Bundled shaded Guava 32.0.1-jre is flagged by CVE-2026-102554 (fixed in 33.7.2) #242

launchdarkly-java-server-sdk 7.17.3 embeds Guava 32.0.1-jre, relocated under com/launchdarkly/shaded/com/google/common. META-INF/maven/com.google.guava/guava/pom.properties still reports 32.0.1-jre, so Trivy flags it as HIGH: CVE-2026-102554 (DoS via unthrottled memory allocation during deserialization), fixed in Guava 33.7.2.

Because the library is shaded, consumers can't override the version through Gradle or Maven. Could you update the bundled Guava to 33.7.2 or later in a future release, or tell us if the SDK is unaffected? Thanks