[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.commons:commons-lang3 (source)	3.21.0 → 3.22.0
com.graphql-java:graphql-java	26.1 → 26.2
tools.jackson:jackson-bom	3.2.4 → 3.3.0

---

Release Notes

graphql-java/graphql-java (com.graphql-java:graphql-java)

v26.2: 26.2

This is a dependency maintenance release for GraphQL Java 26.x to resolve security-scanner findings for CVE-2026-102554 in the bundled Guava dependency.

GraphQL Java's own request processing is not affected by this CVE. The vulnerability concerns native Java object deserialization, which GraphQL Java does not use to parse, validate, or execute GraphQL documents.

The release upgrades bundled Guava from 32.1.2-jre to 33.8.0-jre to remove the affected dependency version from the GraphQL Java JAR and address these scanner findings.

Also updates the shaded-annotation cleanup for the newer Guava, removing references to an annotation type that is not included in the published JAR.

List of PRs

• #​4555 Upgrade Guava to 33.8.0-jre for CVE-2026-102554.

Full Changelog: v26.1...v26.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud