.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -6,7 +6,18 @@ body:
     attributes:
       value: >
         Thank you for filing a bug report. Please help us identify and resolve the bug by filling
-        out the following fields.
+        out the following fields. Before we begin, please make sure that the bug is still present in
+        the [latest](https://github.com/google/guava/releases/latest) version of Guava available.
+        If it's already fixed in the latest version of Guava, then please just update your Guava
+        version instead.
+
+  - type: input
+    attributes:
+      label: Guava Version
+      description: Which version of Guava are you using?
+      placeholder: e.g., 33.2.1-jre
+    validations:
+      required: true
 
   - type: textarea
     attributes:
@@ -72,6 +83,7 @@ body:
         - Java 8
         - Java 11
         - Java 17
+        - Java 21
 
   - type: checkboxes
     attributes:
@@ -81,3 +93,7 @@ body:
             I agree to follow the
             [code of conduct](https://github.com/google/.github/blob/master/CODE_OF_CONDUCT.md).
           required: true
+        - label: >
+            I can reproduce the bug with the
+            [latest](https://github.com/google/guava/releases/latest) version of Guava available.
+          required: true

.github/dependabot.yml

@@ -5,12 +5,27 @@ updates:
 #  - package-ecosystem: "maven"
 #    directory: "/"
 #    schedule:
-#      interval: "daily"
+#      interval: "weekly"
+#    groups:
+#      dependencies:
+#        applies-to: version-updates
+#        patterns:
+#          - "*"
 #  - package-ecosystem: "maven"
 #    directory: "/android"
 #    schedule:
-#      interval: "daily"
+#      interval: "weekly"
+#    groups:
+#      dependencies:
+#        applies-to: version-updates
+#        patterns:
+#          - "*"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -36,20 +36,25 @@ jobs:
         with:
           access_token: ${{ github.token }}
       - name: 'Check out repository'
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-      - name: 'Set up JDK ${{ matrix.java }}'
-        uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7 # v4.2.0
-
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      # When we specify multiple JDKs, the final one becomes the default, which is used to execute Maven itself.
+      # Our Maven configuration then specifies different JDKs to use for some of the steps:
+      # - 11 (sometimes) to *download* to support anyone who runs JDiff or our Gradle integration tests (including our doc snapshots and our Java 11 CI test run) but not to use directly
+      # - 23 for running Javadoc and javac (to help people who build Guava locally and might not use a recent JDK to run Maven)
+      - name: 'Set up JDKs'
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
-          java-version: ${{ matrix.java }}
-          distribution: 'zulu'
+          java-version: |
+            ${{ matrix.java }}
+            23
+          distribution: 'temurin'
           cache: 'maven'
       - name: 'Install'
         shell: bash
-        run: ./mvnw -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn install -U -DskipTests=true -f $ROOT_POM
+        run: ./mvnw -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn -Dtoolchain.skip install -U -DskipTests=true -f $ROOT_POM
       - name: 'Test'
         shell: bash
-        run: ./mvnw -B -P!standard-with-extra-repos verify -U -Dmaven.javadoc.skip=true -f $ROOT_POM
+        run: ./mvnw -B -P!standard-with-extra-repos -Dtoolchain.skip verify -U -Dmaven.javadoc.skip=true -Dsurefire.toolchain.version=${{ matrix.java }} -f $ROOT_POM
       - name: 'Print Surefire reports'
         # Note: Normally a step won't run if the job has failed, but this causes it to
         if: ${{ failure() }}
@@ -67,12 +72,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out repository'
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-      - name: 'Set up JDK 21'
-        uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 'Set up JDKs'
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
-          java-version: 21
-          distribution: 'zulu'
+          # For discussion, see the first setup-java block.
+          # The publish-snapshot workflow doesn't run tests, so we don't have to care which version Maven would select for that step.
+          java-version: 23
+          distribution: 'temurin'
           server-id: sonatype-nexus-snapshots
           server-username: CI_DEPLOY_USERNAME
           server-password: CI_DEPLOY_PASSWORD
@@ -92,12 +99,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out repository'
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-      - name: 'Set up JDK 21'
-        uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 'Set up JDKs'
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
-          java-version: 21
-          distribution: 'zulu'
+          # For discussion, see the first setup-java block.
+          # The generate-docs workflow doesn't run tests, so we don't have to care which version Maven would select for that step.
+          # But we need Java 11 for JDiff.
+          java-version: |
+            11
+            23
+          distribution: 'temurin'
           cache: 'maven'
       - name: 'Generate latest docs'
         env:

.github/workflows/gradle-wrapper-validation.yml

@@ -9,5 +9,5 @@ jobs:
     name: "Validation"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-      - uses: gradle/wrapper-validation-action@699bb18358f12c5b78b37bb0111d3a0e2276e0e2 # v2.1.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: gradle/wrapper-validation-action@f9c9c575b8b21b6485636a91ffecd10e558c62f6 # v3.5.0

.github/workflows/scorecard.yml

@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -59,14 +59,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6
+        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         with:
           sarif_file: results.sarif

.mvn/wrapper/maven-wrapper.properties

@@ -14,8 +14,8 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.5/apache-maven-3.9.5-bin.zip
-distributionSha256Sum=7822eb593d29558d8edf87845a2c47e36e2a89d17a84cd2390824633214ed423
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar
-# TODO: Does not work properly on Windows, see https://issues.apache.org/jira/browse/MWRAPPER-103
-# wrapperSha256Sum=e63a53cfb9c4d291ebe3c2b0edacb7622bbc480326beaa5a0456e412f52f066a
+wrapperVersion=3.3.2
+distributionType=script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+distributionSha256Sum=4ec3f26fb1a692473aea0235c300bd20f0f9fe741947c82c1234cefd76ac3a3c

README.md

@@ -1,8 +1,8 @@
 # Guava: Google Core Libraries for Java
 
-[![Latest release](https://img.shields.io/github/release/google/guava.svg)](https://github.com/google/guava/releases/latest)
-[![Build Status](https://github.com/google/guava/workflows/CI/badge.svg?branch=master)](https://github.com/google/guava/actions)
-[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/7197/badge)](https://bestpractices.coreinfrastructure.org/projects/7197)
+[![GitHub Release](https://img.shields.io/github/v/release/google/guava)](https://github.com/google/guava/releases/latest)
+[![CI](https://github.com/google/guava/actions/workflows/ci.yml/badge.svg)](https://github.com/google/guava/actions/workflows/ci.yml)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/7197/badge)](https://www.bestpractices.dev/projects/7197)
 
 
 
@@ -28,8 +28,8 @@ Guava comes in two flavors:
 Guava's Maven group ID is `com.google.guava`, and its artifact ID is `guava`.
 Guava provides two different "flavors": one for use on a (Java 8+) JRE and one
 for use on Android or by any library that wants to be compatible with Android.
-These flavors are specified in the Maven version field as either `33.1.0-jre` or
-`33.1.0-android`. For more about depending on Guava, see
+These flavors are specified in the Maven version field as either `33.4.0-jre` or
+`33.4.0-android`. For more about depending on Guava, see
 [using Guava in your build].
 
 To add a dependency on Guava using Maven, use the following:
@@ -38,9 +38,9 @@ To add a dependency on Guava using Maven, use the following:
 <dependency>
   <groupId>com.google.guava</groupId>
   <artifactId>guava</artifactId>
-  <version>33.1.0-jre</version>
+  <version>33.4.0-jre</version>
   <!-- or, for Android: -->
-  <version>33.1.0-android</version>
+  <version>33.4.0-android</version>
 </dependency>
 ```
 
@@ -51,16 +51,16 @@ dependencies {
   // Pick one:
 
   // 1. Use Guava in your implementation only:
-  implementation("com.google.guava:guava:33.1.0-jre")
+  implementation("com.google.guava:guava:33.4.0-jre")
 
   // 2. Use Guava types in your public API:
-  api("com.google.guava:guava:33.1.0-jre")
+  api("com.google.guava:guava:33.4.0-jre")
 
   // 3. Android - Use Guava in your implementation only:
-  implementation("com.google.guava:guava:33.1.0-android")
+  implementation("com.google.guava:guava:33.4.0-android")
 
   // 4. Android - Use Guava types in your public API:
-  api("com.google.guava:guava:33.1.0-android")
+  api("com.google.guava:guava:33.4.0-android")
 }
 ```
 
@@ -71,11 +71,11 @@ consult the
 ## Snapshots and Documentation
 
 Snapshots of Guava built from the `master` branch are available through Maven
-using version `HEAD-jre-SNAPSHOT`, or `HEAD-android-SNAPSHOT` for the Android
-flavor.
+using version `999.0.0-HEAD-jre-SNAPSHOT`, or `999.0.0-HEAD-android-SNAPSHOT`
+for the Android flavor.
 
--   Snapshot API Docs: [guava][guava-snapshot-api-docs]
--   Snapshot API Diffs: [guava][guava-snapshot-api-diffs]
+[Snapshot API Javadoc][guava-snapshot-api-docs] as well as
+[Snapshot API Diffs][guava-snapshot-api-diffs] are also available.
 
 ## Learn about Guava
 
@@ -123,7 +123,7 @@ flavor.
     on Linux, with some additional testing on newer JDKs and on Windows. Some
     features, especially in `com.google.common.io`, may not work correctly in
     non-Linux environments. For the Android flavor, our unit tests also run on
-    API level 19 (KitKat).
+    API level 21 (Lollipop).
 
 [guava-snapshot-api-docs]: https://guava.dev/releases/snapshot-jre/api/docs/
 [guava-snapshot-api-diffs]: https://guava.dev/releases/snapshot-jre/api/diffs/

android/guava-bom/pom.xml

@@ -8,9 +8,9 @@
 
   <groupId>com.google.guava</groupId>
   <artifactId>guava-bom</artifactId>
-  <version>HEAD-android-SNAPSHOT</version>
+  <version>999.0.0-HEAD-android-SNAPSHOT</version>
   <packaging>pom</packaging>
-  
+
   <parent>
     <groupId>org.sonatype.oss</groupId>
     <artifactId>oss-parent</artifactId>

android/guava-testlib/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.google.guava</groupId>
     <artifactId>guava-parent</artifactId>
-    <version>HEAD-android-SNAPSHOT</version>
+    <version>999.0.0-HEAD-android-SNAPSHOT</version>
   </parent>
   <artifactId>guava-testlib</artifactId>
   <name>Guava Testing Library</name>
@@ -15,12 +15,14 @@
   </description>
   <dependencies>
     <dependency>
-      <groupId>com.google.code.findbugs</groupId>
-      <artifactId>jsr305</artifactId>
+      <groupId>org.jspecify</groupId>
+      <artifactId>jspecify</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.checkerframework</groupId>
-      <artifactId>checker-qual</artifactId>
+      <groupId>com.google.code.findbugs</groupId>
+      <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>com.google.errorprone</groupId>
@@ -60,6 +62,13 @@
   </dependencies>
   <build>
     <plugins>
+      <plugin>
+        <groupId>org.mvnsearch</groupId>
+        <artifactId>toolchains-maven-plugin</artifactId>
+      </plugin>
+      <plugin>
+        <artifactId>maven-toolchains-plugin</artifactId>
+      </plugin>
       <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
       </plugin>

android/guava-testlib/src/com/google/common/collect/testing/AbstractCollectionTester.java

@@ -19,7 +19,8 @@
 import com.google.common.annotations.GwtCompatible;
 import com.google.errorprone.annotations.CanIgnoreReturnValue;
 import java.util.Collection;
-import org.checkerframework.checker.nullness.qual.Nullable;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 import org.junit.Ignore;
 
 /**
@@ -29,8 +30,10 @@
  * @author Kevin Bourrillion
  */
 @GwtCompatible
-@Ignore // Affects only Android test runner, which respects JUnit 4 annotations on JUnit 3 tests.
-@ElementTypesAreNonnullByDefault
+@Ignore("test runners must not instantiate and run this directly, only via suites we build")
+// @Ignore affects the Android test runner, which respects JUnit 4 annotations on JUnit 3 tests.
+@SuppressWarnings("JUnit4ClassUsedInJUnit3")
+@NullMarked
 public abstract class AbstractCollectionTester<E extends @Nullable Object>
     extends AbstractContainerTester<Collection<E>, E> {
 
@@ -50,12 +53,16 @@ protected Collection<E> resetContainer(Collection<E> newContents) {
     return collection;
   }
 
-  /** @see AbstractContainerTester#resetContainer() */
+  /**
+   * @see AbstractContainerTester#resetContainer()
+   */
   protected void resetCollection() {
     resetContainer();
   }
 
-  /** @return an array of the proper size with {@code null} inserted into the middle element. */
+  /**
+   * @return an array of the proper size with {@code null} inserted into the middle element.
+   */
   protected E[] createArrayWithNullElement() {
     E[] array = createSamplesArray();
     array[getNullLocation()] = null;