fix(security): bump guava to 33.7.2-jre, hibernate-validator to 8.0.6.Final, java-jwt to 4.6.2 (backport 2.0 #35291)

[manerow]

Issue

Cherry-pick of PR #35291 (Fixes #35602)

2.0 pins the same versions main had before that PR: java-jwt 4.4.0, hibernate-validator 8.0.1.Final in the service and in the k8s operator, and guava 33.7.2-jre in the service only. The change applies cleanly, and every changed line matches the main PR.

How it was tested

On 2.0: built common, spec, SDK, service, MCP and the k8s operator. The service and MCP auth and validation unit tests (14 classes, 306 tests) and the whole k8s operator suite (66 tests) pass. The dependency tree shows java-jwt 4.6.2 and guava 33.7.2-jre everywhere, and hibernate-validator 8.0.6.Final in the service and the operator.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues remain.

Summary

Updates Java dependencies and shares the Guava version across Maven modules.

• Guava uses one shared version across Java modules.
• The SDK and integration tests use java-jwt 4.6.2.
• The service and Kubernetes operator use Hibernate Validator 8.0.6.Final.

_{Reviews (2) · Last reviewed commit: "fix(security): bump guava to 33.7.2-jre,..." · Reviewed by Greptile}

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[gitar-bot]

Code Review ✅ Approved

🔴 High risk · Upgrading java-jwt changes JWT expiry handling; rejecting tokens with oversized expiry claims could prevent affected users from authenticating.

Cherry-picks the dependency bumps from PR #35291 onto 2.0, moving java-jwt to 4.6.2, hibernate-validator to 8.0.6.Final in the service and k8s operator, and guava to 33.7.2-jre. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}