Shaded guava 33.0.0-jre in databricks-jdbc 3.4.4 is vulnerable to CVE-2026-102554 #1750

databricks-jdbc 3.4.4 bundles guava 33.0.0-jre, relocated to com.databricks.internal.google.common with META-INF/maven/com.google.guava/guava/pom.properties kept in the jar. Container scanners therefore report CVE-2026-102554 / GHSA-xxph-c9ww-hj94 (HIGH) for any image that ships the driver. The advisory covers guava up to 33.7.1 and 33.7.2 fixes it; main still sets google.guava.version to 33.0.0-jre.

As far as we can tell the driver never deserializes Java objects (nothing outside the bundled guava uses ObjectInputStream), so this looks like scanner hygiene rather than a reachable issue. We can't clear it on our side because the copy is inside the driver jar.

Could you bump google.guava.version to 33.7.2-jre for the next release? Thanks!