From 516aefc8e65668947889c369482a2d0a832ae2cf Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Fri, 30 Oct 2026 10:07:29 +0100
Subject: [PATCH] fix: bump guava to 33.7.2-jre for CVE-2026-102554 (#1882)

Guava arrives transitively via grpc and protobuf-java-util at
32.0.1-jre and 33.6.0-android. Pin it in the parent and in sdk-bom
until those ship a fixed version.

Guava 33.7.2 no longer brings checker-qual, so drop the unused
org.checkerframework import in RegisterV1Components.

Signed-off-by: Javier Aliaga <javier@diagrid.io>
(cherry picked from commit b2c8f21df7cc89b3921cec80620f8ca3bc24a9e9)
---
 pom.xml                                                    | 7 +++++++
 sdk-bom/pom.xml                                            | 7 +++++++
 .../examples/workerone/RegisterV1Components.java           | 1 -
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 7ed436fc28..4f8346b9b7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -83,6 +83,8 @@
     <netty.version>4.2.17.Final</netty.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
+    <!-- TODO: Remove guava override once grpc and protobuf-java-util ship with guava >= 33.7.2 (CVE-2026-102554) -->
+    <guava.version>33.7.2-jre</guava.version>
   </properties>
 
   <distributionManagement>
@@ -184,6 +186,11 @@
         <artifactId>commons-compress</artifactId>
         <version>${commons-compress.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
index 1089ad8671..e03ba5db39 100644
--- a/sdk-bom/pom.xml
+++ b/sdk-bom/pom.xml
@@ -53,6 +53,8 @@
     <opentelemetry.version>1.62.0</opentelemetry.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
+    <!-- TODO: Remove guava override once grpc and protobuf-java-util ship with guava >= 33.7.2 (CVE-2026-102554) -->
+    <guava.version>33.7.2-jre</guava.version>
   </properties>
 
   <build>
@@ -165,6 +167,11 @@
         <artifactId>commons-compress</artifactId>
         <version>${commons-compress.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
diff --git a/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java b/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
index 6343cc6056..c46c379277 100644
--- a/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
+++ b/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
@@ -21,7 +21,6 @@
 import io.dapr.workflows.WorkflowStub;
 import io.dapr.spring.workflows.config.annotations.ActivityMetadata;
 import io.dapr.spring.workflows.config.annotations.WorkflowMetadata;
-import org.checkerframework.checker.units.qual.C;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Component;