All future releases of hadoop are going to ship with 27.0 or later, *including point releases of the 3.1 branch, which is a mixed blessing.
- it's up to date
- no active CVEs
- code which uses things the guava team removed won't compile
- code built with the later release won't link to older versions due to signature overloading, with Preconditions.checkArgument a key example
Making the guava.version spark pulls in an overrideable value makes it possible to choose the version to build with alongside the -Dhadoop.version selection of hadoop version.