Bump commons-io from 2.8.0 to 2.9.0