manuzhang opened a new pull request, #3908: URL: https://github.com/apache/parquet-java/pull/3908
### Rationale for this change Backport #3743 and #3850 to `parquet-1.18.x`, upgrading Guava from 33.6.0-jre to 33.7.2-jre. This includes Guava's deserialization allocation fix for CVE-2026-102554 ([upstream advisory](https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94)). ### What changes are included in this PR? A single `guava.version` property change in the root POM, combining the two main-branch upgrades into one maintenance commit. ### Are these changes tested? - Clean Java 11 reactor `verify` for `parquet-cli` and `parquet-protobuf` with dependencies: 323 tests, 0 failures/errors, 2 Windows-only CLI tests skipped on macOS. - Includes the full CLI and protobuf unit suites, plus Hadoop reader/writer and metadata-converter tests. - Confirmed all three tested modules resolve Guava 33.7.2-jre at runtime. - Configured API-compatibility, dependency-analysis, RAT and Spotless checks passed; `git diff --check` passed. Broad integration tests and Javadocs were skipped. ### Are there any user-facing changes? The declared Guava dependency is updated to 33.7.2-jre. No Parquet file-format or public Parquet API change is introduced; the Java 11 baseline is unchanged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
