[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• engine/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMGOOGLEGUAVA-20825054	610	com.google.guava:guava: 29.0-jre -> 33.7.2-jre com.google.protobuf:protobuf-java-util: 3.13.0 -> 4.33.0 Major version upgrade No Path Found No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[snyk-io]

This upgrade includes a major, high-risk version change for Protocol Buffers and a medium-risk update for Guava.

1. com.google.protobuf:protobuf-java-util@3.13.0 → 4.33.0 (HIGH RISK)

This is a significant and breaking upgrade that moves from the proto3 syntax to the new Protobuf Editions model. This is not a simple dependency swap and will require a coordinated migration.

Key Breaking Changes:

• New Toolchain Required: You must upgrade your protoc compiler to a modern version (e.g., v26.0 or newer) that supports Editions and regenerate all Java classes from your .proto files.
• Incompatible Runtimes: The new 4.x Java runtime is intentionally incompatible with code generated by older 3.x compilers. The build will fail if you have a mismatch.
• API Removals: Numerous deprecated methods and fields have been removed in the 4.x line. For example, the static PARSER field on generated messages is removed and must be replaced with the parser() method.
• Syntax Change: Your .proto files will need to be migrated from syntax = "proto3"; to edition = "2023"; and reviewed for feature changes.

Recommendation: This upgrade requires a dedicated migration effort. Developers must update their entire Protobuf build toolchain and regenerate all Protobuf-related source code. Review the official Protobuf documentation on Editions before proceeding.

2. com.google.guava:guava@29.0-jre → 33.7.2-jre (MEDIUM RISK)

This upgrade spans multiple major versions (v30, v31, v32, v33). While the API surface has been largely stable, the primary risks come from environmental and build-system changes.

Key Changes:

• API Stability: In version 32.0, the @Beta annotation was removed from most APIs, indicating they are now considered stable and will not have breaking changes.
• Java Module System (JPMS): Newer versions have improved support for the Java Module System, which may affect applications running on modern JDKs (9+).
• Build System Metadata: Changes were made to Gradle Module Metadata to better distinguish between -jre and -android artifacts. This could require adjustments to your build configuration, especially if you use Gradle.
• GWT-RPC Support Removed: Support for sending Guava types over GWT-RPC was removed in v30.0. This is the only documented API removal and affects a specific use case.

Recommendation: Verify your application's build and runtime behavior after the upgrade, paying close attention to dependency resolution in Gradle and behavior on modern JDK versions.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.