Align default gson dependency version in generated provider SDKs with core SDK

.changes/unreleased/bug-fixes-2284.yaml

@@ -0,0 +1,6 @@
+component: codegen
+kind: bug-fixes
+body: 'Align the default `gson` dependency version generated for provider SDKs with the version pinned by the core Pulumi Java SDK, so Maven consumers resolve the same version regardless of the order dependencies are declared in their `pom.xml`.'
+time: 2026-08-20T00:31:31.000000000Z
+custom:
+    PR: "2284"

pkg/codegen/java/package_info.go

@@ -186,11 +186,21 @@ func (i PackageInfo) WithJavaSdkDependencyDefault(ver semver.Version) PackageInf
 
 // Makes sure dependencies are added for libraries that the generated
 // code may link against.
+//
+// These versions are kept in sync with the versions declared in
+// sdk/java/pulumi/build.gradle so that a generated provider SDK does
+// not pull in a different version of a shared library than the core
+// Pulumi Java SDK it depends on. Maven's dependency mediation picks a
+// version based on the *declaration order* of dependencies when there
+// is a tie in depth, so a mismatch here can cause the resolved version
+// (and therefore the runtime behavior) of a program to depend on the
+// order in which dependencies are listed in its pom.xml. See
+// https://github.com/pulumi/pulumi-java/issues/812.
 func (i PackageInfo) WithDefaultDependencies() PackageInfo {
 	return i.
 		// Generated code may reference JsonElemeent class.
 		WithDependencyDefault("com.google.code.gson:gson",
-			semver.MustParse("2.8.9")).
+			semver.MustParse("2.10.1")).
 		// TODO consider removing this; this is needed when
 		// the generated code depends on the Nullable class
 		WithDependencyDefault("com.google.code.findbugs:jsr305",

sdk/java/pulumi/build.gradle

@@ -66,7 +66,7 @@ dependencies {
         exclude group: 'com.google.errorprone', module: 'error_prone_annotations'
     }
 
-    implementation("com.google.code.gson:gson:2.10")
+    implementation("com.google.code.gson:gson:2.10.1")
     implementation("com.google.protobuf:protobuf-java:${protobufVersion}")
 
     implementation("com.google.protobuf:protobuf-java-util:${protobufVersion}") {