Skip to content

Bump the dependencies group with 7 updates - #6076

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-52691bf543
Closed

Bump the dependencies group with 7 updates#6076
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-52691bf543

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 7 updates:

Package From To
biz.aQute.bnd:bnd-maven-plugin 7.3.0 7.4.0
com.google.guava:guava-testlib 33.6.0-jre 33.7.1-jre
com.google.guava:guava 33.6.0-jre 33.7.1-jre
com.google.jimfs:jimfs 1.3.1 1.3.2
com.google.protobuf:protobuf-java 4.35.1 4.36.0
com.google.protobuf:protobuf-java-util 4.35.1 4.36.0
org.easymock:easymock 5.6.0 5.7.0

Updates biz.aQute.bnd:bnd-maven-plugin from 7.3.0 to 7.4.0

Release notes

Sourced from biz.aQute.bnd:bnd-maven-plugin's releases.

Bnd/Bndtools 7.4.0

See Release Notes

What's Changed

... (truncated)

Commits
  • 2046c36 build: Build Release 7.4.0
  • aab8519 build: Build Release 7.4.0.RC3
  • 606a199 build: Build Release 7.4.0.RC2
  • afdf547 missing files
  • 9074a7a build: Build Release 7.4.0.RC1
  • b5c4c58 Revert "Eclipse feature support for buildpath"
  • 4fd8e4a Eclipse feature support for buildpath
  • a6ba530 Merge pull request #7336 from chrisrueger/7214-fix-deadlock-junit-tee
  • 0fda33a Fix thread-safety in Tee class
  • 061b7fd Merge pull request #7325 from bndtools/dependabot/github_actions/actions/chec...
  • Additional commits viewable in compare view

Updates com.google.guava:guava-testlib from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava-testlib's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates com.google.jimfs:jimfs from 1.3.1 to 1.3.2

Release notes

Sourced from com.google.jimfs:jimfs's releases.

v1.3.2

  • Fixed Files.move so that ATOMIC_MOVE always enables overwriting of an existing destination file. (3f6e092c)
  • Ensured that SecureDirectoryStream.move works like Files.move with the ATOMIC_MOVE option, as specified, and required that all Path arguments to SecureDirectoryStream methods be from the same FileSystem as the stream itself. (398b0f90)
  • Fixed access from SystemJimfsFileSystemProvider to JimfsFileSystem when they are loaded by different class loaders. (5b756f17)
  • Fixed JimfsInputStream.read to always return 0 when len is 0. (0e5725b4d44ec51d54fba15336aa23147c1bedc7)
Commits
  • d10679b Set version number for jimfs-parent to 1.3.2.
  • 145b64d Bump Guava to 33.7.1.
  • 3965760 Throw UnsupportedOperationException for unsupported attribute views
  • 8ccbf27 Bump Guava to 33.7.0.
  • 10121d7 Update links from the legacy search.maven.org to the new central.sonatype.com.
  • 27ad1f9 Enact some security improvements that I'd missed in previous rounds.
  • 4bb21de Delete assertAsynchronousClose, migrating callers to assertClosed.
  • 0dbccb6 Set persist-credentials: false on checkout actions.
  • 6bff2d8 Bump JSpecify to 1.0.1.
  • 6922aea Bump the github-actions group across 1 directory with 2 updates
  • Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates com.google.protobuf:protobuf-java from 4.35.1 to 4.36.0

Commits

Updates com.google.protobuf:protobuf-java-util from 4.35.1 to 4.36.0

Updates com.google.protobuf:protobuf-java-util from 4.35.1 to 4.36.0

Updates org.easymock:easymock from 5.6.0 to 5.7.0

Release notes

Sourced from org.easymock:easymock's releases.

5.7.0

Add Java 26 support where bytebuddy isn't using unsafe anymore.

Change log

  • Add mock() methods without parameters using varargs reification (#933)
  • Mock creation fails with JDK 26 and ByteBuddy 1.18.10 (#908)git log --oneline
  • Use new Maven central plugin
  • Use a github_token instead
  • Add the missing REST calls to fully automated the release
  • Move to .mvn style version
  • Use assertThrows all over the place
  • Optimize imports and finish updating to JUnit 5
  • Update eclipse configuration
  • Move all to UTF-8 like it should already be
  • Use https for xsd
  • Update objenesis to 3.6
  • Update copyrights to 2026
  • Remove Hamcrest usage
  • Add Maven cache
  • Bump actions/checkout from 7.0.0 to 7.0.1 (#917)
  • Bump actions/github-script from 8 to 9 (#887)
  • Bump actions/setup-java from 5.6.0 to 5.7.0 (#918)
  • Bump activesupport from 8.1.2 to 8.1.2.1 in /website (#882)
  • Bump addressable from 2.8.8 to 2.9.0 in /website (#886)
  • Bump ch.qos.logback:logback-classic from 1.3.14 to 1.6.3 (#930)
  • Bump com.github.spotbugs:spotbugs from 4.8.6 to 4.10.3 (#921)
  • Bump com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.6 to 4.10.3.0 (#922)
  • Bump com.mycila:license-maven-plugin from 4.6 to 5.1.1 (#919)
  • Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.11.0 (#931)
  • Bump concurrent-ruby from 1.3.6 to 1.3.7 in /website (#913)
  • Bump faraday from 2.14.2 to 2.14.3 in /website (#912)
  • Bump json from 2.20.0 to 2.21.2 in /website (#924)
  • Bump junit.jupiter.version from 5.14.1 to 6.1.3 (#926)
  • Bump net.bytebuddy:byte-buddy from 1.18.8 to 1.18.12 (#932)
  • Bump nokogiri from 1.19.3 to 1.19.4 in /website (#911)
  • Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.1.0 (#929)
  • Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 (#832)
  • Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to 3.15.0 (#863)
  • Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 (#899)
  • Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (#894)
  • Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0 (#833)
  • Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (#879)
  • Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (#880)
  • Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 (#837)
  • Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#900)
  • Bump org.apache.maven.plugins:maven-toolchains-plugin from 3.2.0 to 3.3.0 (#928)
  • Bump org.apache.maven.surefire:surefire-testng from 3.5.5 to 3.5.6 (#897)
  • Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (#852)
  • Bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 (#844)

... (truncated)

Changelog

Sourced from org.easymock:easymock's changelog.

Add Java 26 support where bytebuddy isn't using unsafe anymore.

Change log

  • Add mock() methods without parameters using varargs reification (#933)
  • Mock creation fails with JDK 26 and ByteBuddy 1.18.10 (#908)git log --oneline
  • Use new Maven central plugin
  • Use a github_token instead
  • Add the missing REST calls to fully automated the release
  • Move to .mvn style version
  • Use assertThrows all over the place
  • Optimize imports and finish updating to JUnit 5
  • Update eclipse configuration
  • Move all to UTF-8 like it should already be
  • Use https for xsd
  • Update objenesis to 3.6
  • Update copyrights to 2026
  • Remove Hamcrest usage
  • Add Maven cache
  • Bump actions/checkout from 7.0.0 to 7.0.1 (#917)
  • Bump actions/github-script from 8 to 9 (#887)
  • Bump actions/setup-java from 5.6.0 to 5.7.0 (#918)
  • Bump activesupport from 8.1.2 to 8.1.2.1 in /website (#882)
  • Bump addressable from 2.8.8 to 2.9.0 in /website (#886)
  • Bump ch.qos.logback:logback-classic from 1.3.14 to 1.6.3 (#930)
  • Bump com.github.spotbugs:spotbugs from 4.8.6 to 4.10.3 (#921)
  • Bump com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.6 to 4.10.3.0 (#922)
  • Bump com.mycila:license-maven-plugin from 4.6 to 5.1.1 (#919)
  • Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.11.0 (#931)
  • Bump concurrent-ruby from 1.3.6 to 1.3.7 in /website (#913)
  • Bump faraday from 2.14.2 to 2.14.3 in /website (#912)
  • Bump json from 2.20.0 to 2.21.2 in /website (#924)
  • Bump junit.jupiter.version from 5.14.1 to 6.1.3 (#926)
  • Bump net.bytebuddy:byte-buddy from 1.18.8 to 1.18.12 (#932)
  • Bump nokogiri from 1.19.3 to 1.19.4 in /website (#911)
  • Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.1.0 (#929)
  • Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 (#832)
  • Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to 3.15.0 (#863)
  • Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 (#899)
  • Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (#894)
  • Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0 (#833)
  • Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (#879)
  • Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (#880)
  • Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 (#837)
  • Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#900)
  • Bump org.apache.maven.plugins:maven-toolchains-plugin from 3.2.0 to 3.3.0 (#928)
  • Bump org.apache.maven.surefire:surefire-testng from 3.5.5 to 3.5.6 (#897)
  • Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (#852)
  • Bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 (#844)
  • Bump org.codehaus.mojo:jdepend-maven-plugin from 2.1 to 2.2.0 (#855)

... (truncated)

Commits
  • a8422b9 Move to version 5.7.0
  • c0ffdcc Flatten for oss
  • dc07999 Add missing headers
  • 6047a3c Class can be static
  • e208b61 Upgrade samples to JUnit 5 and reified calls
  • f833ee7 Add reified methods (close #933)
  • ffaa64b Add flatten-maven-plugin
  • 02e038e Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0
  • dd4dcf8 Bump net.bytebuddy:byte-buddy from 1.18.11 to 1.18.12
  • 4d66c46 CI has been github actions for years now
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group with 7 updates
a5968d5 
Bumps the dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [biz.aQute.bnd:bnd-maven-plugin](https://github.com/bndtools/bnd) | `7.3.0` | `7.4.0` |
| [com.google.guava:guava-testlib](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |
| [com.google.jimfs:jimfs](https://github.com/google/jimfs) | `1.3.1` | `1.3.2` |
| [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) | `4.35.1` | `4.36.0` |
| com.google.protobuf:protobuf-java-util | `4.35.1` | `4.36.0` |
| [org.easymock:easymock](https://github.com/easymock/easymock) | `5.6.0` | `5.7.0` |


Updates `biz.aQute.bnd:bnd-maven-plugin` from 7.3.0 to 7.4.0
- [Release notes](https://github.com/bndtools/bnd/releases)
- [Commits](bndtools/bnd@7.3.0...7.4.0)

Updates `com.google.guava:guava-testlib` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.google.jimfs:jimfs` from 1.3.1 to 1.3.2
- [Release notes](https://github.com/google/jimfs/releases)
- [Commits](google/jimfs@v1.3.1...v1.3.2)

Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.google.protobuf:protobuf-java` from 4.35.1 to 4.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `com.google.protobuf:protobuf-java-util` from 4.35.1 to 4.36.0

Updates `com.google.protobuf:protobuf-java-util` from 4.35.1 to 4.36.0

Updates `org.easymock:easymock` from 5.6.0 to 5.7.0
- [Release notes](https://github.com/easymock/easymock/releases)
- [Changelog](https://github.com/easymock/easymock/blob/master/ReleaseNotes.md)
- [Commits](easymock/easymock@easymock-5.6.0...easymock-5.7.0)

---
updated-dependencies:
- dependency-name: biz.aQute.bnd:bnd-maven-plugin
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.guava:guava-testlib
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.jimfs:jimfs
  dependency-version: 1.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.protobuf:protobuf-java
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.protobuf:protobuf-java-util
  dependency-version: 4.36.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.protobuf:protobuf-java-util
  dependency-version: 4.36.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.easymock:easymock
  dependency-version: 5.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 30, 2026
@copybara-service copybara-service Bot mentioned this pull request Aug 31, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/maven/dependencies-52691bf543 branch August 31, 2026 07:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cpovirk cpovirk cpovirk approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cpovirk