Bump the dependencies group with 7 updates

[copybara-service]

Bump the dependencies group with 7 updates

Bumps the dependencies group with 7 updates:

Package	From	To
biz.aQute.bnd:bnd-maven-plugin	7.3.0	7.4.0
com.google.guava:guava-testlib	33.6.0-jre	33.7.1-jre
com.google.guava:guava	33.6.0-jre	33.7.1-jre
com.google.jimfs:jimfs	1.3.1	1.3.2
com.google.protobuf:protobuf-java	4.35.1	4.36.0
com.google.protobuf:protobuf-java-util	4.35.1	4.36.0
org.easymock:easymock	5.6.0	5.7.0

Updates biz.aQute.bnd:bnd-maven-plugin from 7.3.0 to 7.4.0

Release notes

Sourced from biz.aQute.bnd:bnd-maven-plugin's releases.

Bnd/Bndtools 7.4.0

See Release Notes

What's Changed

• Remove long-running test from ci server build by @​peterkir in bndtools/bnd#7222
• CI build output improvement by @​peterkir in bndtools/bnd#7223
• build(deps): bump ruby/setup-ruby from 1.306.0 to 1.307.0 by @​dependabot[bot] in bndtools/bnd#7227
• build(deps): bump step-security/harden-runner from 2.19.0 to 2.19.2 by @​dependabot[bot] in bndtools/bnd#7230
• build(deps): bump github/codeql-action from 4.35.2 to 4.36.0 by @​dependabot[bot] in bndtools/bnd#7246
• build(deps): bump step-security/harden-runner from 2.19.2 to 2.19.4 by @​dependabot[bot] in bndtools/bnd#7245
• Create SECURITY.md for bnd security documentation by @​chrisrueger in bndtools/bnd#7243
• build(deps): bump ruby/setup-ruby from 1.307.0 to 1.310.0 by @​dependabot[bot] in bndtools/bnd#7240
• build(deps): bump jekyll-seo-tag from 2.8.0 to 2.9.0 in /docs by @​dependabot[bot] in bndtools/bnd#7225
• Allow overriding HTTPClient request headers by @​chrisrueger in bndtools/bnd#7247
• docs: update generated docs by @​github-actions[bot] in bndtools/bnd#7248
• Set explicit headers before defaults and refine logging by @​chrisrueger in bndtools/bnd#7249
• Cooldowns for Dependabot updates by @​chrisrueger in bndtools/bnd#7250
• build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to 3.10.1 in /maven-plugins by @​dependabot[bot] in bndtools/bnd#7219
• build(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 in /maven-plugins by @​dependabot[bot] in bndtools/bnd#7251
• Surface Sonatype deployment IDs in CI Job Summary and workflow outputs by @​peterkir with @​Copilot in bndtools/bnd#7252
• Stabilize SonatypeDeploymentTest deployment ID discovery across CI by @​peterkir with @​Copilot in bndtools/bnd#7254
• Use PAT_WORKSPACE_REPO for create-workspace-template git auth by @​peterkir with @​Copilot in bndtools/bnd#7253
• Readme: Update Bnd Maven and Gradle plugin versions to 7.3.0 by @​chrisrueger in bndtools/bnd#7258
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in bndtools/bnd#7256
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in bndtools/bnd#7244
• build(deps): bump github/codeql-action from 4.36.0 to 4.36.1 by @​dependabot[bot] in bndtools/bnd#7257
• Bndtools Explorer Quick Links addition - Existing Bnd Workspace by @​peterkir in bndtools/bnd#7259
• Update baseline version to 7.3.0 by @​chrisrueger in bndtools/bnd#7260
• build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @​dependabot[bot] in bndtools/bnd#7261
• Add sync baseline version step in postrelease workflow by @​chrisrueger in bndtools/bnd#7263
• Post release 7.3.0 by @​github-actions[bot] in bndtools/bnd#7266
• [maven][resolve] Provide a better logging experience for maven users when resolving by @​timothyjward in bndtools/bnd#7255
• build(deps): bump gradle/actions from 6.1.0 to 6.2.0 by @​dependabot[bot] in bndtools/bnd#7272
• build(deps): bump ruby/setup-ruby from 1.310.0 to 1.313.0 by @​dependabot[bot] in bndtools/bnd#7271
• build(deps): bump actions/setup-java from 5.2.0 to 5.3.0 by @​dependabot[bot] in bndtools/bnd#7273
• build(deps): bump concurrent-ruby from 1.3.6 to 1.3.7 in /docs by @​dependabot[bot] in bndtools/bnd#7278
• build(deps): bump ruby/setup-ruby from 1.313.0 to 1.314.0 by @​dependabot[bot] in bndtools/bnd#7282
• Persist and manage workspace template fragment indexes by @​maho7791 in bndtools/bnd#7284
• Fix IllegalArgumentException for Maven-style SNAPSHOT versions in PomResource by @​peterkir with @​Copilot in bndtools/bnd#7286
• Add repo deps command to export Maven GAVs for dash-licenses by @​juergen-albert in bndtools/bnd#7275
• docs: update generated docs by @​github-actions[bot] in bndtools/bnd#7287
• fix IndexOutOfBoundsException by @​chrisrueger in bndtools/bnd#7291
• fixing issue #7124 by @​peterkir in bndtools/bnd#7292
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in bndtools/bnd#7277
• build(deps): bump actions/setup-java from 5.3.0 to 5.4.0 by @​dependabot[bot] in bndtools/bnd#7295
• Exclude Eclipse features from P2 Repo .versions() by @​chrisrueger in bndtools/bnd#7296
• build(deps): bump ruby/setup-ruby from 1.314.0 to 1.315.0 by @​dependabot[bot] in bndtools/bnd#7299
• build(deps): bump ruby/setup-ruby from 1.315.0 to 1.316.0 by @​dependabot[bot] in bndtools/bnd#7301
• [Security] Maven Repositories: Add Trusted Checksum Verification by @​chrisrueger in bndtools/bnd#7269
• Fix NPE in RepoCollector initialization during Project construction by @​chrisrueger in bndtools/bnd#7304

... (truncated)

Commits

• 2046c36 build: Build Release 7.4.0
• aab8519 build: Build Release 7.4.0.RC3
• 606a199 build: Build Release 7.4.0.RC2
• afdf547 missing files
• 9074a7a build: Build Release 7.4.0.RC1
• b5c4c58 Revert "Eclipse feature support for buildpath"
• 4fd8e4a Eclipse feature support for buildpath
• a6ba530 Merge pull request #7336 from chrisrueger/7214-fix-deadlock-junit-tee
• 0fda33a Fix thread-safety in Tee class
• 061b7fd Merge pull request #7325 from bndtools/dependabot/github_actions/actions/chec...
• Additional commits viewable in compare view

Updates com.google.guava:guava-testlib from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava-testlib's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates com.google.jimfs:jimfs from 1.3.1 to 1.3.2

Release notes

Sourced from com.google.jimfs:jimfs's releases.

v1.3.2

• Fixed Files.move so that ATOMIC_MOVE always enables overwriting of an existing destination file. (3f6e092c)
• Ensured that SecureDirectoryStream.move works like Files.move with the ATOMIC_MOVE option, as specified, and required that all Path arguments to SecureDirectoryStream methods be from the same FileSystem as the stream itself. (398b0f90)
• Fixed access from SystemJimfsFileSystemProvider to JimfsFileSystem when they are loaded by different class loaders. (5b756f17)
• Fixed JimfsInputStream.read to always return 0 when len is 0. (0e5725b4d44ec51d54fba15336aa23147c1bedc7)

Commits

• d10679b Set version number for jimfs-parent to 1.3.2.
• 145b64d Bump Guava to 33.7.1.
• 3965760 Throw UnsupportedOperationException for unsupported attribute views
• 8ccbf27 Bump Guava to 33.7.0.
• 10121d7 Update links from the legacy search.maven.org to the new central.sonatype.com.
• 27ad1f9 Enact some security improvements that I'd missed in previous rounds.
• 4bb21de Delete assertAsynchronousClose, migrating callers to assertClosed.
• 0dbccb6 Set persist-credentials: false on checkout actions.
• 6bff2d8 Bump JSpecify to 1.0.1.
• 6922aea Bump the github-actions group across 1 directory with 2 updates
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates com.google.protobuf:protobuf-java from 4.35.1 to 4.36.0

Commits

• See full diff in compare view

Updates com.google.protobuf:protobuf-java-util from 4.35.1 to 4.36.0

Updates com.google.protobuf:protobuf-java-util from 4.35.1 to 4.36.0

Updates org.easymock:easymock from 5.6.0 to 5.7.0

Release notes

Sourced from org.easymock:easymock's releases.

5.7.0

Add Java 26 support where bytebuddy isn't using unsafe anymore.

Change log

• Add mock() methods without parameters using varargs reification (#933)
• Mock creation fails with JDK 26 and ByteBuddy 1.18.10 (#908)git log --oneline
• Use new Maven central plugin
• Use a github_token instead
• Add the missing REST calls to fully automated the release
• Move to .mvn style version
• Use assertThrows all over the place
• Optimize imports and finish updating to JUnit 5
• Update eclipse configuration
• Move all to UTF-8 like it should already be
• Use https for xsd
• Update objenesis to 3.6
• Update copyrights to 2026
• Remove Hamcrest usage
• Add Maven cache
• Bump actions/checkout from 7.0.0 to 7.0.1 (#917)
• Bump actions/github-script from 8 to 9 (#887)
• Bump actions/setup-java from 5.6.0 to 5.7.0 (#918)
• Bump activesupport from 8.1.2 to 8.1.2.1 in /website (#882)
• Bump addressable from 2.8.8 to 2.9.0 in /website (#886)
• Bump ch.qos.logback:logback-classic from 1.3.14 to 1.6.3 (#930)
• Bump com.github.spotbugs:spotbugs from 4.8.6 to 4.10.3 (#921)
• Bump com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.6 to 4.10.3.0 (#922)
• Bump com.mycila:license-maven-plugin from 4.6 to 5.1.1 (#919)
• Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.11.0 (#931)
• Bump concurrent-ruby from 1.3.6 to 1.3.7 in /website (#913)
• Bump faraday from 2.14.2 to 2.14.3 in /website (#912)
• Bump json from 2.20.0 to 2.21.2 in /website (#924)
• Bump junit.jupiter.version from 5.14.1 to 6.1.3 (#926)
• Bump net.bytebuddy:byte-buddy from 1.18.8 to 1.18.12 (#932)
• Bump nokogiri from 1.19.3 to 1.19.4 in /website (#911)
• Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.1.0 (#929)
• Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 (#832)
• Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to 3.15.0 (#863)
• Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 (#899)
• Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (#894)
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0 (#833)
• Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (#879)
• Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (#880)
• Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 (#837)
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#900)
• Bump org.apache.maven.plugins:maven-toolchains-plugin from 3.2.0 to 3.3.0 (#928)
• Bump org.apache.maven.surefire:surefire-testng from 3.5.5 to 3.5.6 (#897)
• Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (#852)
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 (#844)

... (truncated)

Changelog

Sourced from org.easymock:easymock's changelog.

Add Java 26 support where bytebuddy isn't using unsafe anymore.

Change log

• Add mock() methods without parameters using varargs reification (#933)
• Mock creation fails with JDK 26 and ByteBuddy 1.18.10 (#908)git log --oneline
• Use new Maven central plugin
• Use a github_token instead
• Add the missing REST calls to fully automated the release
• Move to .mvn style version
• Use assertThrows all over the place
• Optimize imports and finish updating to JUnit 5
• Update eclipse configuration
• Move all to UTF-8 like it should already be
• Use https for xsd
• Update objenesis to 3.6
• Update copyrights to 2026
• Remove Hamcrest usage
• Add Maven cache
• Bump actions/checkout from 7.0.0 to 7.0.1 (#917)
• Bump actions/github-script from 8 to 9 (#887)
• Bump actions/setup-java from 5.6.0 to 5.7.0 (#918)
• Bump activesupport from 8.1.2 to 8.1.2.1 in /website (#882)
• Bump addressable from 2.8.8 to 2.9.0 in /website (#886)
• Bump ch.qos.logback:logback-classic from 1.3.14 to 1.6.3 (#930)
• Bump com.github.spotbugs:spotbugs from 4.8.6 to 4.10.3 (#921)
• Bump com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.6 to 4.10.3.0 (#922)
• Bump com.mycila:license-maven-plugin from 4.6 to 5.1.1 (#919)
• Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.11.0 (#931)
• Bump concurrent-ruby from 1.3.6 to 1.3.7 in /website (#913)
• Bump faraday from 2.14.2 to 2.14.3 in /website (#912)
• Bump json from 2.20.0 to 2.21.2 in /website (#924)
• Bump junit.jupiter.version from 5.14.1 to 6.1.3 (#926)
• Bump net.bytebuddy:byte-buddy from 1.18.8 to 1.18.12 (#932)
• Bump nokogiri from 1.19.3 to 1.19.4 in /website (#911)
• Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.1.0 (#929)
• Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 (#832)
• Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to 3.15.0 (#863)
• Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 (#899)
• Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (#894)
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0 (#833)
• Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (#879)
• Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (#880)
• Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 (#837)
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#900)
• Bump org.apache.maven.plugins:maven-toolchains-plugin from 3.2.0 to 3.3.0 (#928)
• Bump org.apache.maven.surefire:surefire-testng from 3.5.5 to 3.5.6 (#897)
• Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (#852)
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 (#844)
• Bump org.codehaus.mojo:jdepend-maven-plugin from 2.1 to 2.2.0 (#855)

... (truncated)

Commits

• a8422b9 Move to version 5.7.0
• c0ffdcc Flatten for oss
• dc07999 Add missing headers
• 6047a3c Class can be static
• e208b61 Upgrade samples to JUnit 5 and reified calls
• f833ee7 Add reified methods (close #933)
• ffaa64b Add flatten-maven-plugin
• 02e038e Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0
• dd4dcf8 Bump net.bytebuddy:byte-buddy from 1.18.11 to 1.18.12
• 4d66c46 CI has been github actions for years now
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Fixes #6076

FUTURE_COPYBARA_INTEGRATE_REVIEW=#6076 from google:dependabot/maven/dependencies-52691bf543 a5968d5