Bump the maven group across 1 directory with 5 updates

[dependabot]

Bumps the maven group with 5 updates in the /java directory:

Package	From	To
com.google.guava:guava	30.1.1-jre	32.0.0-jre
com.google.protobuf:protobuf-java	3.19.4	3.25.5
commons-io:commons-io	2.7	2.14.0
io.netty:netty-handler	4.1.72.Final	4.1.135.Final
org.apache.logging.log4j:log4j-core	2.17.1	2.25.4

Updates com.google.guava:guava from 30.1.1-jre to 32.0.0-jre

Release notes

Sourced from com.google.guava:guava's releases.

32.0.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.0-jre</version>
  <!-- or, for Android: -->
  <version>32.0.0-android</version>
</dependency>

Jar files

• 32.0.0-jre.jar
• 32.0.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.1.jar

Javadoc

• 32.0.0-jre
• 32.0.0-android

JDiff

• 32.0.0-jre vs. 31.1-jre
• 32.0.0-android vs. 31.1-android
• 32.0.0-android vs. 32.0.0-jre

Changelog

Security fixes

• Reimplemented Files.createTempDir and FileBackedOutputStream to further address CVE-2020-8908 (#4011) and CVE-2023-2976 (#2575). (feb83a1c8f)

While CVE-2020-8908 was officially closed when we deprecated Files.createTempDir in Guava 30.0, we've heard from users that even recent versions of Guava have been listed as vulnerable in other databases of security vulnerabilities. In response, we've reimplemented the method (and the very rarely used FileBackedOutputStream class, which had a similar issue) to eliminate the insecure behavior entirely. This change could technically affect users in a number of different ways (discussed under "Incompatible changes" below), but in practice, the only problem users are likely to encounter is with Windows. If you are using those APIs under Windows, you should skip 32.0.0 and go straight to 32.0.1 which fixes the problem. (Unfortunately, we didn't think of the Windows problem until after the release. And while we warn that common.io in particular may not work under Windows, we didn't intend to regress support.) Sorry for the trouble.

Incompatible changes

Although this release bumps Guava's major version number, it makes no binary-incompatible changes to the guava artifact.

One change could cause issues for Widows users, and a few other changes could cause issues for users in more usual situations:

• The new implementations of Files.createTempDir and FileBackedOutputStream throw an exception under Windows. This is fixed in 32.0.1. Sorry for the trouble.
• guava-gwt now requires GWT 2.10.0.
• This release makes a binary-incompatible change to a @Beta API in the separate artifact guava-testlib. Specifically, we changed the return type of TestingExecutors.sameThreadScheduledExecutor to ListeningScheduledExecutorService. The old return type was a package-private class, which caused the Kotlin compiler to produce warnings. (dafaa3e435)

... (truncated)

Commits

• See full diff in compare view

Updates com.google.protobuf:protobuf-java from 3.19.4 to 3.25.5

Commits

• 9d0ec0f Updating version.json and repo version numbers to: 25.5
• 4a197e7 Merge pull request #18387 from protocolbuffers/cp-lp-25
• b5a7cf7 Remove RecursiveGroup test case which doesn't exist in 25.x pre-Editions
• f000b7e Fix merge conflict by adding optional label to proto2 unittest_lite.proto
• 4728531 Add recursion check when parsing unknown fields in Java.
• 850fcce Internal change
• b704498 Internal change
• e673479 Fix cord handling in DynamicMessage and oneofs. (#18375)
• 8a60b65 Merge pull request #17704 from protocolbuffers/cp-segv
• 94a2663 Fixed a SEGV when deep copying a non-reified sub-message.
• Additional commits viewable in compare view

Updates commons-io:commons-io from 2.7 to 2.14.0

Updates io.netty:netty-handler from 4.1.72.Final to 4.1.135.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.1.135.Final

Security fixes

• CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
• CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
• CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
• CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
• CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
• CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
• CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
• CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).
• CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.
• CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).
• CVE-2026-47244: denial of service in io.netty:netty-codec-http2.
• CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

• Auto-port 4.1: MQTT: Allow MQTT 5 CONNECT with password only by @​netty-project-bot in netty/netty#16834
• ChannelInitializer: correct misleading comment on exceptionCaught route by @​daguimu in netty/netty#16847
• HTTP/2: Parse request-target path like Vert.x (4.1 backport) by @​yawkat in netty/netty#16856
• HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted by @​normanmaurer in netty/netty#16861
• IpSubnetFilter: Correctly handle ipv6 by @​normanmaurer in netty/netty#16860
• Configurable bound on RedisArrayAggregator by @​normanmaurer in netty/netty#16858
• Redis: Limit decoded length by @​normanmaurer in netty/netty#16859
• DNS: Ensure query id is not predictible by @​normanmaurer in netty/netty#16870
• Wrapping plain trust manager silently disables hostname verification by @​normanmaurer in netty/netty#16868
• MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @​daguimu in netty/netty#16852
• Fix revapi warnings (#16885) by @​chrisvest in netty/netty#16892
• HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory by @​normanmaurer in netty/netty#16866
• SSL: Use sane defaults as limits for the client hello length and timeout by @​normanmaurer in netty/netty#16871
• DNS: Only cache CNAME if part of the queried domain by @​normanmaurer in netty/netty#16873
• HTTP/2: Enforce max concurrent streams for misbehaving clients by @​normanmaurer in netty/netty#16876
• Dns: Insufficient Bailiwick Validation for NS Records by @​normanmaurer in netty/netty#16877
• HTTP2: DelegatingDecompressorFrameListener must release memory in all cases by @​normanmaurer in netty/netty#16880
• Pass maxAllocation to Brotli and Zstd decoders (#16844) by @​chrisvest in netty/netty#16886
• HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory by @​normanmaurer in netty/netty#16883
• Auto-port 4.1: Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @​netty-project-bot in netty/netty#16894
• HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs by @​normanmaurer in netty/netty#16881
• Epoll / Kqueue: Correctly handle receive of FD by @​normanmaurer in netty/netty#16872
• SCTP: Limit the number of inflight incomplete SCTP messages and the number of fragments by @​normanmaurer in netty/netty#16875
• Redis: Correctly release incomplete message on removal when using RedisArrayAggregator by @​normanmaurer in netty/netty#16878
• Redis: Limit the maximum number of nested arrays by @​normanmaurer in netty/netty#16882

Full Changelog: netty/netty@netty-4.1.134.Final...netty-4.1.135.Final

... (truncated)

Commits

• f05f765 [maven-release-plugin] prepare release netty-4.1.135.Final
• 728c98b Redis: Limit the maximum number of nested arrays (#16882)
• ced30ad Redis: Correctly release incomplete message on removal when using RedisArrayA...
• cef5395 SCTP: Limit the number of inflight incomplete SCTP messages and the number of...
• 652663c Epoll / Kqueue: Correctly handle receive of FD (#16872)
• bd6214f HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs (#16881)
• d7f9069 Auto-port 4.1: Add maxWindowLog parameter to ZstdDecoder to bound memory allo...
• b831454 HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory (#16883)
• 51260aa Pass maxAllocation to Brotli and Zstd decoders (#16844) (#16886)
• db6138b HTTP2: DelegatingDecompressorFrameListener must release memory in all cases (...
• Additional commits viewable in compare view

Updates org.apache.logging.log4j:log4j-core from 2.17.1 to 2.25.4

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.