[AjimelecGonzalez]

Description

Manual backport of #5918 to 2.19.

Google Guava versions >=4.0 <33.7.2 are affected by CVE-2026-102554 (GHSA-xxph-c9ww-hj94, CWE-770 — Allocation of Resources Without Limits or Throttling), fixed in 33.7.2.

CompactHashMap, CompactHashSet, and MapMakerInternalMap implement readObject() by reading an attacker-controlled element count / initial capacity from the stream and eagerly allocating backing arrays of that size before the actual stream content is consumed. A ~72-byte crafted serialized payload can force a multi-gigabyte allocation and crash the JVM with OutOfMemoryError.

Artifact	From	To
com.google.guava:guava	32.1.3-jre	33.7.2-jre

The version bump is a single line in the root build.gradle (guava_version). All modules reference ${guava_version}, and plugin/integ-test force it via resolutionStrategy, so every module picks up the new version. The automatic backport could not be used because 2.19 was on 32.1.3-jre rather than 33.3.0-jre. Guava 33.x still supports Java 8+, so it is compatible with the branch's Java 11 target.

Two build-only follow-ups were needed on 2.19 that main already has:

• core/build.gradle: add compileOnlyApi 'com.google.code.findbugs:jsr305:3.0.2'. Guava 33.4+ no longer brings in jsr305 transitively, and prometheus uses javax.annotation.Nonnull. Same as main (Bump Calcite to 1.41.0 #4714).
• plugin/build.gradle, integ-test/build.gradle: force org.jspecify:jspecify:1.0.1 to resolve the 1.0.1 (from Guava 33.7.2) vs 1.0.0 conflict under strict conflict resolution. Same as main (Fix version conflict for build #5776).

No source or test changes were required.

Testing

• ./gradlew build -x doctest --continue (JDK 21) — BUILD SUCCESSFUL (compile, unit tests, spotless, jacoco, integTest)
• ./gradlew compileJava compileTestJava (JDK 11) — BUILD SUCCESSFUL

Related Issues

Addresses CVE-2026-102554 for the SQL plugin on 2.19. Backport of #5918.

Check List

• New functionality includes testing.
• New functionality has been documented.
• New functionality has javadoc added.
• New functionality has a user manual doc added.
• New PPL command checklist all confirmed.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff or -s.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit da657eb.

Path	Line	Severity	Description
build.gradle	53	high	Dependency version change: guava upgraded from 32.1.3-jre to 33.7.2-jre. Per mandatory supply chain rule, all dependency version changes must be flagged for maintainer verification — artifact authenticity cannot be confirmed by review alone.
core/build.gradle	50	high	New dependency added: com.google.code.findbugs:jsr305:3.0.2 as compileOnlyApi. Per mandatory supply chain rule, all new dependency additions must be flagged regardless of apparent legitimacy.
integ-test/build.gradle	172	high	New forced dependency added: org.jspecify:jspecify:1.0.1. Per mandatory supply chain rule, all dependency additions must be flagged for maintainer verification.
plugin/build.gradle	108	high	New forced dependency added: org.jspecify:jspecify:1.0.1. Per mandatory supply chain rule, all dependency additions must be flagged for maintainer verification.

The table above displays the top 10 most important findings.

Total: 4 | Critical: 0 | High: 4 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.