While gson version was updated to 2.0.9 to fix the following issue:
GHSA-4jrv-ppp4-jm57
through ab93da9
the latest release
https://github.com/tabulapdf/tabula-java/releases/tag/v1.0.5
still has the vulnerable version.
Would it be ok asking for a new release of tabula-java?