know.
• net: Added MediaType.APPLICATION_GZIP (application/gzip) to be used in preference to GZIP (application/x-gzip). (6393ebbdb6)
• primitives: Added Doubles.MIN_POSITIVE_VALUE and Floats.MIN_POSITIVE_VALUE as more clearly named aliases for Double.MIN_VALUE and Float.MIN_VALUE. (adf5554e7e)
• testlib: Added AbstractClassInitializationTest. (80fd5c114d)
• and, among the usual changes, a larger than usual number of small fixes (4afb1e04a4246c261be4742e1f2e2c39ebaf6266, 79152348ece2de85559eb2eb18133862d492c892, a279b884fe9890a3869142919352156f2a67a705, 786bb1a9b44685875ebe7b83f1404a1f07ac653c, 6b3a8d7498a7fde122967ba37a023ba3dcb47792, de57a419b56bcd887f51bb99103d91c65b7c5e86, fa64cc7c2b320aca9219981952bbb544f8f6ccff, 7b64964048948de3b5633a75d6e64f98cf8fcece, 5ae56d77e64305752b919ff2c96713f47ac0c94c, 37535d73f0416f30e0301efe61a8eb8ede44c1b7, ca8aedb2fdaf40fd6937a0643180aea51ca4154e, c0a8a1edc69393e8141424037571d9825f5fc0f4, 51246d06bb85ccc182a0aeb6a7adcbd55f759ae5, 81c7d030f8f144a4885ccf8efdc72c92605b4eec, 2b86a8216627a807ce8520abc6ae55437dbb85fb, 669a232b4e20ae6e8bc6efc62caaf2f830d56327, b157643c41f9ee6a38732b4fa1a590ba187912d9, ad73fbb9beff220aa26390630724855ef92fc50b, 1e6eb68f2ee8dc6cb164c285f7fe6ad5e8bc0905, 3d5be86651ec58b3f9d15c76cf888ade15aba39b)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because an external CI check (security/snyk) is failing and its logs are not accessible for analysis; the rules require needs-review whenever an unsupported CI provider is failing. The upgrade itself carries low intrinsic risk for this repository: no Java source files import any com.google.common.* classes, so the behavioral changes in this release (hash-flooding hardening in HashBiMap and LinkedHashMultimap, finalization of several public classes and methods, deprecation of MediaType.GZIP) do not directly affect application code. The package is declared as a direct dependency and also drives a checkstyle capability-conflict resolution, so it must stay on the classpath; the upgrade simply bumps the pinned version. The Snyk failure should be investigated to confirm it is not flagging a newly introduced policy violation or a vulnerability introduced into the transitive graph by this version bump before merging.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 1 fixable issue in this upgrade.

• Investigate the failing security/snyk CI check to confirm it is unrelated to the Guava 33.8.0-jre upgrade before merging
  Files: algorithm-exercises-java/build.gradle

AI Assistant Prompt

Copy prompt for AI assistant

I'm upgrading `com.google.guava:guava` from **33.7.2-jre** to **33.8.0-jre** in a Java Gradle project (PR #628). The upgrade itself is a simple version bump in `algorithm-exercises-java/build.gradle` and is already applied. No Java source files in this repository import any `com.google.common.*` classes, so the breaking changes in Guava 33.8.0 (finalized classes, deprecated `MediaType.GZIP`) do not affect application code.

## What's already changed

File: `algorithm-exercises-java/build.gradle`
- Line 36: `implementation 'com.google.guava:guava:33.8.0-jre'` (was 33.7.2-jre)
- Line 82: `select("com.google.guava:guava:33.8.0-jre")` in the checkstyle capability-conflict resolution block (was 33.7.2-jre)

## Action needed: Investigate failing `security/snyk` CI check

The `security/snyk` check is failing on this PR. Since Guava is a large transitive dependency tree, the version bump may have introduced a new vulnerability or triggered a Snyk policy violation.

Please help me investigate:

1. **Check if Guava 33.8.0-jre has known CVEs**: Search for any known security vulnerabilities in `com.google.guava:guava:33.8.0-jre` or its transitive dependencies that were not present in 33.7.2-jre.

2. **Review the transitive dependency changes**: Run `./gradlew :algorithm-exercises-java:dependencies --configuration runtimeClasspath` and compare the dependency tree to identify any new or upgraded transitive dependencies that Snyk might flag.

3. **Check Snyk advisory database**: Look up Guava 33.8.0-jre on Snyk's vulnerability database (https://security.snyk.io/) to see if there are any active advisories.

4. **If the Snyk failure is unrelated to this upgrade**: Confirm that the failure pre-dates this PR by checking if the `security/snyk` check was also failing on the base branch (`main`). If so, the PR is safe to merge and the Snyk issue should be tracked separately.

## Context

- Repository: algorithm-exercises-java (algorithm practice exercises)
- Build system: Gradle
- Guava is declared as a direct dependency but no source code actually uses it
- Guava is also referenced in the checkstyle capability-conflict resolution to resolve a `com.google.collections:google-collections` conflict
- The upgrade was generated by Renovate bot

What we checked

• com.google.guava:guava is declared as a direct implementation dependency, pinned to the new version 33.8.0-jre. This confirms the upgrade is intentional and direct, not transitive. ^[1]
• Guava is also referenced in the configurations.checkstyle capability-conflict resolution block, selecting 33.8.0-jre to resolve the com.google.collections:google-collections capability conflict. Both references must remain consistent. ^[2]
• The new release includes hash-flooding hardening changes in HashBiMap and LinkedHashMultimap. Since no application code imports com.google.common.* classes, this behavioral change has no direct impact on this project. ^[3]
• Package source diff reports that public classes SubscriberExceptionContext, ImmutableGraph, and ListenableFutureTask are now declared final, and many public/protected methods across collect, cache, base, and graph packages are now final. Since no application Java files in this repository extend or override Guava classes (confirmed by import com.google.common.* search returning no matches), these changes do not cause compilation failures here. ^[4]
• The security/snyk CI check is failing. Snyk is an unsupported external CI provider whose logs cannot be retrieved for analysis. Its failure cannot be confirmed as unrelated to this upgrade, so the upgrade must be reviewed before merging. ^[5]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• com.google.guava:guava is declared as a direct implementation dependency, pinned to the new version 33.8.0-jre. This confirms the upgrade is intentional and direct, not transitive.
  

  algorithm-exercises-java/algorithm-exercises-java/build.gradle

  Line 36 in 7c1fc85

  implementation 'com.google.guava:guava:33.8.0-jre'

• Guava is also referenced in the configurations.checkstyle capability-conflict resolution block, selecting 33.8.0-jre to resolve the com.google.collections:google-collections capability conflict. Both references must remain consistent.
  

  algorithm-exercises-java/algorithm-exercises-java/build.gradle

  Line 82 in 7c1fc85

  select("com.google.guava:guava:33.8.0-jre")

Changes

com.google.guava was updated with 3 breaking changes that finalize previously subclassable public classes (SubscriberExceptionContext, ImmutableGraph, ListenableFutureTask), builder classes (ImmutableGraph.Builder, ImmutableNetwork.Builder, ImmutableValueGraph.Builder), and numerous methods across the collect, cache, base, and graph packages — any code subclassing or overriding these must be refactored to use composition or delegation. Additionally, MediaType.GZIP is deprecated in favor of the new MediaType.APPLICATION_GZIP constant.

• Public classes SubscriberExceptionContext (eventbus), ImmutableGraph (graph), and ListenableFutureTask (util.concurrent) are now declared final. Code that subclasses them will no longer compile. Replace subclassing with composition or delegation. (v33.8.0-jre, package source)
• The nested Builder classes ImmutableGraph.Builder, ImmutableNetwork.Builder, and ImmutableValueGraph.Builder are now public static final. Any code that extends these builders will no longer compile. (v33.8.0-jre, package source)
• Many public and protected methods across the collect, cache, base, and graph packages (for example CharMatcher.negate/toString, Converter.appendTo, Optional.toJavaUtil, the Multimap/Multiset/Table view and map methods, LocalCache segment and entry methods, and ImmutableMap.get) are now declared final. Subclasses that override these methods will fail to compile or will stop overriding. Remove those overrides and use delegation instead. (v33.8.0-jre, package source)

View 5 more changes

• MediaType.GZIP (the legacy application/x-gzip constant) is deprecated. Use the new MediaType.APPLICATION_GZIP constant, which maps to application/gzip as registered in RFC 6713. (v33.8.0-jre, package source)
• Added MediaType.APPLICATION_GZIP constant (application/gzip, RFC 6713) as the preferred replacement for the deprecated MediaType.GZIP. (v33.8.0-jre, package source)
• Added Doubles.MIN_POSITIVE_VALUE, an alias for Double.MIN_VALUE (the smallest positive double) with a clearer name. (v33.8.0-jre, package source)
• Added Floats.MIN_POSITIVE_VALUE, an alias for Float.MIN_VALUE (the smallest positive float) with a clearer name. (v33.8.0-jre, package source)
• Internal refactoring across collect, cache, and graph packages (new internal Entries class in Multimaps and element/entry set changes in Multisets and ImmutableMultimap). Visible behaviour is intended to be unchanged, but review any code that depends on these internals. (v33.8.0-jre, package source)

References (5)

[1]: com.google.guava:guava is declared as a direct implementation dependency, pinned to the new version 33.8.0-jre. This confirms the upgrade is intentional and direct, not transitive.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 36 in 7c1fc85

implementation 'com.google.guava:guava:33.8.0-jre'

[2]: Guava is also referenced in the configurations.checkstyle capability-conflict resolution block, selecting 33.8.0-jre to resolve the com.google.collections:google-collections capability conflict. Both references must remain consistent.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 82 in 7c1fc85

select("com.google.guava:guava:33.8.0-jre")

[3]: The new release includes hash-flooding hardening changes in HashBiMap and LinkedHashMultimap. Since no application code imports com.google.common.* classes, this behavioral change has no direct impact on this project. (source link)

[4]: Package source diff reports that public classes SubscriberExceptionContext, ImmutableGraph, and ListenableFutureTask are now declared final, and many public/protected methods across collect, cache, base, and graph packages are now final. Since no application Java files in this repository extend or override Guava classes (confirmed by import com.google.common.* search returning no matches), these changes do not cause compilation failures here. (source link)

[5]: The security/snyk CI check is failing. Snyk is an unsupported external CI provider whose logs cannot be retrieved for analysis. Its failure cannot be confirmed as unrelated to this upgrade, so the upgrade must be reviewed before merging. (source link)

---

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

[fossabot]

[fossabot]

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (eb909b9) to head (7c1fc85).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #628   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fossabot]

No Issues

No security issues were detected in the SAST scan. The code changes appear to follow secure coding practices.

---

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud