[dependabot]

Bumps the production-dependencies group with 3 updates: com.google.guava:guava, org.codehaus.mojo:animal-sniffer-maven-plugin and org.jetbrains.dokka:dokka-maven-plugin.

Updates com.google.guava:guava from 33.7.2-jre to 33.8.0-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.8.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.8.0-jre</version>
  <!-- or, for Android: -->
  <version>33.8.0-android</version>
</dependency>

Jar files

• 33.8.0-jre.jar
• 33.8.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.8.0-jre
• 33.8.0-android

JDiff

• 33.8.0-jre vs. 33.7.2-jre
• 33.8.0-android vs. 33.7.2-android
• 33.8.0-android vs. 33.8.0-jre

Changelog

• collect: Enhanced HashBiMap and LinkedHashMultimap.ValueSet to defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3506)
• collect: Accidentally changed a few methods in ForwardingMap.StandardValues to be final. No Google-internal or GitHub-public code appears to be affected, but we will fix this in the next release. If it causes you problems, let us know.
• net: Added MediaType.APPLICATION_GZIP (application/gzip) to be used in preference to GZIP (application/x-gzip). (6393ebbdb6)
• primitives: Added Doubles.MIN_POSITIVE_VALUE and Floats.MIN_POSITIVE_VALUE as more clearly named aliases for Double.MIN_VALUE and Float.MIN_VALUE. (adf5554e7e)
• testlib: Added AbstractClassInitializationTest. (80fd5c114d)
• and, among the usual changes, a larger than usual number of small fixes (4afb1e04a4246c261be4742e1f2e2c39ebaf6266, 79152348ece2de85559eb2eb18133862d492c892, a279b884fe9890a3869142919352156f2a67a705, 786bb1a9b44685875ebe7b83f1404a1f07ac653c, 6b3a8d7498a7fde122967ba37a023ba3dcb47792, de57a419b56bcd887f51bb99103d91c65b7c5e86, fa64cc7c2b320aca9219981952bbb544f8f6ccff, 7b64964048948de3b5633a75d6e64f98cf8fcece, 5ae56d77e64305752b919ff2c96713f47ac0c94c, 37535d73f0416f30e0301efe61a8eb8ede44c1b7, ca8aedb2fdaf40fd6937a0643180aea51ca4154e, c0a8a1edc69393e8141424037571d9825f5fc0f4, 51246d06bb85ccc182a0aeb6a7adcbd55f759ae5, 81c7d030f8f144a4885ccf8efdc72c92605b4eec, 2b86a8216627a807ce8520abc6ae55437dbb85fb, 669a232b4e20ae6e8bc6efc62caaf2f830d56327, b157643c41f9ee6a38732b4fa1a590ba187912d9, ad73fbb9beff220aa26390630724855ef92fc50b, 1e6eb68f2ee8dc6cb164c285f7fe6ad5e8bc0905, 3d5be86651ec58b3f9d15c76cf888ade15aba39b)

Commits

• See full diff in compare view

Updates org.codehaus.mojo:animal-sniffer-maven-plugin from 1.28 to 1.29

Release notes

Sourced from org.codehaus.mojo:animal-sniffer-maven-plugin's releases.

1.29

Animal Sniffer 1.29 improves signature checking accuracy, fixes @IgnoreJRERequirement suppression ordering in the Ant task, and modernizes signature artifact resolution in the Maven plugin and Enforcer rule. The Maven plugin and Enforcer rule require Maven 3.9.0 or later and Java 8 or later.

✨ Highlights

• Method parameter type checking: SignatureChecker now verifies the types of declared method parameters against the target signature so methods accepting types missing from the target API are caught even if those types are not referenced in the method body. Synthetic constructor parameters generated for inner classes continue to respect @IgnoreJRERequirement (#349).
• Classified signature artifacts in animal-sniffer-maven-plugin: The <signature> configuration in animal-sniffer:check now honours <classifier>, allowing builds to resolve signature artifacts published with a classifier (#346).
• Maven Resolver support in animal-sniffer-enforcer-rule: The checkSignatureRule Enforcer rule now resolves signature artifacts through Maven Resolver instead of the legacy ArtifactResolver, ensuring compatibility with Maven 3.9+ and Maven 4 (#367).
• Reliable @IgnoreJRERequirement suppression in the Ant task: The Ant <check-signature> task now sorts classes within each container so enclosing classes are always processed before their nested/inner classes regardless of filesystem or JAR entry order, and ignores non-class resources without splitting class batches (#350).
• ASM 9.11: Upgraded org.ow2.asm:asm to 9.11 for current Java bytecode support (#354).

🚨 Removed

• Require Maven 3.9.0 (#359) @​slachiewicz

🚀 New features and improvements

• Resolve the enforcer rule's signature through Maven Resolver (#367) @​slachiewicz

🐛 Bug Fixes

• Resolve classified signature artifacts in Maven plugin (#346) @​jhy
• Detect unsupported declared method parameter types (#349) @​wilx
• Fix Ant signature suppression for unordered class files (#350) @​wilx

📝 Documentation updates

• Add AGENTS.md (#366) @​slachiewicz

👻 Maintenance

• Run CheckSignatureTaskTest on JUnit 5 (#376) @​slachiewicz
• Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus (#374) @​slachiewicz
• Drop obsolete plugin pins and Java 1.5 settings from the IT projects (#371) @​slachiewicz
• Declare the Maven artifacts the code uses (#368) @​slachiewicz
• Remove redundant maven-shade-plugin version (#370) @​slachiewicz
• Replace deprecated @​Component with JSR 330 injection (#369) @​slachiewicz
• Apply the JUnit 5 best practices to the tests (#364) @​slachiewicz
• Keep Dependabot on Maven 3.9.x (#362) @​slachiewicz
• Port the BeanShell verify scripts to Groovy (#361) @​slachiewicz
• Migrate SignatureCheckerTest to JUnit 5 (#360) @​slachiewicz

🔧 Build

• Keep Dependabot on Maven 3.9.x and Resolver 1.9.x (#372) @​slachiewicz
• Use the runners' cached Temurin JDKs in CI (#365) @​slachiewicz
• Run CI on Maven 4 (#363) @​slachiewicz
• Assign merged pull requests to the release milestone (#358) @​slachiewicz
• Run one integration test per CPU core (#357) @​slachiewicz
• Check dependencies monthly and group the updates (#356) @​slachiewicz

... (truncated)

Commits

• 376927b [maven-release-plugin] prepare release 1.29
• 4ff56c7 Run CheckSignatureMojoTest on JUnit 5 with the injected constructor
• 43fa25c Update the classifier example, and test version lookup
• 52fb82c Maven plugin resolves classified signature artifacts
• 32ca482 Preserve suppression for synthetic method parameters
• 9007ee7 Cover synthetic parameter suppression regressions
• 4cadda9 Check declared method parameter types against signatures
• 28455f9 Add regression coverage for unsupported parameter types
• c957b5b Run CheckSignatureTaskTest on JUnit 5
• 21f484a Ignore resources without splitting Ant class file batches
• Additional commits viewable in compare view

Updates org.jetbrains.dokka:dokka-maven-plugin from 2.2.0 to 2.3.0

Release notes

Sourced from org.jetbrains.dokka:dokka-maven-plugin's releases.

2.3.0

New Features

• Add support for KEEP-0449: companion block and companion modifier on extensions (#4514, #4529)
• Add new suppressAnnotatedWith option to suppress annotated declarations (#4464) Thanks to @​rnett!
• Add WasmWasi and WasmJs platforms (#4496)
• Add clean up extension point which runs in finally block (#4545) Thanks to @​juliamcclellan!

Javadoc & KDoc Improvements

• JEP 413: Add support for @snippet tag in Javadoc (#4392) Thanks to @​yuriioliinyk4!
• JEP 467: Add support for Javadoc Markdown Doc Comments (#4414) Thanks to @​yuriioliinyk4!
• Fix inconsistent flow for B, Strong, Em, I tags and add support for <h4-6> Javadoc HTML tags (#4375) Thanks to @​yuriioliinyk4!
• Fix unresolved Javadoc @link to an override of a classpath method (#4547)
• Update Enum.values template (#4450), Enum.entries KDoc (#4475)
• Enhance logging about unresolved symbol/links (#4430, #4455, #4477, #4542)
• Enable the new KDoc resolution according to KEEP#389 by default. Drop flag and separate test task for the new KDoc resolution (#4481, #4454, #4471)

Bug Fixes

• Preserve and render reified on Kotlin function type parameters (#4549)
• Handle KaIntersectionType in TypeTranslator (#4520)
• Fix enum class rendering to show enum class instead of enum (#4510)
• Fix: use Kotlin Playground sample resources only on pages with @sample (#4428)
• Fix autoscrolling in the table of contents when opening a new page (#4548)
• Fix resolving fully-qualified KDoc links from unpacked klib (KT-85112) (#4483)
• Fix missing accessor docs of overridden properties (#4544)
• Fix Symbol not found for a typealias to a nested typealias (#4447)
• Fix vararg missing from annotation class constructor signatures (#4557)

Dokka Gradle Plugin

• Support Project Isolation in DGPv2 (#4497)
• Remove unnecessary input-files sorting from devMavenRepositoriesInputFiles (#4432)
• Update com.gradle.publish:plugin-publish-plugin and declare Gradle Configuration Cache compatibility (#4484)
• Fix DGP reading all Gradle properties (#4468)
• Detect and handle intersected source roots in Android multi-variant projects (#4473)
• Set finalizeCoroutines back to true and add a test for metaspace leaks with DGPv2 (#4512)
• Move ProcessIsolation convention values to ProcessIsolation factory function (#4534)

Security updates

Updated dependencies that ship with Dokka's published artifacts, resolving vulnerabilities:

• FreeMarker 2.3.32 → 2.3.35 — fixes CVE-2026-84939, a critical path traversal in template loading (#4613)
• jsoup 1.16.1 → 1.23.2— fixes CVE-2026-75140 (High: memory-exhaustion DoS) and CVE-2026-71497 (#4579)
• Jackson 2.15.3 → 2.22.2 — resolves high-severity CVE-2026-68497, CVE-2026-54512 and CVE-2026-54513 (#4581)

... (truncated)

Commits

• c6cd48a Update Dokka version references to 2.3.0 and Gradle to 9.8.2 in examples (#4617)
• 320ee9c Remove 'api reference' from Gradle Plugin publishing (#4616)
• 332b06a Update the version for the 2.3.0 release
• 797e56f Bump FreeMarker to 2.3.35 (#4613)
• fe916ab Update the version for the 2.3.0-Beta release
• 7fe7cab Update Jsoup version to 1.23.2 (#4579)
• 4a31ebf Better fix for markdown blockqoutes handling (#4595)
• f1762cd Restore DRI to Java method with mapped types (#4594)
• b86fe03 Update Jackson version to 2.22.2 (#4581)
• f802954 Update markdown library version to 0.7.10 (#4596)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 352454fc-2233-4cc1-ba8b-74f07b7d5560

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn