From d1303b0d414504d6988dee2f062548b4391c83fa Mon Sep 17 00:00:00 2001
From: Morgan Kleene <mkleene@virtru.com>
Date: Fri, 25 Sep 2026 16:49:44 -0400
Subject: [PATCH 1/3] update dependencies

---
 examples/pom.xml |  1 -
 pom.xml          | 33 ++++++++++++++++++++++++++++-----
 sdk/pom.xml      |  3 +--
 3 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/examples/pom.xml b/examples/pom.xml
index 61ca5bef..01645e44 100644
--- a/examples/pom.xml
+++ b/examples/pom.xml
@@ -53,7 +53,6 @@
     <dependency>
       <groupId>com.google.code.gson</groupId>
       <artifactId>gson</artifactId>
-      <version>2.11.0</version> 
     </dependency>
     <dependency>
         <groupId>org.apache.logging.log4j</groupId>
diff --git a/pom.xml b/pom.xml
index 6a121d5d..9dc0670b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,8 +14,8 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.release>11</maven.compiler.release>
         <log4j.version>2.20.0</log4j.version>
-        <grpc.version>1.75.0</grpc.version>
-        <protobuf.version>4.29.2</protobuf.version>
+        <grpc.version>1.78.0</grpc.version>
+        <protobuf.version>4.36.2</protobuf.version>
         <!-- 1.84 patches GHSA-c3fc-8qff-9hwx and GHSA-p93r-85wp-75v3 (open in 1.82). -->
         <bouncycastle.version>1.84</bouncycastle.version>
         <bc-fips.version>2.1.2</bc-fips.version>
@@ -90,12 +90,12 @@
             <dependency>
                 <groupId>com.google.errorprone</groupId>
                 <artifactId>error_prone_annotations</artifactId>
-                <version>2.30.0</version>
+                <version>2.50.0</version>
             </dependency>
             <dependency>
                 <groupId>com.google.guava</groupId>
                 <artifactId>guava</artifactId>
-                <version>33.3.1-android</version>
+                <version>33.7.1-jre</version>
             </dependency>
             <dependency>
                 <groupId>com.google.protobuf</groupId>
@@ -161,6 +161,16 @@
                 <artifactId>byte-buddy-agent</artifactId>
                 <version>${bytebuddy.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.google.code.gson</groupId>
+                <artifactId>gson</artifactId>
+                <version>2.14.0</version>
+            </dependency>
+            <dependency>
+                <groupId>org.jspecify</groupId>
+                <artifactId>jspecify</artifactId>
+                <version>1.0.1</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
@@ -306,15 +316,21 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
                 <inherited>true</inherited>
+                <version>3.6.3</version>
                 <configuration>
                     <failFast>false</failFast>
                     <rules>
+                        <banDuplicateClasses>
+                            <findAllDuplicates>true</findAllDuplicates>
+                            <ignoreWhenIdentical>true</ignoreWhenIdentical>
+                            <findAllDuplicates>true</findAllDuplicates>
+                        </banDuplicateClasses>
                         <requireMavenVersion>
                             <version>3.6.0</version>
                             <level>ERROR</level>
                         </requireMavenVersion>
                         <requireJavaVersion>
-                            <version>${maven.compiler.target}</version>
+                            <version>${maven.compiler.release}</version>
                             <level>WARN</level>
                         </requireJavaVersion>
                         <dependencyConvergence/>
@@ -325,6 +341,13 @@
                         <reactorModuleConvergence/>
                     </rules>
                 </configuration>
+                <dependencies>
+                    <dependency>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>extra-enforcer-rules</artifactId>
+                        <version>1.12.1</version>
+                    </dependency>
+                </dependencies>
                 <executions>
                     <execution>
                         <id>enforce-maven</id>
diff --git a/sdk/pom.xml b/sdk/pom.xml
index 66f461c1..b1fbf506 100644
--- a/sdk/pom.xml
+++ b/sdk/pom.xml
@@ -39,7 +39,6 @@
         <dependency>
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
-            <version>2.11.0</version>
         </dependency>
         <dependency>
             <groupId>com.vdurmont</groupId>
@@ -59,7 +58,7 @@
         <dependency>
             <groupId>build.buf</groupId>
             <artifactId>protovalidate</artifactId>
-            <version>0.1.9</version>
+            <version>1.3.0</version>
             <scope>compile</scope>
         </dependency>
         <!-- Networking Dependencies -->

From 4ef2ca7bda0f1ae295b612930a2645a37e8b66cd Mon Sep 17 00:00:00 2001
From: Morgan Kleene <mkleene@virtru.com>
Date: Fri, 25 Sep 2026 17:02:09 -0400
Subject: [PATCH 2/3] stop using nonstandard null annotation

---
 sdk/src/test/java/io/opentdf/platform/sdk/PemTestUtils.java | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/sdk/src/test/java/io/opentdf/platform/sdk/PemTestUtils.java b/sdk/src/test/java/io/opentdf/platform/sdk/PemTestUtils.java
index 0b7bb62c..78c2e6de 100644
--- a/sdk/src/test/java/io/opentdf/platform/sdk/PemTestUtils.java
+++ b/sdk/src/test/java/io/opentdf/platform/sdk/PemTestUtils.java
@@ -1,7 +1,6 @@
 package io.opentdf.platform.sdk;
 
-import org.checkerframework.checker.nullness.qual.NonNull;
-
+import javax.annotation.Nonnull;
 import java.io.ByteArrayInputStream;
 import java.math.BigInteger;
 import java.nio.charset.StandardCharsets;
@@ -107,7 +106,7 @@ private static ECPoint decodePoint(byte[] data, EllipticCurve curve) {
                 + Integer.toHexString(prefix) + ", length=" + data.length);
     }
 
-    private static @NonNull BigInteger getY(EllipticCurve curve, BigInteger x, int prefix) {
+    private static @Nonnull BigInteger getY(EllipticCurve curve, BigInteger x, int prefix) {
         BigInteger p = ((ECFieldFp) curve.getField()).getP();
         // y^2 = x^3 + a*x + b (mod p); valid for all NIST P-curves we support.
         BigInteger rhs = x.modPow(BigInteger.valueOf(3), p)

From 8a4a007bda78438296030cdcf73ac799456d3f8e Mon Sep 17 00:00:00 2001
From: Morgan Kleene <mkleene@virtru.com>
Date: Fri, 25 Sep 2026 17:21:29 -0400
Subject: [PATCH 3/3] Remove redundant findAllDuplicates configuration

---
 pom.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 9dc0670b..26b55ba6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -321,7 +321,6 @@
                     <failFast>false</failFast>
                     <rules>
                         <banDuplicateClasses>
-                            <findAllDuplicates>true</findAllDuplicates>
                             <ignoreWhenIdentical>true</ignoreWhenIdentical>
                             <findAllDuplicates>true</findAllDuplicates>
                         </banDuplicateClasses>