From 3b65169d6c84d2cfda5f3ed73388d3c2feaeb718 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 23:43:49 -0700
Subject: [PATCH] build(deps): bump com.google.guava:guava from 32.1.3-jre to
 33.7.1-jre in /test/java/spark (#12141)

* build(deps): bump com.google.guava:guava in /test/java/spark

Bumps [com.google.guava:guava](https://github.com/google/guava) from 32.1.3-jre to 33.7.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* test/java/spark: bump guava to 33.7.2-jre

33.7.1 is covered by a published advisory for uncontrolled memory
allocation during CompactHashMap/CompactHashSet deserialization;
33.7.2 is the patched release.

* test/random_access: bump guava to 33.7.2-jre

Same deserialization advisory; the pin predates the fix.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: user.email <chrislusf@users.noreply.github.com>
---
 test/java/spark/pom.xml    | 2 +-
 test/random_access/pom.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/java/spark/pom.xml b/test/java/spark/pom.xml
index 0548986ac9..78a842276e 100644
--- a/test/java/spark/pom.xml
+++ b/test/java/spark/pom.xml
@@ -149,7 +149,7 @@
             <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava</artifactId>
-                <version>32.1.3-jre</version>
+                <version>33.7.2-jre</version>
             </dependency>
 
             <!-- SnakeYAML - Fix CVEs -->
diff --git a/test/random_access/pom.xml b/test/random_access/pom.xml
index 949c84448b..d9be28de0f 100644
--- a/test/random_access/pom.xml
+++ b/test/random_access/pom.xml
@@ -8,7 +8,7 @@
     <version>1.0-SNAPSHOT</version>
 
     <properties>
-        <guava.version>32.0.0-jre</guava.version>
+        <guava.version>33.7.2-jre</guava.version>
     </properties>
 
     <dependencies>