chore(deps): bump com.google.guava:guava from 30.1-jre to 33.6.0-jre

[dependabot]

Bumps com.google.guava:guava from 30.1-jre to 33.6.0-jre.

Release notes

Sourced from com.google.guava:guava's releases.

33.6.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.6.0-jre</version>
  <!-- or, for Android: -->
  <version>33.6.0-android</version>
</dependency>

Jar files

• 33.6.0-jre.jar
• 33.6.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.6.0-jre
• 33.6.0-android

JDiff

• 33.6.0-jre vs. 33.5.0-jre
• 33.6.0-android vs. 33.5.0-android
• 33.6.0-android vs. 33.6.0-jre

Changelog

• Migrated some classes from finalize() to PhantomReference in preparation for the removal of finalization. (786b619dd6, 7c6b17c, aeef90988d)
• cache: Deprecated CacheBuilder APIs that use TimeUnit in favor of those that use Duration. (73f8b0bb84)
• collect: Added toImmutableSortedMap collectors that use the natural comparator. (64d70b9f94)
• collect: Changed ConcurrentHashMultiset, ImmutableMultimap, and TreeMultiset deserialization to avoid mutating final fields. In extremely unlikely scenarios in which an instance of that type contains an object that refers back to that instance, this could lead to a broken instance that throws NullPointerException when used. (8240c7e596, 046468055f)
• graph: Removed @Beta from all APIs in the package. (dae9566b73)
• graph: Added support to Graphs.transitiveClosure() for different strategies for adding self-loops. (2e13df25b2)
• graph: Added an asNetwork() view to Graph and ValueGraph. (909c593c61)
• hash: Added BloomFilter.serializedSize(). (df9bcc251a)
• net: Added HttpHeaders.CDN_CACHE_CONTROL. (75331b5030)

33.5.0

Maven

<dependency>
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

[dj4oC]

Dependabot gradle bump: com.google.guava:guava 30.1-jre→33.6.0-jre (test-only dependency).

Findings

Nothing blocking — also security-positive. 30.1-jre predates the fix for CVE-2020-8908 (insecure temp-directory creation in Files.createTempDir(), fixed in 32.0.0+); 33.6.0-jre includes that fix. compile check is green.

Verdict

Approved — Dependabot fast-lane eligible (CI green, no open human/bot questions, no known CVE — bump resolves prior CVE-2020-8908 exposure).

---

Generated by Claude Code

[dj4oC]

• Security: no findings — bump resolves prior CVE-2020-8908 exposure
• Stability: no findings
• Performance: no findings
• Test coverage: N/A — dependency manifest bump, no new code
• TODOs found: none
• Dependency touched: yes — confirmed in dependabot.yml (gradle ecosystem)
• CI status: all green
• Stale review: no

---

Generated by Claude Code

[jesmrec]

@dependabot rebase