build(deps-dev): bump com.google.guava:guava from 33.7.1-jre to 33.7.2-jre

[dependabot]

Bumps com.google.guava:guava from 33.7.1-jre to 33.7.2-jre.

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[FrankChen021]

This is an automated review by Codex GPT-5.6 Luna(Max).

Compatibility analysis

ROUND_1 established a SAFE compatibility verdict for com.google.guava:guava from 33.7.1-jre to 33.7.2-jre; this later-round review reuses that record without repeating release research. The persisted release inventory is 33.7.0-android, 33.7.0-jre, 33.7.1-android, 33.7.1-jre, 33.7.2-android, and 33.7.2-jre, with the exact JRE transition 33.7.1-jre -> 33.7.2-jre. API/ABI, runtime, configuration, serialization/wire including serialVersionUIDs and stream structure, persistence, clients, transitive dependency resolution, licenses, and extension/plugin SPI are all SAFE.

Druid impact

The only PR change is <shade.guava.version> in extensions-contrib/opentelemetry-emitter/pom.xml, changing 33.7.1-jre to 33.7.2-jre. The relevant consumers are OpenTelemetryEmitter, OpenTelemetryEmitterModule, and DruidContextTextMapGetter; they have no Guava or Java-serialization call sites. Guava remains an implementation dependency for the OpenTelemetry extension and is shaded and relocated from com.google.common to org.apache.druid.opentelemetry.shaded.com.google.common. No tracked production or test source changed.

Validation

Focused validation passed: OpenTelemetryEmitterTest 8/8; OpenTelemetry module package/shading build; Maven dependency resolution with Guava 33.7.2-jre and failureaccess 1.0.3; public japicmp with no incompatible API changes; git diff --check; and clean isolated-worktree validation. The merge-base diff is exactly one POM line.

CI gate

Exact head is caa3082c551eee7668434e062d2b4618230f6d6e. The PR is OPEN, non-draft, MERGEABLE, and reports mergeStateStatus=CLEAN; no current-head review or approval exists. The complete paginated statusCheckRollup is SUCCESS: 27/27 CheckRuns are COMPLETED/SUCCESS, 0 StatusContexts, and every reported item succeeded.

The original C* job 117251631339 failed on workflow 38984163395 due to an external/flaky CostBasedAutoScalerIntegrationTest failure; the OpenTelemetry POM change does not affect embedded tests, and downstream coverage was skipped. The one eligible targeted failed-job rerun completed as workflow attempt 2, producing replacement C* job 117295976575 and coverage job 117301751170; both succeeded, restoring the all-green rollup.

Automation actions

No files changed and no commit was pushed. One eligible failed-job rerun was used: workflow 38984163395 attempt 2 produced replacement C* job 117295976575 and coverage job 117301751170, both successful. This body is prepared for exact-head approval after coordinator persistence and authorization.

No merge was performed.