Skip to content

build(deps): bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre #7333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
May 2, 2025
Merged

build(deps): bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre #7333

merged 4 commits into from
May 2, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 18, 2025 •
edited
Loading

Bumps com.google.guava:guava from 33.4.6-jre to 33.4.8-jre.

Release notes

Sourced from com.google.guava:guava's releases.

33.4.8

Guava 33.4.8 fixes a problem that we introduced while starting to migrate guava-android off Unsafe in 33.4.7.

Even if you're not upgrading from Guava 33.4.0 or earlier, still read the release notes for Guava 33.4.1. Those release notes contain information about the effects of Guava 33.4.5 and higher on the module system.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.4.8-jre</version>
  <!-- or, for Android: -->
  <version>33.4.8-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

  • util.concurrent: Removed our VarHandle code from guava-android. While the code was never used at runtime under Android, it was causing problems under the Android Gradle Plugin with a minSdkVersion below 26. To continue to avoid sun.misc.Unsafe under the JVM, guava-android will now always use AtomicReferenceFieldUpdater when run there. (75da92419a)

33.4.7

Prefer to upgrade straight to 33.4.8: 33.4.7 breaks the build of Android apps with a minSdkVersion below 26. We will publish a fixed version soon. This problem is fixed in 33.4.8.

Guava 33.4.7, like 33.4.6, fixes two problems that we introduced while modularizing Guava and migrating off Unsafe in 33.4.5.

Even if you're not upgrading from Guava 33.4.0 or earlier, still read the release notes for Guava 33.4.1. Those release notes contain information about the effects of Guava 33.4.5 and higher on the module system.

Maven

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies java Pull requests that update Java code labels Apr 18, 2025
@dependabot dependabot bot requested a review from pethers as a code owner April 18, 2025 10:29
@github-actions GitHub Actions
Copy link

github-actions bot commented Apr 18, 2025 •
edited
Loading

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 5bca1da.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.google.guava:failureaccess 1.0.3 🟢 8.8
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 2badge detected: InProgress
License🟢 10license file detected
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy🟢 10security policy file detected
CI-Tests🟢 1028 out of 28 merged PRs checked by a CI test -- score normalized to 10
Vulnerabilities🟢 100 existing vulnerabilities detected
Contributors🟢 10project has 11 contributing companies or organizations

Scanned Files

  • service.data.impl/pom.xml

@dependabot dependabot bot force-pushed the dependabot/maven/com.google.guava-guava-33.4.8-jre branch 2 times, most recently from 935b3f9 to 7d24da1 Compare April 19, 2025 16:28
@dependabot
build(deps): bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre
3117770 
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.4.6-jre to 33.4.8-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 33.4.8-jre
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/maven/com.google.guava-guava-33.4.8-jre branch from 7d24da1 to 3117770 Compare April 20, 2025 19:03
@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented May 2, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@pethers pethers merged commit fc63930 into master May 2, 2025
8 checks passed
@pethers pethers deleted the dependabot/maven/com.google.guava-guava-33.4.8-jre branch May 2, 2025 17:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pethers pethers Awaiting requested review from pethers pethers is a code owner

Assignees
No one assigned
Labels
dependencies java Pull requests that update Java code size/XS
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@pethers