spmallette opened a new pull request, #3752: URL: https://github.com/apache/tinkerpop/pull/3752
- **Bump:** com.google.guava:guava 33.6.0-jre -> 33.7.1-jre (maven, JVM core, direct managed dep) - **Why:** Bugfix - 33.7.1 removes the Multi-Release line from guava's jar manifest, fixing a Java 9/10 tooling issue introduced in 33.7.0; routine. Not security, not a bug affecting code we rely on (pom: 'we don't really use guava directly'). - **Target:** master only (section 2.5 default for a routine bugfix; no backport) - **Tested:** master - docker-excluded full reactor 'mvn clean install -Dmaven.exec.skip=true': BUILD SUCCESS (17:00 min). Java unit tests green across the reactor incl. guava consumers - e.g. aggregate surefire Tests run: 14500, Failures: 0, Errors: 0, Skipped: 241 and Tests run: 12854, Failures: 0, Errors: 0, Skipped: 8; all 'Tests run:' lines show Failures: 0, Errors: 0. GLV docker-compose integration excluded by the chosen command and NOT claimed (guava does not reach the server->GLV wire). - **Convergence:** Also aligned org.jspecify:jspecify 1.0.0 -> 1.0.1 via root-pom dependencyManagement (section 4.5) - guava 33.7.1 bumped its transitive jspecify, clashing with compile-testing/truth 1.0.0 in gremlin-annotations. Minimal single-artifact, same-major patch align; disclosed in the commit body. - **LICENSE:** n/a (not enumerated in Console/Server NOTICE/LICENSE) - **Risk:** Low - routine manifest-only guava bugfix + a patch-level transitive convergence align within the existing compile-testing conflict-resolution block. - **Verdict:** TAKE (routine bugfix, direct managed dep, low-risk, builds clean on master with the sanctioned section 4.5 convergence alignment) Supersedes dependabot #3746. *🤖 Agent assisted PR.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
