Repository navigation
fix(deps): update dependency com.google.guava:guava to v33.8.0 - #265
Open
renovate-bot wants to merge 1 commit into
Open
renovate-bot wants to merge 1 commit into
renovate-bot wants to merge 1 commit into
Conversation
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
May 31, 2024 19:58
2598b93 to
42f109e
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
August 17, 2024 00:50
42f109e to
c067d7e
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
September 23, 2024 21:33
c067d7e to
54af6e1
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
December 16, 2024 23:39
54af6e1 to
98ccd1e
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
March 20, 2025 01:50
98ccd1e to
e926dd1
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
March 25, 2025 19:51
e926dd1 to
30ac9f1
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
April 8, 2025 19:31
30ac9f1 to
8e1e37a
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
April 9, 2025 18:49
8e1e37a to
8f9011a
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
April 14, 2025 18:37
8f9011a to
2634238
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
June 15, 2025 22:47
2634238 to
7cada87
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
September 18, 2025 02:48
7cada87 to
2180cb6
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
November 10, 2025 17:58
2180cb6 to
c33da84
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
February 2, 2026 15:02
c33da84 to
03150a7
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
February 12, 2026 11:56
03150a7 to
42ececf
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
April 14, 2026 20:58
42ececf to
2108d0e
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
October 10, 2026 20:52
2108d0e to
cde88e7
Compare
renovate-bot
force-pushed
the
renovate/guava-monorepo
branch
from
November 2, 2026 22:46
cde88e7 to
295d786
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
33.1.0-jre→33.8.0-jreRelease Notes
google/guava (com.google.guava:guava)
v33.8.0: 33.8.0Compare Source
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
collect: EnhancedHashBiMapandLinkedHashMultimap.ValueSetto defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3)collect: Accidentally changed a few methods inForwardingMap.StandardValuesto befinal. No Google-internal or GitHub-public code appears to be affected, but we will fix this in the next release. If it causes you problems, let us know.net: AddedMediaType.APPLICATION_GZIP(application/gzip) to be used in preference toGZIP(application/x-gzip). (6393ebb)primitives: AddedDoubles.MIN_POSITIVE_VALUEandFloats.MIN_POSITIVE_VALUEas more clearly named aliases forDouble.MIN_VALUEandFloat.MIN_VALUE. (adf5554)testlib: AddedAbstractClassInitializationTest. (80fd5c1)4afb1e0,7915234,a279b88,786bb1a,6b3a8d7,de57a41,fa64cc7,7b64964,5ae56d7,37535d7,ca8aedb,c0a8a1e,51246d0,81c7d03,2b86a82,669a232,b157643,ad73fbb,1e6eb68,3d5be86)v33.7.2: 33.7.2Compare Source
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
collect: ChangedMapMaker,CompactHashMap, andCompactHashSetdeserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36)v33.7.1: 33.7.1Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
Guava 33.7.1 removes the
Multi-Releaseline from our jar manifest, fixing an issue under Java 9 and 10 that was introduced toguava-jrein version 33.7.0. Sorry for the trouble.v33.7.0: 33.7.0Newly introduced problem for Java 9 and Java 10 only
Guava 33.7.0 includes a
Multi-Releaseline in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
b0668e7)module-info.classis now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file atMETA-INF/versions/9/OSGI-INF/MANIFEST.MF, which occasionally causes trouble for some users. (230019b)minSdkVersionis now 24 (Nougat). This follows the minimum of Google's foundational Android libraries, and we expect it to have no practical impact on users. (ea0af87)collect: Changed someImmutableMapimplementations to create a new, lightweight object on each call to view methods likekeySet(), rather than creating and storing that object during the first call for reuse later. This is likely to slightly improve performance for some users, but it could lead to regressions in unusual cases, such as repeatedly callingasMultimap().inverse()on the sameImmutableMapinstance. (e87d019)net: AddedHttpHeadersconstant foron-prefetch-activation. (abd06a3)net: AddedMediaTypeconstants forapplication/yamlandapplication/x-pem-file. (a8e9533,1d40e27)util.concurrent: FixedExecutionSequencerqueue stall when delegate executor throwsRejectedExecutionException. (8410194)v33.6.0: 33.6.0Compare Source
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
finalize()toPhantomReferencein preparation for the removal of finalization. (786b619,7c6b17c,aeef909)cache: DeprecatedCacheBuilderAPIs that useTimeUnitin favor of those that useDuration. (73f8b0b)collect: AddedtoImmutableSortedMapcollectors that use the natural comparator. (64d70b9)collect: ChangedConcurrentHashMultiset,ImmutableMultimap, andTreeMultisetdeserialization to avoid mutatingfinalfields. In extremely unlikely scenarios in which an instance of that type contains an object that refers back to that instance, this could lead to a broken instance that throwsNullPointerExceptionwhen used. (8240c7e,0464680)graph: Removed@Betafrom all APIs in the package. (dae9566)graph: Added support toGraphs.transitiveClosure()for different strategies for adding self-loops. (2e13df2)graph: Added anasNetwork()view toGraphandValueGraph. (909c593)hash: AddedBloomFilter.serializedSize(). (df9bcc2)net: AddedHttpHeaders.CDN_CACHE_CONTROL. (75331b5)v33.5.0: 33.5.0Compare Source
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
Automatic-Module-Nametoguava-android. (It, unlike,guava-jre, is not a proper module.) (7a04a8a)guava-gwt: Google has moved off GWT internally. We plan to continue to releaseguava-gwtfor users of GWT and J2CL, but the artifact is no longer tested for GWT-specific issues, and we have limited resources to fix any unexpected issues that might arise. While we do not anticipate any specific problems, we can't guarantee how long support will continue.minSdkVersionto 23 (Marshmallow). This follows the minimum of Google's foundational Android libraries, and we expect it to have no practical impact on users. (5c23347)2dfd572)cache: Improved the handling of exceptions from compute functions inCache.asMap(). (We do still recommend using Caffeine rather thancom.google.common.cache.) (087f2c4)collect: ImprovedIterators.mergeSorted()to preserve stability for equal elements. (4dc93be)math: AddedsaturatedAbsmethods toIntMathandLongMath. (ed0e518)net: Addedimage/aviftoMediaType. (53344ca)testing: MadeCollectorTesteravailable to Android users. (294c251)util.concurrent: AddedStriped.custom. (1586eb2)v33.4.8: 33.4.8Compare Source
Guava 33.4.8 fixes a problem that we introduced while starting to migrate
guava-androidoffUnsafein 33.4.7.Even if you're not upgrading from Guava 33.4.0 or earlier, still read the release notes for Guava 33.4.1. Those release notes contain information about the effects of Guava 33.4.5 and higher on the module system.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
util.concurrent: Removed ourVarHandlecode fromguava-android. While the code was never used at runtime under Android, it was causing problems under the Android Gradle Plugin with aminSdkVersionbelow 26. To continue to avoidsun.misc.Unsafeunder the JVM,guava-androidwill now always useAtomicReferenceFieldUpdaterwhen run there. (75da924)v33.4.7: 33.4.7Compare Source
Prefer to upgrade straight to 33.4.8: 33.4.7 breaks the build of Android apps with a minSdkVersion below 26. We will publish a fixed version soon. This problem is fixed in 33.4.8.
Guava 33.4.7, like 33.4.6, fixes two problems that we introduced while modularizing Guava and migrating off
Unsafein 33.4.5.Even if you're not upgrading from Guava 33.4.0 or earlier, still read the release notes for Guava 33.4.1. Those release notes contain information about the effects of Guava 33.4.5 and higher on the module system.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
guavamodule's dependency onfailureaccessto betransitive. Also, modified theguava-testlibmodule to make its dependency onguavatransitive, to remove its dependency onfailureaccess, and to add a dependency (transitive) onjunit. (63ecdf2)util.concurrent: Modified our fast paths to ensure that they continue to work when run through optimizers, such as those commonly used by Android apps. This fixes problems that some users may have seen since Guava 33.4.5. (b8dcaed,f9eff73)util.concurrent: Changed theguava-androidcopy ofAbstractFutureto tryVarHandlebeforeUnsafe, eliminating a warning under newer JDKs. (7336af1)v33.4.6: 33.4.6Compare Source
Prefer to upgrade straight to 33.4.8: While Guava 33.4.6 fixes two problems that we introduced while modularizing Guava in 33.4.5, it still contains some small problems with the module system, and it may still cause trouble for optimizers, and the subsequent 33.4.7 breaks the build of Android apps with a minSdkVersion below 26. These problems have been fixed in 33.4.8.
Even if you're not upgrading from Guava 33.4.0 or earlier, still read the release notes for Guava 33.4.1. Those release notes contain information about the effects of Guava 33.4.5 and higher on the module system.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
40485b9)Cannot find annotation method 'value()' in type 'DoNotMock': .... (7e15ab3)v33.4.5: 33.4.5Compare Source
Use Guava 33.4.8, not Guava 33.4.5. 33.4.5 was our first attempt to modularize Guava, but we misconfigured our build, so it:
33.4.5 (and 33.4.6) also may cause trouble for some optimizers (like those commonly used for Android apps), and 33.4.7 breaks the build of Android apps with a minSdkVersion below 26.
All these issues are fixed by release 33.4.8. Sorry for the trouble.
When you read the release notes for 33.4.8, you should also read the release notes for Guava 33.4.1, even if you're not upgrading from Guava 33.4.0 or earlier: Those release notes contain information about the effect of Guava 33.4.5 and higher on the module system.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
guava-testlibandfailureaccessjars) to be a modular jar. (7a71ea0,287c701)sun.misc.Unsafeunder Java 9+. (ee63055,80aab00,400af25,71d0692,d1a3cd5,b3bb29a,1a300f6)guava-androidon the JVM (instead of usingguava-jre), Guava will still try to usesun.misc.Unsafe. We will do further work on this in the future.ee3b9c6,d25d62f)Special thanks to @sgammon for his modularization efforts.
v33.4.4: 33.4.4Compare Source
This is one of a series of releases that improve Guava's nullness annotations. For more information, including troubleshooting help, see the release notes for Guava 33.4.1. Most users can update directly to Guava 33.4.8.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
2cc8c5e)80559d2)v33.4.3: 33.4.3Compare Source
This is one of a series of releases that improve Guava's nullness annotations. For more information, including troubleshooting help, see the release notes for Guava 33.4.1. Most users can update directly to Guava 33.4.8.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
@CheckForNullto the Checker Framework@Nullable. Most tools recognize both annotations, so we expect this to be a no-op in almost all cases. This release removes our dependency on JSR-305. (d997ad9)v33.4.2: 33.4.2Compare Source
This is one of a series of releases that improve Guava's nullness annotations. For more information, including troubleshooting help, see the release notes for Guava 33.4.1. Most users can update directly to Guava 33.4.8.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
@ParametricNullnessinto a no-op for Kotlin and IntelliJ. Before now, it was forcing many usages of type variables to have platform types, which meant that Kotlin couldn't check those usages for nullness errors. With this change, Kotlin can detect more errors. (ae36f57)v33.4.1: 33.4.1Compare Source
Today, we are releasing Guava 33.4.1 and a few other 33.4.x releases. All the releases maintain binary compatibility, but they include changes to nullness and the module system that may be disruptive to some users.
Most users can jump straight to 33.4.8 to pick up a few small improvements with no disruption.
If you encounter trouble with 33.4.8, then read on.
Module-system trouble
First, use Guava 33.4.8, not Guava 33.4.5. 33.4.5 was our first attempt to modularize Guava, but we made a few mistakes, so it:
33.4.5 (and 33.4.6) also may cause trouble for some optimizers (like those commonly used for Android apps), and 33.4.7 breaks the build of Android apps with a minSdkVersion below 26.
All these issues are fixed by release 33.4.8. Sorry for the trouble.
Guava 33.4.8 (after a false start in Guava 33.4.5) changes Guava to be a Java module. You can still use Guava without using the module system yourself. However, if your build system automatically recognizes Guava as a module, then you may see errors. As a temporary fix, you can upgrade only to 33.4.4 while you investigate the module problems.
If you see build errors (such as
package com.google.common.collect is not visible), try modifying yourmodule-info.javato includerequires com.google.common;.If you see runtime errors, then you may be performing reflection on Guava internals. We recommend not doing this, since Guava internals change frequently, potentially breaking such code. The module system is designed to call attention to this situation, but you can always silence it with
--add-opens, passing the module name (com.google.common) and package name from your error message along with the name of the module that is accessing Guava's internals (which is also shown in the error message).Nullness trouble
Nullness annotations have no effect on Java itself, but they do affect nullness checkers, such as NullAway, the Checker Framework, and Kotlin.
If you encounter only a modest number of nullness errors, we recommend upgrading straight to 33.4.8 or higher, suppressing or fixing the errors to prepare for the change.
For build errors from a Java nullness checker, you can generally silence them with
@SuppressWarnings(docs: NullAway, the Checker Framework, Error Prone). Of course, we recommend inspecting at least a few new errors so that you can judge whether the errors are worth fixing instead of just suppressing.For build errors from Kotlin, there is no supported way to suppress. (If, after reading the instructions here, you believe that one would be valuable, please share your experiences with the Kotlin developers.) You'll instead need to change your code, often in one of the following ways:
Multiset<Foo>toMultiset<Foo?>.FutureCallback<Foo>to aFutureCallback<Foo?>so that itsonSuccessmethod can still be declared to accept aFoo?.ImmutableList<Foo>instead ofImmutableList<Foo?>.ImmutableList<T>to be valid, you may need to change your type-parameter declaration from<T>to<T: Any>. Occasionally, you may want to keep the type-parameter declaration as it is but change to usingImmutableList<T & Any>.!!or a cast. These operators sometimes introduce a runtime check where there was not one before.null.Gradual migration
If you encounter a large number of errors when upgrading, then you may wish to upgrade your Guava version incrementally. Guava 33.4.1, 33.4.2, 33.4.3, and 33.4.4 are each one step toward improving Guava's nullness annotations. You may find it easier to upgrade one version at a time. By doing so, you can handle all problems of a particular "kind" at once. Then, once you submit the upgrade, you prevent backsliding of that kind. (Almost all problems should surface in the upgrade to 33.4.1 or the upgrade to 33.4.2.)
If you take this path, you may wish to set
-Xjsr305=strictbefore even the first Guava upgrade. That flag may identify a subset of problems ahead of the Guava changes. Note, however, that it may also cause Kotlin to detect nullness errors in your usages of any other libraries that use custom nullness annotations. If so, the flag would cause you to have to perform a larger cleanup that the Guava upgrade requires, so you'll have to judge whether that flag would be helpful on net.Temporary emergency fallback option: Disabling current and future checking of Java APIs
In the worst case, it is possible to tell Kotlin not to produce errors for any usages of JSpecify annotations, both those in Guava and those in other libraries (such as Caffeine and the forthcoming Spring Framework 7). You can do this by setting
-Xjspecify-annotations=warn. If you are considering this, we recommend instead deferring your upgrade of Guava to give yourself time to work through the nullness errors. We are making an effort not to publish a release with new APIs in the near future, so you should be able to safely defer upgrading for a while. If you do still choose to set the flag, we recommend working to remove it in the future, since it will hide more and more errors as time goes by.For more help
We monitor for Guava questions on StackOverflow. If you believe that you are seeing a bug in a nullness checker, you can report it to the tool owners (e.g., NullAway, the Checker Framework). If you believe that you are seeing a problem with these instructions or with Guava's nullness annotations, report a bug to us.
Maven
Jar files
Guava requires one runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
@ElementTypesAreNonnullByDefaultannotations with the JSpecify@NullMarkedannotation. (8ebb375)v33.4.0: 33.4.0Compare Source
Maven
Jar files
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.