Repository navigation
This is a dependency maintenance release for GraphQL Java 26.x to resolve security-scanner findings for CVE-2026-102554 in the bundled Guava dependency.
GraphQL Java's own request processing is not affected by this CVE. The vulnerability concerns native Java object deserialization, which GraphQL Java does not use to parse, validate, or execute GraphQL documents.
The release upgrades bundled Guava from 32.1.2-jre to 33.8.0-jre to remove the affected dependency version from the GraphQL Java JAR and address these scanner findings.
Also updates the shaded-annotation cleanup for the newer Guava, removing references to an annotation type that is not included in the published JAR.
List of PRs
- #4555 Upgrade Guava to 33.8.0-jre for CVE-2026-102554.
Full Changelog: v26.1...v26.2