Bump the prod-deps group across 1 directory with 5 updates

[dependabot]

Bumps the prod-deps group with 5 updates in the / directory:

Package	From	To
com.squareup.wire:wire-schema-jvm	6.4.1	6.4.5
com.squareup.wire:wire-schema	6.4.1	6.4.5
tools.jackson:jackson-bom	3.2.1	3.2.2
ch.qos.logback:logback-classic	1.6.1	1.6.3
com.google.guava:guava	33.6.0-jre	33.7.1-jre

Updates com.squareup.wire:wire-schema-jvm from 6.4.1 to 6.4.5

Changelog

Sourced from com.squareup.wire:wire-schema-jvm's changelog.

Version 6.4.5

2026-06-29

Common

• Security: Reject oversized lengths and fixed-width values that exceed the current reader limit in Java/Kotlin and Swift runtimes (#3635, [GHSA-9rm7-3qhh-h2mc][GHSA-9rm7-3qhh-h2mc] reported by Ta Duc Thien and Duc Anh Nguyen)

Version 6.4.4

2026-06-23

Common

• Security: Reject negative lengths when skipping groups in Swift, so crafted protobuf payloads throw ProtocolException instead of unchecked runtime exceptions (#3616, [GHSA-86wm-r4c5-2rc9][GHSA-86wm-r4c5-2rc9], reported by [tonghuaroot][tonghuaroot])

Version 6.4.0

2026-05-15

Common

• Security: Escape comment delimiters in generated documentation for Java, Kotlin, and Swift, preventing malicious proto documentation from injecting source code into generated files (#3600)

Version 7.0.0-alpha03

2026-05-14

Common

• Security: Reject negative lengths when skipping groups in Java/Kotlin, so crafted protobuf payloads throw ProtocolException instead of unchecked runtime exceptions (#3597, [GHSA-7xpr-hc2w-34m9][GHSA-7xpr-hc2w-34m9], reported by [TrekLaps][TrekLaps])

Version 6.3.0

2026-05-13

Common

... (truncated)

Commits

• efbbc29 Prepare for release 6.4.5.
• 082d5d8 Prevent overflow for 32-bit length integers
• See full diff in compare view

Updates com.squareup.wire:wire-schema from 6.4.1 to 6.4.5

Changelog

Sourced from com.squareup.wire:wire-schema's changelog.

Version 6.4.5

2026-06-29

Common

• Security: Reject oversized lengths and fixed-width values that exceed the current reader limit in Java/Kotlin and Swift runtimes (#3635, [GHSA-9rm7-3qhh-h2mc][GHSA-9rm7-3qhh-h2mc] reported by Ta Duc Thien and Duc Anh Nguyen)

Version 6.4.4

2026-06-23

Common

• Security: Reject negative lengths when skipping groups in Swift, so crafted protobuf payloads throw ProtocolException instead of unchecked runtime exceptions (#3616, [GHSA-86wm-r4c5-2rc9][GHSA-86wm-r4c5-2rc9], reported by [tonghuaroot][tonghuaroot])

Version 6.4.0

2026-05-15

Common

• Security: Escape comment delimiters in generated documentation for Java, Kotlin, and Swift, preventing malicious proto documentation from injecting source code into generated files (#3600)

Version 7.0.0-alpha03

2026-05-14

Common

• Security: Reject negative lengths when skipping groups in Java/Kotlin, so crafted protobuf payloads throw ProtocolException instead of unchecked runtime exceptions (#3597, [GHSA-7xpr-hc2w-34m9][GHSA-7xpr-hc2w-34m9], reported by [TrekLaps][TrekLaps])

Version 6.3.0

2026-05-13

Common

... (truncated)

Commits

• efbbc29 Prepare for release 6.4.5.
• 082d5d8 Prevent overflow for 32-bit length integers
• See full diff in compare view

Updates com.squareup.wire:wire-schema from 6.4.1 to 6.4.5

Changelog

Sourced from com.squareup.wire:wire-schema's changelog.

Version 6.4.5

2026-06-29

Common

• Security: Reject oversized lengths and fixed-width values that exceed the current reader limit in Java/Kotlin and Swift runtimes (#3635, [GHSA-9rm7-3qhh-h2mc][GHSA-9rm7-3qhh-h2mc] reported by Ta Duc Thien and Duc Anh Nguyen)

Version 6.4.4

2026-06-23

Common

• Security: Reject negative lengths when skipping groups in Swift, so crafted protobuf payloads throw ProtocolException instead of unchecked runtime exceptions (#3616, [GHSA-86wm-r4c5-2rc9][GHSA-86wm-r4c5-2rc9], reported by [tonghuaroot][tonghuaroot])

Version 6.4.0

2026-05-15

Common

• Security: Escape comment delimiters in generated documentation for Java, Kotlin, and Swift, preventing malicious proto documentation from injecting source code into generated files (#3600)

Version 7.0.0-alpha03

2026-05-14

Common

• Security: Reject negative lengths when skipping groups in Java/Kotlin, so crafted protobuf payloads throw ProtocolException instead of unchecked runtime exceptions (#3597, [GHSA-7xpr-hc2w-34m9][GHSA-7xpr-hc2w-34m9], reported by [TrekLaps][TrekLaps])

Version 6.3.0

2026-05-13

Common

... (truncated)

Commits

• efbbc29 Prepare for release 6.4.5.
• 082d5d8 Prevent overflow for 32-bit length integers
• See full diff in compare view

Updates tools.jackson:jackson-bom from 3.2.1 to 3.2.2

Commits

• 719429d [maven-release-plugin] prepare release jackson-bom-3.2.2
• d0b9877 Prep for 3.2.2 release
• e32f526 Merge branch '3.1' into 3.2
• 113f6a1 Post-release dep version bump
• 46176f6 [maven-release-plugin] prepare for next development iteration
• 8b4a513 [maven-release-plugin] prepare release jackson-bom-3.1.6
• adeda6f Prep for 3.1.6 release
• c3a4deb Merge branch '3.1' into 3.2
• 3c74470 Merge branch '2.x' into 3.1
• 06416ba Merge pull request #129 from FasterXML/tatu/2.23/woodstox-7.2.2
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions