From 615b850160d5f60b360d92a7e9c277319b346d35 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 08:04:44 +0000
Subject: [PATCH 1/2] ci: Bump com.google.guava:guava from 32.1.2-jre to
 33.7.1-jre in /java

Bumps [com.google.guava:guava](https://github.com/google/guava) from 32.1.2-jre to 33.7.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 java/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/pom.xml b/java/pom.xml
index 579ebddacb..4e3cfa5779 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -77,7 +77,7 @@
     <!-- Remote resource NOTICE years use this timestamp, not the build date. -->
     <project.build.outputTimestamp>2026-01-01T00:00:00Z</project.build.outputTimestamp>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-    <guava.version>32.1.2-jre</guava.version>
+    <guava.version>33.7.1-jre</guava.version>
     <janino.version>3.1.12</janino.version>
     <jsr305.version>3.0.2</jsr305.version>
     <slf4j.version>2.0.12</slf4j.version>

From 445e8104fa67f9f98d9a0926f62a955b09ac2e7b Mon Sep 17 00:00:00 2001
From: chaokunyang <shawn.ck.yang@gmail.com>
Date: Mon, 2 Nov 2026 11:30:20 +0800
Subject: [PATCH 2/2] fix(java): declare JSR-305 annotation dependencies

---
 java/fory-core/pom.xml | 5 +++++
 java/fory-json/pom.xml | 5 +++++
 java/pom.xml           | 5 +++++
 3 files changed, 15 insertions(+)

diff --git a/java/fory-core/pom.xml b/java/fory-core/pom.xml
index 09e73814fb..1ed5d5b662 100644
--- a/java/fory-core/pom.xml
+++ b/java/fory-core/pom.xml
@@ -56,6 +56,11 @@
       <artifactId>guava</artifactId>
       <optional>true</optional>
     </dependency>
+    <dependency>
+      <groupId>com.google.code.findbugs</groupId>
+      <artifactId>jsr305</artifactId>
+      <scope>provided</scope>
+    </dependency>
     <dependency>
       <groupId>org.codehaus.janino</groupId>
       <artifactId>janino</artifactId>
diff --git a/java/fory-json/pom.xml b/java/fory-json/pom.xml
index e72ed21722..0b35c9e922 100644
--- a/java/fory-json/pom.xml
+++ b/java/fory-json/pom.xml
@@ -63,6 +63,11 @@
       <artifactId>guava</artifactId>
       <optional>true</optional>
     </dependency>
+    <dependency>
+      <groupId>com.google.code.findbugs</groupId>
+      <artifactId>jsr305</artifactId>
+      <scope>provided</scope>
+    </dependency>
   </dependencies>
 
   <build>
diff --git a/java/pom.xml b/java/pom.xml
index 4e3cfa5779..d81cb4810d 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -177,6 +177,11 @@
         <artifactId>guava</artifactId>
         <version>${guava.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.code.findbugs</groupId>
+        <artifactId>jsr305</artifactId>
+        <version>${jsr305.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.codehaus.janino</groupId>
         <artifactId>janino</artifactId>