Shall we change `IOUtils.toBytesArray` to Guava's `ByteStreams.toByteArray`? So we can remove `commons-io` from our dependencies. Guava is better at maintaining API compatibility across versions.