Update Gitiles dependencies

This area was overdue for attention, there are many bugs filed
about out-of-date Gitiles dependencies.

Google uses its internal build system to build Gitiles, and we
experience friction in updating internally, since we need to update
not just Gitiles, but all internal uses of that dependency. With
AI assistance I updated WORKSPACE library versions to match the
ones Google is using, if Google is using a newer version.

All of these updates involve stable APIs, no source file updates
were required.

Updating commons-compress added a new dependency on commons-io,
so added that (thanks to David for finding that, Diffy for the
win!)

Testing was to run `bazel test //...`, run the `tools/run.dev`
script and test localhost, and run `tools/maven/mvn.sh install`.

I compared these updated versions with the versions in the JGit
and Gerrit projects. All permutations are now there--Gitiles uses
a more recent version than the other two, JGit does, and Gerrit
does. I can run the same update on JGit and Gerrit once this
change is in.

+------------------------+-------------------+--------------------+
| Library                | Old Version       | New Version        |
+------------------------+-------------------+--------------------+
| ASM (OW2)              | 9.2               | 9.9.1              |
| Autolink               | 0.10.0            | 0.11.0             |
| Byte Buddy             | 1.14.9            | 1.18.2             |
| Commonmark             | 0.21.0            | 0.24.0             |
| Commons Codec          | 1.16.0            | 1.18.0             |
| Commons Compress       | 1.25.0            | 1.28.0             |
| Commons IO             | <none>            | 2.21.0             |
| Commons Lang3          | 3.8.1             | 3.18.0             |
| Commons Text           | 1.2               | 1.10.0             |
| Diffutils              | 1.3.0             | 4.16               |
| Error Prone Annot.     | 2.22.0            | 2.46.0             |
| Gson                   | 2.10.1            | 2.13.2             |
| Guava                  | 32.1.2-jre        | 33.5.0-jre         |
| Guava Failureaccess    | 1.0.1             | 1.0.3              |
| Hamcrest               | 2.2               | 3.0                |
| ICU4J                  | 74.2              | 78.2               |
| Jetty                  | 9.4.53.v20231009  | 9.4.57.v20241219   |
| Junit                  | 4.12              | 4.13.2             |
| Mockito                | 5.6.0             | 5.21.0             |
| Objenesis              | 2.6               | 3.0.1              |
| Protobuf               | 3.19.4            | 3.25.5             |
| SLF4J                  | 1.7.36            | 2.0.17             |
| Servlet API            | 3.1.0             | 4.0.1              |
| Truth                  | 1.1               | 1.4.4              |
| XZ                     | 1.9               | 1.11               |
+------------------------+-------------------+--------------------+

Release-Notes: Stabilize WORKSPACE dependencies and fix checksums.
Change-Id: Ic7dc1c8e96e8c1b26c80d259fb0b194ae4fc41f8
diff --git a/WORKSPACE b/WORKSPACE
index c9e9953..050e19e 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -39,44 +39,50 @@
 
 maven_jar(
     name = "error-prone-annotations",
-    artifact = "com.google.errorprone:error_prone_annotations:2.22.0",
-    sha1 = "bfb9e4281a4cea34f0ec85b3acd47621cfab35b4",
+    artifact = "com.google.errorprone:error_prone_annotations:2.46.0",
+    sha1 = "4ecb5d2392c38c46e6cb65e1bf60be708d97005d",
 )
 
 maven_jar(
     name = "commons-codec",
-    artifact = "commons-codec:commons-codec:1.16.0",
-    sha1 = "4e3eb3d79888d76b54e28b350915b5dc3919c9de",
+    artifact = "commons-codec:commons-codec:1.18.0",
+    sha1 = "ee45d1cf6ec2cc2b809ff04b4dc7aec858e0df8f",
 )
 
 maven_jar(
     name = "commons-lang3",
-    artifact = "org.apache.commons:commons-lang3:3.8.1",
-    sha1 = "6505a72a097d9270f7a9e7bf42c4238283247755",
+    artifact = "org.apache.commons:commons-lang3:3.18.0",
+    sha1 = "fb14946f0e39748a6571de0635acbe44e7885491",
 )
 
 maven_jar(
     name = "commons-text",
-    artifact = "org.apache.commons:commons-text:1.2",
-    sha1 = "74acdec7237f576c4803fff0c1008ab8a3808b2b",
+    artifact = "org.apache.commons:commons-text:1.10.0",
+    sha1 = "3363381aef8cef2dbc1023b3e3a9433b08b64e01",
+)
+
+maven_jar(
+    name = "commons-io",
+    artifact = "commons-io:commons-io:2.21.0",
+    sha1 = "52a6f68fe5afe335cde95461dd5c3412f04996f7",
 )
 
 maven_jar(
     name = "gson",
-    artifact = "com.google.code.gson:gson:2.10.1",
-    sha1 = "b3add478d4382b78ea20b1671390a858002feb6c",
+    artifact = "com.google.code.gson:gson:2.13.2",
+    sha1 = "48b8230771e573b54ce6e867a9001e75977fe78e",
 )
 
 maven_jar(
     name = "guava",
-    artifact = "com.google.guava:guava:32.1.2-jre",
-    sha1 = "5e64ec7e056456bef3a4bc4c6fdaef71e8ab6318",
+    artifact = "com.google.guava:guava:33.5.0-jre",
+    sha1 = "8699de25f2f979108d6c1b804a7ba38cda1116bc",
 )
 
 maven_jar(
     name = "guava-failureaccess",
-    artifact = "com.google.guava:failureaccess:1.0.1",
-    sha1 = "1dcf1de382a0bf95a3d8b0849546c88bac1292c9",
+    artifact = "com.google.guava:failureaccess:1.0.3",
+    sha1 = "aeaffd00d57023a2c947393ed251f0354f0985fc",
 )
 
 maven_jar(
@@ -86,56 +92,56 @@
     sha1 = "f7be08ec23c21485b9b5a1cf1654c2ec8c58168d",
 )
 
-COMMONMARK_VERSION = "0.21.0"
+COMMONMARK_VERSION = "0.24.0"
 
 # When upgrading commonmark it should also be updated in plugins/gitiles
 maven_jar(
     name = "commonmark",
     artifact = "org.commonmark:commonmark:" + COMMONMARK_VERSION,
-    sha1 = "c98f0473b17c87fe4fa2fc62a7c6523a2fe018f0",
+    sha1 = "59af01016ece382b55b4acb6a5190b08879c637c",
 )
 
 maven_jar(
     name = "cm-autolink",
     artifact = "org.commonmark:commonmark-ext-autolink:" + COMMONMARK_VERSION,
-    sha1 = "55c0312cf443fa3d5af0daeeeca00d6deee3cf90",
+    sha1 = "703e28852088ff1b4b3a06622416fd807147bd84",
 )
 
 maven_jar(
     name = "autolink",
-    artifact = "org.nibor.autolink:autolink:0.10.0",
-    sha1 = "6579ea7079be461e5ffa99f33222a632711cc671",
+    artifact = "org.nibor.autolink:autolink:0.11.0",
+    sha1 = "32abc7854d5801d19ff16be92362fa4c511d9a70",
 )
 
 maven_jar(
     name = "gfm-strikethrough",
     artifact = "org.commonmark:commonmark-ext-gfm-strikethrough:" + COMMONMARK_VERSION,
-    sha1 = "953f4b71e133a98fcca93f3c3f4e58b895b76d1f",
+    sha1 = "9e9c1e5b50340643099d52c6b841f60fb6f54c27",
 )
 
 maven_jar(
     name = "gfm-tables",
     artifact = "org.commonmark:commonmark-ext-gfm-tables:" + COMMONMARK_VERSION,
-    sha1 = "fb7d65fa89a4cfcd2f51535d2549b570cf1dbd1a",
+    sha1 = "8a30c4e89ce33450c47604325751bec613bce541",
 )
 
 maven_jar(
     name = "servlet-api",
-    artifact = "javax.servlet:javax.servlet-api:3.1.0",
-    sha1 = "3cd63d075497751784b2fa84be59432f4905bf7c",
+    artifact = "javax.servlet:javax.servlet-api:4.0.1",
+    sha1 = "a27082684a2ff0bf397666c3943496c44541d1ca",
 )
 
 maven_jar(
     name = "truth",
-    artifact = "com.google.truth:truth:1.1",
-    sha1 = "6a096a16646559c24397b03f797d0c9d75ee8720",
+    artifact = "com.google.truth:truth:1.4.4",
+    sha1 = "33810058273a2a3b6ce6d1f8c8621bfc85493f67",
 )
 
 # Indirect dependency of truth
 maven_jar(
     name = "diffutils",
-    artifact = "com.googlecode.java-diff-utils:diffutils:1.3.0",
-    sha1 = "7e060dd5b19431e6d198e91ff670644372f60fbd",
+    artifact = "io.github.java-diff-utils:java-diff-utils:4.16",
+    sha1 = "cca1e7dc2460d0afeebc3fc4a3386eadede08c5a",
 )
 
 maven_jar(
@@ -184,14 +190,14 @@
 
 maven_jar(
     name = "protobuf",
-    artifact = "com.google.protobuf:protobuf-java:3.19.4",
-    sha1 = "748e4e0b9e4fa6b9b1fe65690aa04a9db56cfc4d",
+    artifact = "com.google.protobuf:protobuf-java:3.25.5",
+    sha1 = "5ae5c9ec39930ae9b5a61b32b93288818ec05ec1",
 )
 
 maven_jar(
     name = "icu4j",
-    artifact = "com.ibm.icu:icu4j:74.2",
-    sha1 = "97222d018f7f43cae88cacd1fad39717b001ffc4",
+    artifact = "com.ibm.icu:icu4j:78.2",
+    sha1 = "31b9d9a35d283432d0ce1a8b6e2631dcfd046ab8",
 )
 
 maven_jar(
@@ -204,143 +210,144 @@
 # corresponding version
 maven_jar(
     name = "commons-compress",
-    artifact = "org.apache.commons:commons-compress:1.25.0",
-    sha1 = "9d35aec423da6c8a7f93d7e9e1c6b1d9fe14bb5e",
+    artifact = "org.apache.commons:commons-compress:1.28.0",
+    sha1 = "e482f2c7a88dac3c497e96aa420b6a769f59c8d7",
 )
 
 # Transitive dependency of commons_compress. Should only be
 # upgraded at the same time as commons_compress.
 maven_jar(
     name = "tukaani-xz",
-    artifact = "org.tukaani:xz:1.9",
+    artifact = "org.tukaani:xz:1.11",
     attach_source = False,
-    sha1 = "1ea4bec1a921180164852c65006d928617bd2caf",
+    sha1 = "bdfd1774efb216f506f4f3c5b08c205b308c50aa",
 )
 
 maven_jar(
     name = "junit",
-    artifact = "junit:junit:4.12",
-    sha1 = "2973d150c0dc1fefe998f834810d68f278ea58ec",
+    artifact = "junit:junit:4.13.2",
+    sha1 = "8ac9e16d933b6fb43bc7f576336b8f4d7eb5ba12",
 )
 
 maven_jar(
     name = "hamcrest",
-    artifact = "org.hamcrest:hamcrest:2.2",
-    sha1 = "1820c0968dba3a11a1b30669bb1f01978a91dedc",
+    artifact = "org.hamcrest:hamcrest:3.0",
+    sha1 = "8fd9b78a8e6a6510a078a9e30e9e86a6035cfaf7",
 )
 
 maven_jar(
     name = "mockito",
-    artifact = "org.mockito:mockito-core:5.6.0",
-    sha1 = "550b7a0eb22e1d72d33dcc2e5ef6954f73100d76",
+    artifact = "org.mockito:mockito-core:5.21.0",
+    sha1 = "121287b8287464a5a7af2e47d5dbc49ca38a892f",
 )
 
-BYTE_BUDDY_VERSION = "1.14.9"
+BYTE_BUDDY_VERSION = "1.18.2"
 
 maven_jar(
     name = "bytebuddy",
     artifact = "net.bytebuddy:byte-buddy:" + BYTE_BUDDY_VERSION,
-    sha1 = "b69e7fff6c473d3ed2b489cdfd673a091fd94226",
+    sha1 = "7ac991b4bd502e2567efcdecc0d2e9b3f7dd3859",
 )
 
 maven_jar(
     name = "bytebuddy-agent",
     artifact = "net.bytebuddy:byte-buddy-agent:" + BYTE_BUDDY_VERSION,
-    sha1 = "dfb8707031008535048bad2b69735f46d0b6c5e5",
+    sha1 = "62f38a6faf7f069d661b79a07d566f504b0b20c4",
 )
 
 maven_jar(
     name = "objenesis",
-    artifact = "org.objenesis:objenesis:2.6",
-    sha1 = "639033469776fd37c08358c6b92a4761feb2af4b",
+    artifact = "org.objenesis:objenesis:3.0.1",
+    sha1 = "11cfac598df9dc48bb9ed9357ed04212694b7808",
 )
 
-SL_VERS = "1.7.36"
+SL_VERS = "2.0.17"
 
 maven_jar(
     name = "log-api",
     artifact = "org.slf4j:slf4j-api:" + SL_VERS,
-    sha1 = "6c62681a2f655b49963a5983b8b0950a6120ae14",
+    sha1 = "d9e58ac9c7779ba3bf8142aff6c830617a7fe60f",
 )
 
 maven_jar(
     name = "slf4j-simple",
     artifact = "org.slf4j:slf4j-simple:" + SL_VERS,
-    sha1 = "a41f9cfe6faafb2eb83a1c7dd2d0dfd844e2a936",
+    sha1 = "9872a3fd794ffe7b18d17747926a64d61526ca96",
 )
 
-JETTY_VERSION = "9.4.53.v20231009"
+JETTY_VERSION = "9.4.57.v20241219"
 
 maven_jar(
     name = "servlet",
     artifact = "org.eclipse.jetty:jetty-servlet:" + JETTY_VERSION,
-    sha1 = "6670d6a54cdcaedd8090e8cf420fd5dd7d08e859",
+    sha1 = "3e648eebddbf5ad0c0f7698e50c6a69c4a77fd95",
 )
 
 maven_jar(
     name = "security",
     artifact = "org.eclipse.jetty:jetty-security:" + JETTY_VERSION,
-    sha1 = "6fbc8ebe9046954dc2f51d4ba69c8f8344b05f7f",
+    sha1 = "2b545f68d45b947fdc6e279a0e8ae3630ec10e05",
 )
 
 maven_jar(
     name = "server",
     artifact = "org.eclipse.jetty:jetty-server:" + JETTY_VERSION,
-    sha1 = "8b0e761a0b359db59dae77c00b4213b0586cb994",
+    sha1 = "ad3baf52b98b4a32f5714fe2e58ac0e502b4e4d8",
 )
 
 maven_jar(
     name = "continuation",
     artifact = "org.eclipse.jetty:jetty-continuation:" + JETTY_VERSION,
-    sha1 = "eb200267a81425a77fe140689939e0e65c673e20",
+    sha1 = "c2bf5c810049fe23945f737a3c4743da81baa62d",
 )
 
 maven_jar(
     name = "http",
     artifact = "org.eclipse.jetty:jetty-http:" + JETTY_VERSION,
-    sha1 = "87faf21eb322753f0527bcb88c43e67044786369",
+    sha1 = "c7a3a9c599346708894cf355e03105937f45f427",
 )
 
 maven_jar(
     name = "io",
     artifact = "org.eclipse.jetty:jetty-io:" + JETTY_VERSION,
-    sha1 = "70cf7649b27c964ad29bfddf58f3bfe0d30346cf",
+    sha1 = "bd0ca6e5c4314972cd91f427fa09dedfe3b84ff5",
 )
 
 maven_jar(
     name = "util",
     artifact = "org.eclipse.jetty:jetty-util:" + JETTY_VERSION,
-    sha1 = "f72bb4f687b4454052c6f06528ba9910714df947",
+    sha1 = "7bf7ea75644ac064199e1e32c66ccd312239f2dc",
 )
 
-OW2_VERS = "9.2"
+OW2_VERS = "9.9.1"
 
 maven_jar(
     name = "ow2-asm",
     artifact = "org.ow2.asm:asm:" + OW2_VERS,
-    sha1 = "81a03f76019c67362299c40e0ba13405f5467bff",
+    sha1 = "2ceea6ab43bcae1979b2a6d85fc0ca429877e5ab",
 )
 
 maven_jar(
     name = "ow2-asm-analysis",
     artifact = "org.ow2.asm:asm-analysis:" + OW2_VERS,
-    sha1 = "7487dd756daf96cab9986e44b9d7bcb796a61c10",
+    sha1 = "1ab8d9316ef7a67240087919a708246c37ed1660",
 )
 
 maven_jar(
     name = "ow2-asm-commons",
     artifact = "org.ow2.asm:asm-commons:" + OW2_VERS,
-    sha1 = "f4d7f0fc9054386f2893b602454d48e07d4fbead",
+    sha1 = "ab35de4c537184a09339069f1a3b3aacf2289149",
 )
 
 maven_jar(
     name = "ow2-asm-tree",
     artifact = "org.ow2.asm:asm-tree:" + OW2_VERS,
-    sha1 = "d96c99a30f5e1a19b0e609dbb19a44d8518ac01e",
+    sha1 = "b6b1b3366296163b4b1f540731aad0a2baa484d8",
 )
 
 maven_jar(
     name = "ow2-asm-util",
     artifact = "org.ow2.asm:asm-util:" + OW2_VERS,
-    sha1 = "fbc178fc5ba3dab50fd7e8a5317b8b647c8e8946",
+    sha1 = "e51f5b0ae0b0c1960687ae970a2a3434d39d8abb",
 )
+
diff --git a/javatests/com/google/gitiles/BUILD b/javatests/com/google/gitiles/BUILD
index e7576a5..692537d 100644
--- a/javatests/com/google/gitiles/BUILD
+++ b/javatests/com/google/gitiles/BUILD
@@ -43,6 +43,7 @@
         ":testutil",
         "//lib:servlet-api",
         "//lib:commons-codec",
+        "//lib:commons-io",
         "//lib/truth",
         "//lib:jgit-junit",
         "//lib/junit",
diff --git a/lib/BUILD b/lib/BUILD
index c763f24..6a25509 100644
--- a/lib/BUILD
+++ b/lib/BUILD
@@ -11,6 +11,7 @@
     "autolink",
     "commonmark",
     "commons-codec",
+    "commons-io",
     "commons-lang3",
     "commons-text",
     "cm-autolink",