[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• incubating/wrappers/java/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMGOOGLEGUAVA-20825054	610	com.google.guava:guava: 28.2-jre -> 33.7.2-jre com.google.protobuf:protobuf-java-util: 3.11.1 -> 4.33.0 Major version upgrade No Path Found No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[snyk-io]

This upgrade contains a high-risk major version update for protobuf-java-util and a medium-risk major version update for guava.

Top 3 Most Impactful Upgrades

• com.google.protobuf:protobuf-java-util (3.11.1 → 4.33.0) - HIGH RISK

  This is a major version upgrade that introduces significant breaking changes. The Protobuf library does not support mixing generated code and runtimes across major versions. Code generated with a protoc compiler compatible with the 3.x runtime (which produces GeneratedMessageV3 classes) is not compatible with the 4.x runtime.

  Recommendation: All Protobuf source files (.proto) must be recompiled using a version of the protoc compiler that is compatible with the new 4.x runtime. Failure to do so will result in runtime errors, as newer versions actively detect and reject mismatched code.

• com.google.guava:guava (28.2-jre → 33.7.2-jre) - MEDIUM RISK

  While this is a large version jump, the Guava team has focused on maintaining binary compatibility in the primary guava artifact. However, some breaking changes and important deprecations exist:

  • Removed API: The deprecated single-argument ServiceManager.addListener(Listener) was removed in v30.0. Code should be updated to use the two-argument addListener(Listener, Executor) method.
  • Behavioral Change: Files.createTempDir() was deprecated in v30.0 due to a security vulnerability (CVE-2020-8908) and later reimplemented in v32.0. While intended to be a fix, applications relying on the old behavior should be re-verified.
  • API Stabilization: In v32.0, the @Beta annotation was removed from most APIs, indicating they are now considered stable and will not have their compatibility broken.

  Recommendation: Review code for usage of ServiceManager.addListener and Files.createTempDir. Due to the wide version span, thorough regression testing is strongly advised to catch any unexpected behavioral changes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.