From 8678529cfbe024c87533b46f70f78d9616cec9a9 Mon Sep 17 00:00:00 2001
From: jkodroff <410614+jkodroff@users.noreply.github.com>
Date: Thu, 20 Aug 2026 01:01:31 +0000
Subject: [PATCH 1/2] Align default gson dependency version in generated
 provider SDKs with core SDK

Generated provider SDKs (build.gradle) declared a hardcoded default
dependency on com.google.code.gson:gson:2.8.9, while the core Pulumi
Java SDK (com.pulumi:pulumi) has since moved on to gson:2.10. Because
these are declared at the same depth in a consumer's dependency graph,
Maven resolves the version based on pom.xml declaration order (first
declared wins on a tie), so a Maven user could get a different,
non-deterministic gson version depending on the order in which they
listed their provider and the pulumi dependency.

This is the same class of bug reported in #812 (guava/grpc-netty
version skew based on dependency order caused a program hang). The
guava mismatch was fixed shortly after that issue was filed by
dropping the default guava dependency from generated provider SDKs,
but the gson defaults were never kept in sync with the core SDK's
pinned version.

Bump both the core SDK's pinned gson version and the codegen default
to gson:2.10.1 (a real published, semver-parseable Gson release) so
they match exactly and Maven resolves the same version regardless of
pom.xml ordering.
---
 pkg/codegen/java/package_info.go                     | 12 +++++++++++-
 .../testing/test/testdata/akamai/java/build.gradle   |  2 +-
 .../testdata/assets-and-archives/java/build.gradle   |  2 +-
 .../azure-native-nested-types/java/build.gradle      |  2 +-
 .../build-files/gradle-nexus/java/build.gradle       |  2 +-
 .../testdata/build-files/gradle/java/build.gradle    |  2 +-
 .../build-files/unspecified/java/build.gradle        |  2 +-
 .../test/testdata/cyclic-types/java/build.gradle     |  2 +-
 .../testdata/dash-named-schema/java/build.gradle     |  2 +-
 .../testdata/dashed-import-schema/java/build.gradle  |  2 +-
 .../test/testdata/jumbo-resources/java/build.gradle  |  2 +-
 .../test/testdata/kubernetes20/java/build.gradle     |  2 +-
 .../test/testdata/legacy-names/java/build.gradle     |  2 +-
 .../test/testdata/mini-awsclassic/java/build.gradle  |  2 +-
 .../test/testdata/mini-awsx/java/build.gradle        |  2 +-
 .../test/testdata/mini-azuread/java/build.gradle     |  2 +-
 .../test/testdata/mini-azurenative/java/build.gradle |  2 +-
 .../test/testdata/mini-kubernetes/java/build.gradle  |  2 +-
 .../nested-module-thirdparty/java/build.gradle       |  2 +-
 .../test/testdata/nested-module/java/build.gradle    |  2 +-
 .../output-funcs-edgeorder/java/build.gradle         |  2 +-
 .../output-funcs-tfbridge20/java/build.gradle        |  2 +-
 .../test/testdata/output-funcs/java/build.gradle     |  2 +-
 .../test/testdata/parameterized/java/build.gradle    |  2 +-
 .../testdata/plain-and-default/java/build.gradle     |  2 +-
 .../java/build.gradle                                |  2 +-
 .../testdata/resource-args-python/java/build.gradle  |  2 +-
 .../resource-property-overlap/java/build.gradle      |  2 +-
 .../java/build.gradle                                |  2 +-
 .../java/build.gradle                                |  2 +-
 .../simple-resource-schema/java/build.gradle         |  2 +-
 .../simple-resource-with-aliases/java/build.gradle   |  2 +-
 .../simple-schema-pyproject/java/build.gradle        |  2 +-
 .../testdata/simple-yaml-schema/java/build.gradle    |  2 +-
 .../testdata/urn-id-properties/java/build.gradle     |  2 +-
 .../using-shared-types-in-config/java/build.gradle   |  2 +-
 sdk/java/pulumi/build.gradle                         |  2 +-
 37 files changed, 47 insertions(+), 37 deletions(-)

diff --git a/pkg/codegen/java/package_info.go b/pkg/codegen/java/package_info.go
index 454e0c18155..691643e1f12 100644
--- a/pkg/codegen/java/package_info.go
+++ b/pkg/codegen/java/package_info.go
@@ -186,11 +186,21 @@ func (i PackageInfo) WithJavaSdkDependencyDefault(ver semver.Version) PackageInf
 
 // Makes sure dependencies are added for libraries that the generated
 // code may link against.
+//
+// These versions are kept in sync with the versions declared in
+// sdk/java/pulumi/build.gradle so that a generated provider SDK does
+// not pull in a different version of a shared library than the core
+// Pulumi Java SDK it depends on. Maven's dependency mediation picks a
+// version based on the *declaration order* of dependencies when there
+// is a tie in depth, so a mismatch here can cause the resolved version
+// (and therefore the runtime behavior) of a program to depend on the
+// order in which dependencies are listed in its pom.xml. See
+// https://github.com/pulumi/pulumi-java/issues/812.
 func (i PackageInfo) WithDefaultDependencies() PackageInfo {
 	return i.
 		// Generated code may reference JsonElemeent class.
 		WithDependencyDefault("com.google.code.gson:gson",
-			semver.MustParse("2.8.9")).
+			semver.MustParse("2.10.1")).
 		// TODO consider removing this; this is needed when
 		// the generated code depends on the Nullable class
 		WithDependencyDefault("com.google.code.findbugs:jsr305",
diff --git a/pkg/codegen/testing/test/testdata/akamai/java/build.gradle b/pkg/codegen/testing/test/testdata/akamai/java/build.gradle
index 87891baf038..8b7ce2888f1 100644
--- a/pkg/codegen/testing/test/testdata/akamai/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/akamai/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/assets-and-archives/java/build.gradle b/pkg/codegen/testing/test/testdata/assets-and-archives/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/assets-and-archives/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/assets-and-archives/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/azure-native-nested-types/java/build.gradle b/pkg/codegen/testing/test/testdata/azure-native-nested-types/java/build.gradle
index 267850c9431..ddc4e2c4e5a 100644
--- a/pkg/codegen/testing/test/testdata/azure-native-nested-types/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/azure-native-nested-types/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/build-files/gradle-nexus/java/build.gradle b/pkg/codegen/testing/test/testdata/build-files/gradle-nexus/java/build.gradle
index 3b6be106345..1bb9c0eb384 100644
--- a/pkg/codegen/testing/test/testdata/build-files/gradle-nexus/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/build-files/gradle-nexus/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/build-files/gradle/java/build.gradle b/pkg/codegen/testing/test/testdata/build-files/gradle/java/build.gradle
index b2c61c4f2e2..225c32a86e0 100644
--- a/pkg/codegen/testing/test/testdata/build-files/gradle/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/build-files/gradle/java/build.gradle
@@ -43,7 +43,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/build-files/unspecified/java/build.gradle b/pkg/codegen/testing/test/testdata/build-files/unspecified/java/build.gradle
index 3b6be106345..1bb9c0eb384 100644
--- a/pkg/codegen/testing/test/testdata/build-files/unspecified/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/build-files/unspecified/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/cyclic-types/java/build.gradle b/pkg/codegen/testing/test/testdata/cyclic-types/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/cyclic-types/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/cyclic-types/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/dash-named-schema/java/build.gradle b/pkg/codegen/testing/test/testdata/dash-named-schema/java/build.gradle
index 4a4fc6a19c4..ded930feb90 100644
--- a/pkg/codegen/testing/test/testdata/dash-named-schema/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/dash-named-schema/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/dashed-import-schema/java/build.gradle b/pkg/codegen/testing/test/testdata/dashed-import-schema/java/build.gradle
index 63130b5d4ee..faaae4c48d9 100644
--- a/pkg/codegen/testing/test/testdata/dashed-import-schema/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/dashed-import-schema/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/jumbo-resources/java/build.gradle b/pkg/codegen/testing/test/testdata/jumbo-resources/java/build.gradle
index 870f1642c4e..48415c44a8f 100644
--- a/pkg/codegen/testing/test/testdata/jumbo-resources/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/jumbo-resources/java/build.gradle
@@ -43,7 +43,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
     implementation("org.assertj:assertj-core:3.27.1")
     implementation("org.junit.jupiter:junit-jupiter-api:5.11.4")
diff --git a/pkg/codegen/testing/test/testdata/kubernetes20/java/build.gradle b/pkg/codegen/testing/test/testdata/kubernetes20/java/build.gradle
index fa5993a7b1e..cd47276fd80 100644
--- a/pkg/codegen/testing/test/testdata/kubernetes20/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/kubernetes20/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/legacy-names/java/build.gradle b/pkg/codegen/testing/test/testdata/legacy-names/java/build.gradle
index 78d2aba5d34..5b984688d78 100644
--- a/pkg/codegen/testing/test/testdata/legacy-names/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/legacy-names/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/mini-awsclassic/java/build.gradle b/pkg/codegen/testing/test/testdata/mini-awsclassic/java/build.gradle
index 81edd18f5d5..403fdb5ba42 100644
--- a/pkg/codegen/testing/test/testdata/mini-awsclassic/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/mini-awsclassic/java/build.gradle
@@ -43,7 +43,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.google.protobuf:protobuf-java:3.25.5")
     implementation("com.google.protobuf:protobuf-java-util:3.25.5")
     implementation("com.pulumi:pulumi:0.0.1")
diff --git a/pkg/codegen/testing/test/testdata/mini-awsx/java/build.gradle b/pkg/codegen/testing/test/testdata/mini-awsx/java/build.gradle
index 6812377d580..41e5e1cd58f 100644
--- a/pkg/codegen/testing/test/testdata/mini-awsx/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/mini-awsx/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/mini-azuread/java/build.gradle b/pkg/codegen/testing/test/testdata/mini-azuread/java/build.gradle
index a20b5ce2b1d..8295d8bdddd 100644
--- a/pkg/codegen/testing/test/testdata/mini-azuread/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/mini-azuread/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/mini-azurenative/java/build.gradle b/pkg/codegen/testing/test/testdata/mini-azurenative/java/build.gradle
index 23bac3ef716..6a5c919c11d 100644
--- a/pkg/codegen/testing/test/testdata/mini-azurenative/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/mini-azurenative/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/mini-kubernetes/java/build.gradle b/pkg/codegen/testing/test/testdata/mini-kubernetes/java/build.gradle
index 486bd2c450a..b4530e465ea 100644
--- a/pkg/codegen/testing/test/testdata/mini-kubernetes/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/mini-kubernetes/java/build.gradle
@@ -43,7 +43,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.google.guava:guava:32.1.2-jre")
     implementation("com.pulumi:pulumi:0.0.1")
     implementation("org.assertj:assertj-core:3.27.1")
diff --git a/pkg/codegen/testing/test/testdata/nested-module-thirdparty/java/build.gradle b/pkg/codegen/testing/test/testdata/nested-module-thirdparty/java/build.gradle
index 4a4fc6a19c4..ded930feb90 100644
--- a/pkg/codegen/testing/test/testdata/nested-module-thirdparty/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/nested-module-thirdparty/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/nested-module/java/build.gradle b/pkg/codegen/testing/test/testdata/nested-module/java/build.gradle
index 69b50c3ab3d..6bdbc2296df 100644
--- a/pkg/codegen/testing/test/testdata/nested-module/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/nested-module/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/output-funcs-edgeorder/java/build.gradle b/pkg/codegen/testing/test/testdata/output-funcs-edgeorder/java/build.gradle
index 59b3acc960d..4342aef2a90 100644
--- a/pkg/codegen/testing/test/testdata/output-funcs-edgeorder/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/output-funcs-edgeorder/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/output-funcs-tfbridge20/java/build.gradle b/pkg/codegen/testing/test/testdata/output-funcs-tfbridge20/java/build.gradle
index 75a3811dcf5..be5a403026e 100644
--- a/pkg/codegen/testing/test/testdata/output-funcs-tfbridge20/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/output-funcs-tfbridge20/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/output-funcs/java/build.gradle b/pkg/codegen/testing/test/testdata/output-funcs/java/build.gradle
index 75a3811dcf5..be5a403026e 100644
--- a/pkg/codegen/testing/test/testdata/output-funcs/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/output-funcs/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/parameterized/java/build.gradle b/pkg/codegen/testing/test/testdata/parameterized/java/build.gradle
index e45d52db3de..b880d2f5ae9 100644
--- a/pkg/codegen/testing/test/testdata/parameterized/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/parameterized/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/plain-and-default/java/build.gradle b/pkg/codegen/testing/test/testdata/plain-and-default/java/build.gradle
index dc95a85f5a6..3a0000056ef 100644
--- a/pkg/codegen/testing/test/testdata/plain-and-default/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/plain-and-default/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/resource-args-python-case-insensitive/java/build.gradle b/pkg/codegen/testing/test/testdata/resource-args-python-case-insensitive/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/resource-args-python-case-insensitive/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/resource-args-python-case-insensitive/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/resource-args-python/java/build.gradle b/pkg/codegen/testing/test/testdata/resource-args-python/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/resource-args-python/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/resource-args-python/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/resource-property-overlap/java/build.gradle b/pkg/codegen/testing/test/testdata/resource-property-overlap/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/resource-property-overlap/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/resource-property-overlap/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/simple-plain-schema-with-root-package/java/build.gradle b/pkg/codegen/testing/test/testdata/simple-plain-schema-with-root-package/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/simple-plain-schema-with-root-package/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/simple-plain-schema-with-root-package/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/simple-resource-schema-custom-pypackage-name/java/build.gradle b/pkg/codegen/testing/test/testdata/simple-resource-schema-custom-pypackage-name/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/simple-resource-schema-custom-pypackage-name/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/simple-resource-schema-custom-pypackage-name/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/simple-resource-schema/java/build.gradle b/pkg/codegen/testing/test/testdata/simple-resource-schema/java/build.gradle
index 2d01595e618..036e497beaf 100644
--- a/pkg/codegen/testing/test/testdata/simple-resource-schema/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/simple-resource-schema/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/simple-resource-with-aliases/java/build.gradle b/pkg/codegen/testing/test/testdata/simple-resource-with-aliases/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/simple-resource-with-aliases/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/simple-resource-with-aliases/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/simple-schema-pyproject/java/build.gradle b/pkg/codegen/testing/test/testdata/simple-schema-pyproject/java/build.gradle
index 3b6be106345..1bb9c0eb384 100644
--- a/pkg/codegen/testing/test/testdata/simple-schema-pyproject/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/simple-schema-pyproject/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/simple-yaml-schema/java/build.gradle b/pkg/codegen/testing/test/testdata/simple-yaml-schema/java/build.gradle
index f41b9d30bf9..f7455fd7bca 100644
--- a/pkg/codegen/testing/test/testdata/simple-yaml-schema/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/simple-yaml-schema/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/urn-id-properties/java/build.gradle b/pkg/codegen/testing/test/testdata/urn-id-properties/java/build.gradle
index a510f98496f..31efeb7fd23 100644
--- a/pkg/codegen/testing/test/testdata/urn-id-properties/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/urn-id-properties/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/pkg/codegen/testing/test/testdata/using-shared-types-in-config/java/build.gradle b/pkg/codegen/testing/test/testdata/using-shared-types-in-config/java/build.gradle
index 493b48e4e14..e31f233ffeb 100644
--- a/pkg/codegen/testing/test/testdata/using-shared-types-in-config/java/build.gradle
+++ b/pkg/codegen/testing/test/testdata/using-shared-types-in-config/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
-    implementation("com.google.code.gson:gson:2.8.9")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.pulumi:pulumi:0.0.1")
 }
 
diff --git a/sdk/java/pulumi/build.gradle b/sdk/java/pulumi/build.gradle
index c112595a266..14f35adcb68 100644
--- a/sdk/java/pulumi/build.gradle
+++ b/sdk/java/pulumi/build.gradle
@@ -66,7 +66,7 @@ dependencies {
         exclude group: 'com.google.errorprone', module: 'error_prone_annotations'
     }
 
-    implementation("com.google.code.gson:gson:2.10")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.google.protobuf:protobuf-java:${protobufVersion}")
 
     implementation("com.google.protobuf:protobuf-java-util:${protobufVersion}") {

From 4eb0a72d34715f2cb1d633e5a65c3100dfb07bd5 Mon Sep 17 00:00:00 2001
From: jkodroff <410614+jkodroff@users.noreply.github.com>
Date: Thu, 20 Aug 2026 01:02:07 +0000
Subject: [PATCH 2/2] Add changelog entry for #2284

---
 .changes/unreleased/bug-fixes-2284.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .changes/unreleased/bug-fixes-2284.yaml

diff --git a/.changes/unreleased/bug-fixes-2284.yaml b/.changes/unreleased/bug-fixes-2284.yaml
new file mode 100644
index 00000000000..e570191e0b3
--- /dev/null
+++ b/.changes/unreleased/bug-fixes-2284.yaml
@@ -0,0 +1,6 @@
+component: codegen
+kind: bug-fixes
+body: 'Align the default `gson` dependency version generated for provider SDKs with the version pinned by the core Pulumi Java SDK, so Maven consumers resolve the same version regardless of the order dependencies are declared in their `pom.xml`.'
+time: 2026-08-20T00:31:31.000000000Z
+custom:
+    PR: "2284"