Q4 2025 dependency updates

.github/workflows/documentation.yml

@@ -11,8 +11,8 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: 'temurin'
           java-version-file: .java-version

.github/workflows/integration-tests.yml

@@ -18,13 +18,13 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: 'temurin'
           java-version-file: .java-version
           cache: 'maven'
-      - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+      - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v5.0.0
         name: Configure AWS credentials from Test account
         with:
           role-to-assume: ${{ vars.AWS_ROLE }}

.github/workflows/test.yml

@@ -25,9 +25,9 @@ jobs:
         options: --name foundationdb1
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up JDK
-        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: 'temurin'
           java-version-file: .java-version

.mvn/wrapper/maven-wrapper.properties

@@ -14,7 +14,7 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar
-distributionSha256Sum=4ec3f26fb1a692473aea0235c300bd20f0f9fe741947c82c1234cefd76ac3a3c
+distributionSha256Sum=0d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb
-wrapperSha256Sum=3d8f20ce6103913be8b52aef6d994e0c54705fb527324ceb9b835b338739c7a8
+wrapperSha256Sum=4e2fbf6554bc8a4702cdfdd3bef464f423393d784ddbb037216320ce55d5e4e1

pom.xml

@@ -37,11 +37,11 @@
   </modules>
 
   <properties>
-    <aws.sdk2.version>2.31.70</aws.sdk2.version>
+    <aws.sdk2.version>2.33.8</aws.sdk2.version>
-    <braintree.version>3.42.0</braintree.version>
+    <braintree.version>3.44.0</braintree.version>
-    <commons-csv.version>1.14.0</commons-csv.version>
+    <commons-csv.version>1.14.1</commons-csv.version>
-    <commons-io.version>2.19.0</commons-io.version>
+    <commons-io.version>2.20.0</commons-io.version>
-    <dropwizard.version>4.0.12</dropwizard.version>
+    <dropwizard.version>4.0.16</dropwizard.version>
     <dropwizard-metrics-datadog.version>1.1.14</dropwizard-metrics-datadog.version>
     <!-- Note: when updating FoundationDB, also include a copy of `libfdb_c.so` from the FoundationDB release at
     src/main/jib/usr/lib/libfdb_c.so. We use x86_64 builds without AVX instructions enabled (i.e. FoundationDB versions
@@ -50,39 +50,39 @@
     <foundationdb.version>7.3.62</foundationdb.version>
     <foundationdb.api-version>730</foundationdb.api-version>
     <foundationdb.client-library-sha256>bfed237b787fae3cde1222676e6bfbb0d218fc27bf9e903397a7a7aa96fb2d33</foundationdb.client-library-sha256>
-    <google-cloud-libraries.version>26.62.0</google-cloud-libraries.version>
+    <google-cloud-libraries.version>26.67.0</google-cloud-libraries.version>
     <grpc.version>1.73.0</grpc.version> <!-- should be kept in sync with the value from Google libraries-bom -->
-    <gson.version>2.13.1</gson.version>
+    <gson.version>2.13.2</gson.version>
     <!-- several libraries (AWS, Google Cloud) use Apache http components transitively, and we need to align them -->
     <httpcore.version>4.4.16</httpcore.version>
     <httpclient.version>4.5.14</httpclient.version>
-    <jackson.version>2.19.1</jackson.version>
+    <jackson.version>2.20.0</jackson.version>
     <junit-pioneer.version>2.3.0</junit-pioneer.version>
     <jsr305.version>3.0.2</jsr305.version>
-    <kotlin.version>2.2.0</kotlin.version>
+    <kotlin.version>2.2.20</kotlin.version>
     <!-- Logback 1.5.14+ has a null pointer bug: https://github.com/qos-ch/logback/issues/929. -->
     <logback.version>1.5.13</logback.version>
-    <logback-access-common.version>2.0.5</logback-access-common.version>
+    <logback-access-common.version>2.0.6</logback-access-common.version>
-    <lettuce.version>6.7.1.RELEASE</lettuce.version>
+    <lettuce.version>6.8.1.RELEASE</lettuce.version>
-    <libphonenumber.version>9.0.8</libphonenumber.version>
+    <libphonenumber.version>9.0.13</libphonenumber.version>
     <logstash.logback.version>8.1</logstash.logback.version>
-    <log4j-bom.version>2.25.0</log4j-bom.version>
+    <log4j-bom.version>2.25.1</log4j-bom.version>
     <luajava.version>3.5.0</luajava.version>
-    <micrometer.version>1.15.1</micrometer.version>
+    <micrometer.version>1.15.4</micrometer.version>
-    <netty.version>4.1.122.Final</netty.version>
+    <netty.version>4.1.127.Final</netty.version>
     <!-- Must be less than or equal to the value from Google libraries-bom which controls the protobuf runtime version.
     See https://protobuf.dev/support/cross-version-runtime-guarantee/. -->
     <protoc.version>4.29.4</protoc.version>
     <pushy.version>0.15.4</pushy.version>
     <reactive.grpc.version>1.2.4</reactive.grpc.version>
-    <reactor-bom.version>2024.0.7</reactor-bom.version> <!-- 3.7.4, see https://github.com/reactor/reactor#bom-versioning-scheme -->
+    <reactor-bom.version>2024.0.10</reactor-bom.version> <!-- 3.7.11, see https://github.com/reactor/reactor#bom-versioning-scheme -->
     <resilience4j.version>2.3.0</resilience4j.version>
     <semver4j.version>3.1.0</semver4j.version>
     <simple-grpc.version>0.1.0</simple-grpc.version>
     <slf4j.version>2.0.17</slf4j.version>
     <stripe.version>28.4.0</stripe.version>
-    <swagger.version>2.2.31</swagger.version>
+    <swagger.version>2.2.36</swagger.version>
-    <testcontainers.version>1.21.2</testcontainers.version>
+    <testcontainers.version>1.21.3</testcontainers.version>
 
     <!-- images to use in tests via testcontainers  -->
     <dynamodb.image>amazon/dynamodb-local:3.0.0@sha256:2fed5e3a965a4ba5aa6ac82baec57058b5a3848e959d705518f3fd579a77e76b</dynamodb.image>
@@ -90,8 +90,8 @@
     <redis.image>redis:7.4-alpine@sha256:af1d0fc3f63b02b13ff7906c9baf7c5b390b8881ca08119cd570677fe2f60b55</redis.image>
     <redis-cluster.image>docker.io/bitnami/redis-cluster:7.4@sha256:a53d023fdfaf8a8d7ddc58da040d3494e4cb45772644618ffa44c42dcd32b9af</redis-cluster.image>
 
-    <!-- eclipse-temurin:24.0.1_9-jre-noble (note: always use the multi-arch manifest *LIST* here) -->
+    <!-- eclipse-temurin:24.0.2_12-jre-noble (note: always use the multi-arch manifest *LIST* here) -->
-    <docker.image.sha256>a42f2330212db8bc1459a2550def18f6ec04a8c31494ffc20dea13dfa82a211e</docker.image.sha256>
+    <docker.image.sha256>85ecfc9bbb42af046d2bacbf1219d2005be4840cbfa16c2e6fd910d9ccfec95b</docker.image.sha256>
 
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
   </properties>
@@ -246,7 +246,7 @@
       <dependency>
         <groupId>org.ow2.asm</groupId>
         <artifactId>asm</artifactId>
-        <version>9.7.1 </version>
+        <version>9.8</version>
         <scope>test</scope>
       </dependency>
       <dependency>
@@ -272,13 +272,13 @@
       <dependency>
         <groupId>com.redis</groupId>
         <artifactId>testcontainers-redis</artifactId>
-        <version>2.2.2</version>
+        <version>2.2.4</version>
         <scope>test</scope>
       </dependency>
       <dependency>
         <groupId>org.signal</groupId>
         <artifactId>libsignal-server</artifactId>
-        <version>0.76.5</version>
+        <version>0.80.3</version>
       </dependency>
       <dependency>
         <groupId>org.signal</groupId>
@@ -352,7 +352,7 @@
     <dependency>
       <groupId>org.wiremock</groupId>
       <artifactId>wiremock</artifactId>
-      <version>3.12.1</version>
+      <version>3.13.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -551,7 +551,7 @@
               <rules>
                 <dependencyConvergence/>
                 <requireMavenVersion>
-                  <version>3.9.9</version>
+                  <version>3.9.11</version>
                 </requireMavenVersion>
               </rules>
             </configuration>

service/pom.xml

@@ -11,11 +11,11 @@
   <artifactId>service</artifactId>
 
   <properties>
-    <firebase-admin.version>9.4.3</firebase-admin.version>
+    <firebase-admin.version>9.6.0</firebase-admin.version>
     <java-uuid-generator.version>5.1.0</java-uuid-generator.version>
-    <google-androidpublisher.version>v3-rev20250318-2.0.0</google-androidpublisher.version>
+    <google-androidpublisher.version>v3-rev20250904-2.0.0</google-androidpublisher.version>
-    <storekit.version>3.4.0</storekit.version>
+    <storekit.version>3.6.0</storekit.version>
-    <webauthn4j.version>0.28.6.RELEASE</webauthn4j.version>
+    <webauthn4j.version>0.29.6.RELEASE</webauthn4j.version>
     <java-jwt.version>4.5.0</java-jwt.version>
   </properties>
 
@@ -243,12 +243,19 @@
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-compress</artifactId>
-      <version>1.27.1</version>
+      <version>1.28.0</version>
     </dependency>
 
     <dependency>
       <groupId>com.google.cloud</groupId>
       <artifactId>google-cloud-pubsub</artifactId>
+      <exclusions>
+        <!-- our direct import of guava brings in a more recent version of failureaccess, so excluding it here -->
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <!-- resolve opentelemetry-semconv conflicts from lower in firebase-admin and firestore dependency trees -->
@@ -261,12 +268,17 @@
           <groupId>io.opentelemetry.semconv</groupId>
           <artifactId>opentelemetry-semconv</artifactId>
         </exclusion>
+        <!-- our direct import of guava brings in a more recent version of failureaccess, so excluding it here -->
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
       <groupId>io.opentelemetry.semconv</groupId>
       <artifactId>opentelemetry-semconv</artifactId>
-      <version>1.30.0</version>
+      <version>1.37.0</version>
     </dependency>
     <dependency>
       <groupId>com.google.cloud</groupId>
@@ -276,6 +288,11 @@
           <groupId>io.opentelemetry.semconv</groupId>
           <artifactId>opentelemetry-semconv</artifactId>
         </exclusion>
+        <!-- our direct import of guava brings in a more recent version of failureaccess, so excluding it here -->
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
 
@@ -390,7 +407,7 @@
     <dependency>
       <groupId>com.amazonaws</groupId>
       <artifactId>dynamodb-lock-client</artifactId>
-      <version>1.3.0</version>
+      <version>1.4.0</version>
     </dependency>
 
     <dependency>
@@ -432,7 +449,7 @@
     <dependency>
       <groupId>com.googlecode.libphonenumber</groupId>
       <artifactId>geocoder</artifactId>
-      <version>3.2</version>
+      <version>3.14</version>
     </dependency>
 
     <dependency>