Bump the dependencies group with 7 updates

[dependabot]

Bumps the dependencies group with 7 updates:

Package	From	To
com.google.guava:guava-testlib	33.7.1-jre	33.7.2-jre
com.google.guava:guava	33.7.1-jre	33.7.2-jre
com.google.testparameterinjector:test-parameter-injector	1.23	1.24
org.safere:safere	0.11.0	1.0.0
com.google.googlejavaformat:google-java-format	1.36.1	1.37.0
joda-time:joda-time	2.14.4	2.15.0
org.checkerframework:checker-qual	4.2.3	4.3.0

Updates com.google.guava:guava-testlib from 33.7.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava-testlib's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

Commits

• See full diff in compare view

Updates com.google.guava:guava from 33.7.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

Commits

• See full diff in compare view

Updates com.google.testparameterinjector:test-parameter-injector from 1.23 to 1.24

Updates org.safere:safere from 0.11.0 to 1.0.0

Release notes

Sourced from org.safere:safere's releases.

SafeRE 1.0.0

Highlights

SafeRE 1.0.0 is the first major release of SafeRE: linear-time regular expressions for Java, with java.util.regex-compatible behavior within that constraint and direct UTF-8 matching. This release improves Unicode grapheme handling, fixes matching and capture edge cases, and speeds up literal searches and DFA-heavy workloads. Java 21 or later is required.

Migration from 0.11.0

• The retired multi-anchor gap executor and its public diagnostics enum constant, MatchStrategy.MULTI_ANCHOR, have been removed. Update any references or exhaustive switches over that constant; matching continues through the remaining engines and accelerators. (#865)
• SafeRE's supported syntax and documented compatibility boundaries still apply. Backreferences, lookaround, atomic groups, \G, and consuming possessive quantifiers remain unsupported; see the syntax guide and intentional divergences when migrating from java.util.regex.

Compatibility and correctness

• Align \X grapheme segmentation with Unicode 17 data, including format controls, extenders, spacing marks, prepend characters, and Indic conjuncts. Grapheme tables now come from pinned public Unicode data. Preserve Unicode segmentation for unassigned code points instead of treating all unassigned code points as grapheme controls, and document the intentional JDK difference. (#932)
• Make Unicode case equivalence symmetric. (#870)
• Fix deferred capture coordinates in opaque matcher regions and reverse DFA searches starting inside surrogate pairs. (#887, #930)
• Preserve consuming branches after deferred DFA matches, refresh DFA storage references after allocation, and restrict start acceleration to unanchored forward states. (#859, #886, #893)
• Fix case-insensitive UTF-8 prefix scan bounds at logical slice ends. (#885)
• Document intentional differences in quoting inside comments and matcher state after a terminal empty find(), with regression and differential coverage. (#860, #933)

Performance

• Improve literal selection and String searches with rare-character anchors, single-character search kernels, and bounded fallback when candidate density makes acceleration unproductive. (#876, #883, #901, #905)
• Accelerate exact-case and Unicode-case-insensitive UTF-8 literal searches and literal-prefix filtering, while bounding verification work across retries and repeated finds. (#919, #920, #924)
• Flush and rebuild productive DFA caches on state-budget exhaustion, with backoff and recovery for unproductive workloads. The reported Rebar bounded-repeat workload improved by about 3× across String, UTF-8, and vector configurations. (#908)
• Reduce capture speculation, resolve variable-offset start candidates against leading character classes, verify nullable leading expansions at the inner match, and base accelerator backoff on actual skipped work. (#878, #906, #915, #896)
• Improve rejection prefilters and fast-reject non-matching start-anchored replacements. The reported Rebar Ruff workload improved by about 2.4× on the String path through single-character class rejection. (#910, #922, #927)
• Dispatch experimental vector scans according to each search window and strengthen dispatch auditing. (#861, #862, #909)

Other changes

• Publish development snapshots after successful main CI and correct SCM URLs in published Maven POMs. (#897, #877)
• Expand randomized UTF-8, capture-bound, repeated-find, and scan-boundary coverage; add Rebar benchmark results and additional native benchmark workloads. (#875, #907, #918)
• Reorganize the documentation and refresh the README with a new SafeRE logo. (#942, #943)

Contributors

Thanks to @​cushon for search acceleration, DFA cache recovery, Unicode grapheme work, and stronger differential and dispatch coverage, and @​wendigo for correcting published Maven SCM metadata. Thanks also to @​eaftan for compatibility fixes, UTF-8 search improvements, release infrastructure, and documentation.

Full changelog: eaftan/safere@v0.11.0...v1.0.0

Commits

• 09c4812 Prepare installation examples for SafeRE 1.0.0 (#953)
• 38a0516 Exclude unsupported previous-match anchor and atomic groups in fuzz compiler ...
• 86066ee Reorganize documentation and refresh the SafeRE README (#942)
• 30ae754 Add SafeRE logo to README (#943)
• 5bfcec9 Preserve unassigned grapheme semantics and document JDK divergence (#932)
• f63b002 Discourage dependencies on JDK internals (#941)
• 39565b2 Document and test intentional exhausted matcher state divergence (#933)
• a9f90ef Bump org.codehaus.mojo:build-helper-maven-plugin (#937)
• 848d059 Keep reverse DFA search within surrogate-interior start (#930)
• 6eea37a Streamline agent guidance and scope local validation (#934)
• Additional commits viewable in compare view

Updates com.google.googlejavaformat:google-java-format from 1.36.1 to 1.37.0

Release notes

Sourced from com.google.googlejavaformat:google-java-format's releases.

v1.37.0

Changes:

• Add a --max-line-length flag (#425)
• Markdown javadoc formatting improvements (c51d6916518ab4dfffbb086449fa00f7160ae468, ecba4fb24fd064a64d2918c5fdb45546d08e3063)
• Add --google-style and --style=google|aosp flags for easier switching between Google and AOSP style (#1415)

Full Changelog: google/google-java-format@v1.36.1...v1.37.0

Commits

• d346693 Release google-java-format 1.37.0
• f70f5e1 Cache indentation spaces lazily in JavaOutput.
• 6b86849 Add --max-line-length and --style options, and programmatic tab support, to g...
• 4c732b8 Rewrite code so it doesn't use negative lookahead in a regex.
• 8165092 Add --google-style to select Google Style
• ed87207 Use inherited EMPTY_RANGE in JavaOutput to eliminate Formatter dependency.
• 4b088d2 Replace calls to Runnables.doNothing() with a do-nothing lambda, () -> {}.
• b291d95 Fix duplicate blank lines before MOE end strip comment tag
• c6c150d Move google-java-format settings page to Tools section.
• 4b3d373 Bump the dependencies group across 1 directory with 2 updates
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.7.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

Commits

• See full diff in compare view

Updates joda-time:joda-time from 2.14.4 to 2.15.0

Release notes

Sourced from joda-time:joda-time's releases.

Release v2.15.0

See the change notes for more information.

What's Changed

• Fix DelegatedDurationField by @​jodastephen in JodaOrg/joda-time#838
• Update time zone data to 2026egtz by @​jodastephen in JodaOrg/joda-time#841

Full Changelog: JodaOrg/joda-time@v2.14.4...v2.15.0

Commits

• 5ffcf3c Release v2.15.0
• d6135ac Update time zone data to 2026egtz (#841)
• 4b7867a Fix DelegatedDurationField (#838)
• 9c34f03 Fix changes.xml
• See full diff in compare view

Updates org.checkerframework:checker-qual from 4.2.3 to 4.3.0

Release notes

Sourced from org.checkerframework:checker-qual's releases.

Checker Framework 4.3.0

Version 4.3.0 (2026-10-01)

User-visible changes

The new Modifiability Checker warns when a program might throw UnsupportedOperationException at run time because it calls a mutating method on a collection that does not support the method.

The new wpi2.sh script does whole-program inference, but requires buildfile edits.

Purity Checker:

• Renamed message keys purity.not.deterministic.X, purity.not.sideeffectfree.X, and purity.not.deterministic.not.sideeffectfree.X to purity.X.
• -AcheckPurityAnnotations issues warnings that it missed previously.

The Checker Framework runs under JDK 27 -- that is, it runs on a version 27 JVM.

The Checker Framework runs noticeably faster, due to performance tuning.

The HTML version of the manual has a new look. In addition to the single-page version, there is a multi-page version.

Changes for type system implementers

JavaParserUtil: moved DEFAULT_LANGUAGE_LEVEL, parseCompilationUnit(), parseStubUnit(), and parseExpression() into new class StaticJavaParserUtil.

Renamed AnnotatedTypes.innerMostType() to innermostComponentType().

Removed the unused method WholeProgramInferenceScenesStorage.updateAnnotationSetInScene().

Methods that used to return (or accept) an IPair now use a record with meaningful component names.

Closed issues

#294, #1170, #1184, #1256, #1440, #1444, #1669, #2090, #2172, #2429, #2448, #2561, #2637, #2704, #2722, #2770, #2896, #2995, #3015, #3025, #3027, #3146, #3281, #3624, #4690, #4708, #4754, #5064, #5201, #6038, #6716, #6741, #6748, #6756, #6768, #6832, #6881, #7023, #7049, #7064, #7311, #7683, #8053, #8054, #8055, #8167, #8168, #8169, #8238, #8261, #8284.

Changelog

Sourced from org.checkerframework:checker-qual's changelog.

Version 4.3.0 (2026-10-01)

User-visible changes

The new Modifiability Checker warns when a program might throw UnsupportedOperationException at run time because it calls a mutating method on a collection that does not support the method.

The new wpi2.sh script does whole-program inference, but requires buildfile edits.

Purity Checker:

• Renamed message keys purity.not.deterministic.X, purity.not.sideeffectfree.X, and purity.not.deterministic.not.sideeffectfree.X to purity.X.
• -AcheckPurityAnnotations issues warnings that it missed previously.

The Checker Framework runs under JDK 27 -- that is, it runs on a version 27 JVM.

The Checker Framework runs noticeably faster, due to performance tuning.

The HTML version of the manual has a new look. In addition to the single-page version, there is a multi-page version.

Changes for type system implementers

JavaParserUtil: moved DEFAULT_LANGUAGE_LEVEL, parseCompilationUnit(), parseStubUnit(), and parseExpression() into new class StaticJavaParserUtil.

Renamed AnnotatedTypes.innerMostType() to innermostComponentType().

Removed the unused method WholeProgramInferenceScenesStorage.updateAnnotationSetInScene().

Methods that used to return (or accept) an IPair now use a record with meaningful component names.

Closed issues

#294, #1170, #1184, #1256, #1440, #1444, #1669, #2090, #2172, #2429, #2448, #2561, #2637, #2704, #2722, #2770, #2896, #2995, #3015, #3025, #3027, #3146, #3281, #3624, #4690, #4708, #4754, #5064, #5201, #6038, #6716, #6741, #6748, #6756, #6768, #6832, #6881, #7023, #7049, #7064, #7311, #7683, #8053, #8054, #8055, #8167, #8168, #8169, #8238, #8261, #8284.

Commits

• a850bea new release 4.3.0
• 2df7db6 Fix the module in links to Collections Javadoc
• c714cde Fix broken links in the lwarp-generated manuals (#8312)
• 1014d08 Add the Modifiability Checker (#8234)
• 3c6e930 Don't bound a fresh capture type variable by unresolved inference variables (...
• cd86e5d Prep for the release.
• 0195f64 Check a constructor's purity against its class's instance initializers (#8113)
• 93d6023 Add test cases for issues that are already fixed (#8303)
• 9e0f606 Add test cases for issues that are already fixed (#8302)
• 8a1a3aa Don't let an inference bound that ignores annotations override one that (#8285)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
com.google.testparameterinjector:test-parameter-injector	[>= 1.8.a, < 1.9]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml