[AjimelecGonzalez]

Description

Google Guava versions >=4.0 <33.7.2 are affected by CVE-2026-102554 (GHSA-xxph-c9ww-hj94, CWE-770 — Allocation of Resources Without Limits or Throttling), fixed in 33.7.2.

CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject() by reading an attacker-controlled element count / initial capacity from the stream and eagerly allocating backing arrays of that size before the actual stream content is consumed. A ~72-byte crafted serialized payload can force a multi-gigabyte allocation and crash the JVM with OutOfMemoryError.

This PR bumps the Guava version pinned in this repo:

Artifact	From	To
com.google.guava:guava	33.3.0-jre	33.7.2-jre

The change is a single line in the root build.gradle (guava_version). All modules (common, core, ppl, sql, legacy, protocol) reference ${guava_version}, and plugin/integ-test force it via resolutionStrategy, so every module picks up the new version. ./gradlew :opensearch-sql-plugin:dependencyInsight --dependency com.google.guava:guava --configuration runtimeClasspath confirms com.google.guava:guava:33.7.2-jre (forced).

No source or test changes were required.

Testing

• ./gradlew build -x doctest --continue (JDK 21) — BUILD SUCCESSFUL (compile, unit tests, spotless, jacoco, integTest)

Related Issues

Addresses CVE-2026-102554 for the SQL plugin.

Check List

• New functionality includes testing.
• New functionality has been documented.
• New functionality has javadoc added.
• New functionality has a user manual doc added.
• New PPL command checklist all confirmed.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff or -s.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 3162ebc.

Path	Line	Severity	Description
build.gradle	56	high	Dependency version change: guava_version bumped from 33.3.0-jre to 33.7.2-jre. Per mandatory review policy, all dependency version changes must be flagged for maintainer verification to rule out namespace hijacking or supply chain compromise.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.38%. Comparing base (f08c81a) to head (3162ebc).

❌ Your project check has failed because the head coverage (75.38%) is below the target coverage (99.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #5918   +/-   ##
=========================================
  Coverage     75.38%   75.38%           
  Complexity    10384    10384           
=========================================
  Files           963      963           
  Lines         41093    41093           
  Branches       4681     4681           
=========================================
  Hits          30977    30977           
  Misses         8810     8810           
  Partials       1306     1306           

Flag	Coverage Δ
sql-engine	75.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.