fix(security): bump guava to 33.7.2-jre, hibernate-validator to 8.0.6.Final, java-jwt to 4.6.2 (backport 2.0 #35291)

openmetadata-integration-tests/pom.xml

@@ -178,7 +178,7 @@
     <dependency>
       <groupId>com.auth0</groupId>
       <artifactId>java-jwt</artifactId>
-      <version>4.4.0</version>
+      <version>${java-jwt.version}</version>
       <scope>test</scope>
     </dependency>
     <!-- Playwright Java for UI integration tests (*UIIT.java) -->

openmetadata-k8s-operator/pom.xml

@@ -94,7 +94,7 @@
         <dependency>
             <groupId>org.hibernate.validator</groupId>
             <artifactId>hibernate-validator</artifactId>
-            <version>8.0.1.Final</version>
+            <version>8.0.6.Final</version>
         </dependency>
 
         <!-- Testing -->

openmetadata-sdk/pom.xml

@@ -22,7 +22,7 @@
         <slf4j.version>2.0.9</slf4j.version>
         <lombok.version>1.18.30</lombok.version>
         <testcontainers.version>1.21.4</testcontainers.version>
-        <jwt.version>4.4.0</jwt.version>
+        <jwt.version>4.6.2</jwt.version>
         <flyway.version>9.22.3</flyway.version>
         <json.version>20240303</json.version>
     </properties>

openmetadata-service/pom.xml

@@ -83,7 +83,7 @@
     <dependency>
       <groupId>org.hibernate.validator</groupId>
       <artifactId>hibernate-validator</artifactId>
-      <version>8.0.1.Final</version>
+      <version>8.0.6.Final</version>
     </dependency>
     <!-- Jakarta Bean Validation API -->
     <dependency>
@@ -871,7 +871,7 @@
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
-      <version>33.7.2-jre</version>
+      <version>${guava.version}</version>
       <scope>compile</scope>
     </dependency>
     <dependency>

pom.xml

@@ -145,6 +145,10 @@
          own schedule; it is not a reason to leave a server on 5.6, which is
          still exposed to the CVE above. -->
     <jena.version>6.2.0</jena.version>
+    <!-- CVE-2026-102554 (unbounded allocation), fixed in 33.7.2-jre. Managed here, not only in
+         openmetadata-service, because common/spec/sdk/java-client otherwise resolve 33.4.8-jre
+         via dropwizard-jersey and 33.3.1-android via google-auth-library. -->
+    <guava.version>33.7.2-jre</guava.version>
 
     <sonar.projectKey>open-metadata_OpenMetadata</sonar.projectKey>
     <sonar.moduleKey>${project.artifactId}</sonar.moduleKey>
@@ -159,7 +163,7 @@
     <dropwizard-micrometer.version>3.0.0</dropwizard-micrometer.version>
     <micrometer.version>1.16.7</micrometer.version>
     <json-schema-validator.version>2.0.1</json-schema-validator.version>
-    <java-jwt.version>4.4.0</java-jwt.version>
+    <java-jwt.version>4.6.2</java-jwt.version>
     <jwks-rsa.version>0.22.1</jwks-rsa.version>
     <jjwt.version>0.9.1</jjwt.version>
     <rerunner-jupiter.version>2.1.6</rerunner-jupiter.version>
@@ -209,6 +213,11 @@
            transitively from dropwizard-core and stay unmanaged on its older line (e.g.
            jetty-security, CVE-2026-10050 digest authentication bypass). Imported before
            anything that pulls dropwizard so the patched line wins. -->
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.eclipse.jetty</groupId>
         <artifactId>jetty-bom</artifactId>