From e4607b13d49dfdb212ecd5448caf280f72ae5347 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 25 Mar 2025 23:07:52 +0000
Subject: [PATCH 1/2] Bump com.google.guava:guava from 33.4.0-jre to 33.4.6-jre

Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.4.0-jre to 33.4.6-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 0efdd67..1035cb6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
         <!-- overwrite due to CVE-2023-2976 in Guice transitive dependencies -->
-        <version>33.4.0-jre</version>
+        <version>33.4.6-jre</version>
       </dependency>
     </dependencies>
   </dependencyManagement>

From dff2cf8041d8bae78d4b0833bb72ccf653e11468 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Sat, 5 Apr 2025 11:00:53 +0200
Subject: [PATCH 2/2] Added explicit dependency to findbugs jsr305

---
 pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pom.xml b/pom.xml
index 1035cb6..4582a90 100644
--- a/pom.xml
+++ b/pom.xml
@@ -63,6 +63,12 @@
       <artifactId>guice</artifactId>
       <version>6.0.0</version>
     </dependency>
+    <!-- needed by Guava 33.4.3+ for javax.annotations.Nullable -->
+    <dependency>
+      <groupId>com.google.code.findbugs</groupId>
+      <artifactId>jsr305</artifactId>
+      <version>3.0.2</version>
+    </dependency>
     <dependency>
       <groupId>jakarta.annotation</groupId>
       <artifactId>jakarta.annotation-api</artifactId>