[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.google.guava:guava	33.6.0-jre → 33.8.0-jre

---

Release Notes

google/guava (com.google.guava:guava)

v33.8.0: 33.8.0

Compare Source

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.8.0-jre</version>
  <!-- or, for Android: -->
  <version>33.8.0-android</version>
</dependency>

Jar files

• 33.8.0-jre.jar
• 33.8.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.8.0-jre
• 33.8.0-android

JDiff

• 33.8.0-jre vs. 33.7.2-jre
• 33.8.0-android vs. 33.7.2-android
• 33.8.0-android vs. 33.8.0-jre

Changelog

• collect: Enhanced HashBiMap and LinkedHashMultimap.ValueSet to defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3)
• net: Added MediaType.APPLICATION_GZIP (application/gzip) to be used in preference to GZIP (application/x-gzip). (6393ebb)
• primitives: Added Doubles.MIN_POSITIVE_VALUE and Floats.MIN_POSITIVE_VALUE as more clearly named aliases for Double.MIN_VALUE and Float.MIN_VALUE. (adf5554)
• testlib: Added AbstractClassInitializationTest. (80fd5c1)
• and, among the usual changes, a larger than usual number of small fixes (4afb1e0, 7915234, a279b88, 786bb1a, 6b3a8d7, de57a41, fa64cc7, 7b64964, 5ae56d7, 37535d7, ca8aedb, c0a8a1e, 51246d0, 81c7d03, 2b86a82, 669a232, b157643, ad73fbb, 1e6eb68, 3d5be86)

v33.7.2: 33.7.2

Compare Source

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36)

v33.7.1: 33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

v33.7.0: 33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
  <version>33.7.0-android</version>
</dependency>

Jar files

• 33.7.0-jre.jar
• 33.7.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.0-jre
• 33.7.0-android

JDiff

• 33.7.0-jre vs. 33.6.0-jre
• 33.7.0-android vs. 33.6.0-android
• 33.7.0-android vs. 33.7.0-jre

Changelog

• The Android jar now contains our Proguard configs. (b0668e7)
• The Guava module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/MANIFEST.MF, which occasionally causes trouble for some users. (230019b)
• Our Android minSdkVersion is now 24 (Nougat). This follows the minimum of Google's foundational Android libraries, and we expect it to have no practical impact on users. (ea0af87)
• collect: Changed some ImmutableMap implementations to create a new, lightweight object on each call to view methods like keySet(), rather than creating and storing that object during the first call for reuse later. This is likely to slightly improve performance for some users, but it could lead to regressions in unusual cases, such as repeatedly calling asMultimap().inverse() on the same ImmutableMap instance. (e87d019)
• net: Added HttpHeaders constant for on-prefetch-activation. (abd06a3)
• net: Added MediaType constants for application/yaml and application/x-pem-file. (a8e9533, 1d40e27)
• util.concurrent: Fixed ExecutionSequencer queue stall when delegate executor throws RejectedExecutionException. (8410194)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.