NIFI-16245 - Bump Spring to 7.0.9, Spring Security to 7.1.1, Guava to 33.7.1-jre, and others

[pvillard31]

Summary

NIFI-16245 - Bump Spring to 7.0.9, Spring Security to 7.1.1, Guava to 33.7.1-jre, and others

Important - note to be added in migration guidance:

Apache Tika has been upgraded to version 4.0.0. This upgrade can change metadata produced by ExtractMediaMetadata and character encodings reported by IdentifyMimeType. In particular, some text content previously identified as ISO-8859-1 can now be identified as windows-1252, and metadata attribute names for some media formats, including BMP and WAV, have changed. Review downstream flows that depend on exact mime.charset values or Tika-generated metadata attribute names.

• Protobuf from 4.35.1 to 4.36.0 - https://github.com/protocolbuffers/protobuf/releases/tag/v36.0
• Guava from 33.7.0-jre to 33.7.1-jre - https://github.com/google/guava/releases/tag/v33.7.1
• RabbitMQ AMQP Client from 5.34.0 to 5.35.0 - https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0
• Elasticsearch client from 9.5.1 to 9.5.2 - https://github.com/elastic/elasticsearch-java/releases/tag/v9.5.2
• Spring Integration from 7.1.0 to 7.1.1 - https://github.com/spring-projects/spring-integration/releases/tag/v7.1.1
• Spring Data Redis from 4.0.6 to 4.1.1 - https://github.com/spring-projects/spring-data-redis/releases/tag/4.1.1
• Spring LDAP from 4.1.0 to 4.1.1 - https://github.com/spring-projects/spring-ldap/releases/tag/4.1.1
• Spring Boot from 4.1.0 to 4.1.1 - https://github.com/spring-projects/spring-boot/releases/tag/v4.1.1
• Spring Security from 7.1.0 to 7.1.1 - https://github.com/spring-projects/spring-security/releases/tag/7.1.1
• Spring from 7.0.8 to 7.0.9 - https://github.com/spring-projects/spring-framework/releases/tag/v7.0.9
• Greenmail from 2.1.12 to 2.1.13 - https://github.com/greenmail-mail-test/greenmail/releases/tag/release-2.1.13
• Apache Tika from 3.3.2 to 4.0.0 - https://github.com/apache/tika/releases/tag/4.0.0
• HiveMQ MQTT Client from 1.3.17 to 1.4.0 - https://github.com/hivemq/hivemq-mqtt-client/releases/tag/v1.4.0
• JSON Schema Validator from 2.0.4 to 2.0.7 - https://github.com/networknt/json-schema-validator/releases/tag/2.0.7
• SMBJ from 0.14.0 to 0.15.0 - https://github.com/hierynomus/smbj/releases/tag/v0.15.0
• Javassist from 3.32.0-GA to 3.33.0-GA - https://github.com/jboss-javassist/javassist/releases/tag/rel_3_33_0_ga
• AWS SDK from 2.54.0 to 2.54.2 - https://github.com/aws/aws-sdk-java-v2/releases/tag/2.54.2

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000
• Pull request contains commits signed with a registered key indicating Verified status

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

• Build completed using ./mvnw clean install -P contrib-check
  • JDK 21
  • JDK 25

Licensing

• New dependencies are compatible with the Apache License 2.0 according to the License Policy
• New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

• Documentation formatting appears as expected in rendered files

[dan-s1]

It looks like there are changes from Redis 4.0.6 to 4.1.1

2026-08-24T14:22:51.4824216Z ##[warning][WARNING] /home/runner/work/nifi/nifi/nifi-extension-bundles/nifi-redis-bundle/nifi-redis-extensions/src/main/java/org/apache/nifi/redis/service/SimpleRedisDistributedMapCacheClientService.java:[152,121] [deprecation] SetOption in RedisStringCommands has been deprecated
2026-08-24T14:22:51.4904582Z ##[warning][WARNING] /home/runner/work/nifi/nifi/nifi-extension-bundles/nifi-redis-bundle/nifi-redis-extensions/src/main/java/org/apache/nifi/redis/service/SimpleRedisDistributedMapCacheClientService.java:[152,44] [deprecation] set(byte[],byte[],Expiration,SetOption) in RedisStringCommands has been deprecated

[pvillard31]

Done, thanks @dan-s1

[exceptionfactory]

Thanks for the upgrades and adjustments @pvillard31, and thanks for the review @dan-s1, looks good!