I upgraded the POI dependency to 3.5-beta4.
Note that if we want to use the new Office XML support in POI 3.5 we probably also need to add some of the extra XML dependencies. Any NOTICE and LICENSE changes related to POI 3.5 and potential other dependencies should be reviewed before our next release.
There's a problem with a GPLv3 file being included in the HDGF part of POI that we use for text extraction from Visio diagrams. I filed a bug for that (see https://issues.apache.org/bugzilla/show_bug.cgi?id=46361) and I think we need to find some resolution to the issue before our next release.