From 168a969147ea77a6fe8f12fa15c6bc25b1e671f2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:21:57 +0200
Subject: [PATCH 01/76] MINOR: Bump io.netty:netty-bom from 4.2.10.Final to
 4.2.12.Final (#1091)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.10.Final to 4.2.12.Final.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netty/netty/releases">io.netty:netty-bom's
releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.12.Final</h2>
<h2>What's Changed</h2>
<ul>
<li>Revert &quot;Eliminate redundant bounds checks in CompositeByteBuf
accessors&quot; by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16550">netty/netty#16550</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netty/netty/compare/netty-4.2.11.Final...netty-4.2.12.Final">https://github.com/netty/netty/compare/netty-4.2.11.Final...netty-4.2.12.Final</a></p>
<h2>netty-4.2.11.Final</h2>
<h2>Security</h2>
<ul>
<li>CVE-2026-33871, <a
href="https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv">HTTP/2
CONTINUATION Frame Flood Denial of Service</a></li>
<li>CVE-2026-33870, <a
href="https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8">HTTP
Request Smuggling via Chunked Extension Quoted-String Parsing</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Update to latest JDK 26 EA release by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16230">netty/netty#16230</a></li>
<li>HTTP3: Allow to support non-standard HTTP3 settings by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16171">netty/netty#16171</a></li>
<li>Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry
loop by <a
href="https://github.com/adwsingh"><code>@​adwsingh</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16245">netty/netty#16245</a></li>
<li>Allocate one large segment and slice for each MsgHdrMemory by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16234">netty/netty#16234</a></li>
<li>Make RefCntOpenSslContext.deallocate more robust by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16253">netty/netty#16253</a></li>
<li>Epoll: Fix excessive CPU usage when Channel is only registered but
no… by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16250">netty/netty#16250</a></li>
<li>Update to gcc for arm 10.3-2021.07 by <a
href="https://github.com/m1ngyuan"><code>@​m1ngyuan</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16255">netty/netty#16255</a></li>
<li>Add acmeIdentifier extension support to pkitesting by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16256">netty/netty#16256</a></li>
<li>Update JDK versions to latest patch releases by <a
href="https://github.com/m1ngyuan"><code>@​m1ngyuan</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16254">netty/netty#16254</a></li>
<li>Avoid allocation in HttpObjectEncoder.addEncodedLengthHex method by
<a href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16241">netty/netty#16241</a></li>
<li>Automatic backporting workflow from 4.1 to 4.2 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16269">netty/netty#16269</a></li>
<li>Revert &quot;Automatic backporting workflow from 4.1 to 4.2&quot; by
<a href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in
<a
href="https://redirect.github.com/netty/netty/pull/16270">netty/netty#16270</a></li>
<li>HTTP2: Correctly account for padding when decompress by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16264">netty/netty#16264</a></li>
<li>Automatic backporting workflow from 4.1 to 4.2 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16271">netty/netty#16271</a></li>
<li>Automatic backporting workflow from 4.1 to 4.2 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16273">netty/netty#16273</a></li>
<li>Backport PRs must be created with personal access tokens by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16276">netty/netty#16276</a></li>
<li>Expose QuicSslContextBuilder::sni by <a
href="https://github.com/ZeroErrors"><code>@​ZeroErrors</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16178">netty/netty#16178</a></li>
<li>Add more porting workflows by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16275">netty/netty#16275</a></li>
<li>Add more porting workflows by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16283">netty/netty#16283</a></li>
<li>Remove the unpooled allocator from test permutations by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16282">netty/netty#16282</a></li>
<li>Some polishing of the porting workflows by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16288">netty/netty#16288</a></li>
<li>Allow to set destination connection id when creating a client side
QuicheChannel by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16286">netty/netty#16286</a></li>
<li>Update to latest JDK26 EA build by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16295">netty/netty#16295</a></li>
<li>Add javadoc to clarify responsibility of the user when generating
the remote connection id by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16293">netty/netty#16293</a></li>
<li>Make the build run faster by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16290">netty/netty#16290</a></li>
<li>Fix IDE warnings in SslHandler by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16237">netty/netty#16237</a></li>
<li>Decrease Long allocations and map.put calls in
ReferenceCountedOpenSllEngine in handshake() method by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16242">netty/netty#16242</a></li>
<li>Support boringssl SSLCredential API by <a
href="https://github.com/jmcrawford45"><code>@​jmcrawford45</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/15919">netty/netty#15919</a></li>
<li>Fix high-order bit aliasing in HttpUtil.validateToken by <a
href="https://github.com/furkanvarol"><code>@​furkanvarol</code></a> in
<a
href="https://redirect.github.com/netty/netty/pull/16279">netty/netty#16279</a></li>
<li>Improve multi-byte access performance when UNALIGNED availability is
unknown by <a
href="https://github.com/Songdoeon"><code>@​Songdoeon</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16207">netty/netty#16207</a></li>
<li>Avoid unnecessary SSL.getVersion() call and string allocation in
ReferenceCountedOpenSslEngine by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16278">netty/netty#16278</a></li>
<li>Support more branch freedom for auto-porting by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16300">netty/netty#16300</a></li>
<li>fix: the precedence of + is higher than &gt;&gt; by <a
href="https://github.com/cuiweixie"><code>@​cuiweixie</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16312">netty/netty#16312</a></li>
<li>AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater
than byteBuf.maxCapacity() by <a
href="https://github.com/laosijikaichele"><code>@​laosijikaichele</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16309">netty/netty#16309</a></li>
<li>Fix flaky PooledByteBufAllocatorTest by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16313">netty/netty#16313</a></li>
<li>Fix pooled arena accounting tests by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16321">netty/netty#16321</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netty/netty/commit/67ce541e4692853e24fc506466960db35bb64914"><code>67ce541</code></a>
[maven-release-plugin] prepare release netty-4.2.12.Final</li>
<li><a
href="https://github.com/netty/netty/commit/7074624644b79f4e97081bd58a58ed135962b8c2"><code>7074624</code></a>
Revert &quot;Eliminate redundant bounds checks in CompositeByteBuf
accessors&quot; (<a
href="https://redirect.github.com/netty/netty/issues/16">#16</a>...</li>
<li><a
href="https://github.com/netty/netty/commit/c3b0a43442dbf84e3eb161d5f252623f832f1579"><code>c3b0a43</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://github.com/netty/netty/commit/c94a8180e749f694fb76963dd494bae17c31aff6"><code>c94a818</code></a>
[maven-release-plugin] prepare release netty-4.2.11.Final</li>
<li><a
href="https://github.com/netty/netty/commit/3b76df185678353733aa21702d6be16130d188a0"><code>3b76df1</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/aae944a19eb036993fc47c4b40639476f519deaf"><code>aae944a</code></a>
Auto-port 4.2: Limit the number of Continuation frames per HTTP2 Headers
(<a
href="https://redirect.github.com/netty/netty/issues/16">#16</a>...</li>
<li><a
href="https://github.com/netty/netty/commit/60014996491c41d91c26f80bca096610f34fc858"><code>6001499</code></a>
Eliminate redundant bounds checks in CompositeByteBuf accessors (<a
href="https://redirect.github.com/netty/netty/issues/16525">#16525</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/a7fbb6f84625ef29733a1506ed3520e3c21d5247"><code>a7fbb6f</code></a>
JdkZlibDecoder: accumulate decompressed output before firing channelRead
(<a
href="https://redirect.github.com/netty/netty/issues/16">#16</a>...</li>
<li><a
href="https://github.com/netty/netty/commit/7937553d8f49e17b064f57b1414907aed8e3be3d"><code>7937553</code></a>
Enforce io.netty.maxDirectMemory accounting on all Java versions (<a
href="https://redirect.github.com/netty/netty/issues/16489">#16489</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/893ea2ea6c35c9e1812e5d331530b88d8690022b"><code>893ea2e</code></a>
Allocate less in QueryStringDecoder.addParam for typical use case (<a
href="https://redirect.github.com/netty/netty/issues/16527">#16527</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netty/netty/compare/netty-4.2.10.Final...netty-4.2.12.Final">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.netty:netty-bom&package-manager=maven&previous-version=4.2.10.Final&new-version=4.2.12.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 863169b47b..61b5b3f0b2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
     <dep.junit.jupiter.version>5.12.2</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.17</dep.slf4j.version>
     <dep.guava-bom.version>33.5.0-jre</dep.guava-bom.version>
-    <dep.netty-bom.version>4.2.10.Final</dep.netty-bom.version>
+    <dep.netty-bom.version>4.2.12.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.79.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.21.2</dep.jackson-bom.version>

From 89fa995eac2aa84e0195341bff601dfce66b942e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:22:13 +0200
Subject: [PATCH 02/76] MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.34 to
 11.37 (#1096)

Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.34 to 11.37.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt">com.nimbusds:oauth2-oidc-sdk's
changelog</a>.</em></p>
<blockquote>
<p>version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.</p>
<p>version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.</p>
<p>version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.</p>
<p>version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).</p>
<p>version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.</p>
<p>version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.</p>
<p>version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.</p>
<p>version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.</p>
<p>version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.</p>
<p>version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.</p>
<p>version 2.9 (2013-09-17)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/d98de1ab39f699e39903967775abc242fc064e78"><code>d98de1a</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/2ea716f29401515a656c73bef9d66d5860270b2f"><code>2ea716f</code></a>
Shortens InvalidClientException messages</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/ed5773c5a3383a4c5af5f8484aad2864dc1b79c6"><code>ed5773c</code></a>
TokenRevocationRequest receives custom form parameters support</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/e133559f00d1469a5da284cfdbb30d4d0102e3be"><code>e133559</code></a>
Updates tests for shortened InvalidClientException messages</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/fe43e1f129febee53c0a15178b08b6e835bcd460"><code>fe43e1f</code></a>
[maven-release-plugin] prepare release 11.35</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/73224c9422c0ebb3c1a3b5387aac2d529d8bef5b"><code>73224c9</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/f3f728613feb023640801faf33873d55f6c2ec98"><code>f3f7286</code></a>
Adds static JSONObjectUtils.getNonNegativeLong methods</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/d6899e0554d630956dd09e3d2ba1236ee66d2bd6"><code>d6899e0</code></a>
Cleans up JSONObjectUtils.getEnum(net.minidev.json.JSONObject,
java.lang.Stri...</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/9b05d23a876550842e75c1abff08795ac825b9a0"><code>9b05d23</code></a>
Adds non-negative checks when parsing Date instances from Unix
timestamps (is...</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/592d8f4e82e7815966258c114b66834b9b4c9e6c"><code>592d8f4</code></a>
Adds &quot;acr&quot; and &quot;auth_time&quot; parameter (RFC 9470)
support to TokenIntrospection...</li>
<li>Additional commits viewable in <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.37..11.34">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.nimbusds:oauth2-oidc-sdk&package-manager=maven&previous-version=11.34&new-version=11.37)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index ffeff12462..483c019cdc 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -182,7 +182,7 @@ under the License.
     <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>oauth2-oidc-sdk</artifactId>
-      <version>11.34</version>
+      <version>11.37</version>
     </dependency>
 
   </dependencies>

From 4297733dae36ca83234a239b25068db775a09743 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:30:50 +0200
Subject: [PATCH 03/76] MINOR: Bump com.gradle:develocity-maven-extension from
 2.3.4 to 2.4.0 (#1095)

Bumps com.gradle:develocity-maven-extension from 2.3.4 to 2.4.0.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:develocity-maven-extension&package-manager=maven&previous-version=2.3.4&new-version=2.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .mvn/extensions.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index 4585435b49..f52dfafb4a 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -23,7 +23,7 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>develocity-maven-extension</artifactId>
-        <version>2.3.4</version>
+        <version>2.4.0</version>
     </extension>
     <extension>
         <groupId>com.gradle</groupId>

From 447372ce4caa5a53387018861e3ea9d1f7be795c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:57:29 +0200
Subject: [PATCH 04/76] MINOR: Bump
 com.google.api.grpc:proto-google-common-protos from 2.66.0 to 2.67.0 (#1092)

Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.66.0 to 2.67.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/sdk-platform-java/releases">com.google.api.grpc:proto-google-common-protos's
releases</a>.</em></p>
<blockquote>
<h2>v2.67.0</h2>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.1...v2.67.0">2.67.0</a>
(2026-02-18)</h2>
<h3>Features</h3>
<ul>
<li><strong>observability:</strong> introduce minimal tracing
implementation (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4105">#4105</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/e4e5e893e7a62bd12528e7d448dc2789f71946eb">e4e5e89</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgrade Google-Auth-Library to v1.43.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4114">#4114</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/825298b6bf225bb8536ecab9d788f82f3f8eec4d">825298b</a>)</li>
<li>Upgrade grpc to 1.76.3 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4106">#4106</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/c6555f5f0cd85683db76394271e1f57989cac7d0">c6555f5</a>)</li>
</ul>
<h2>v2.66.1</h2>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.0...v2.66.1">2.66.1</a>
(2026-02-04)</h2>
<h3>Documentation</h3>
<ul>
<li>[common-protos] update reference documentation for
<code>SelectionInput.DROPDOWN</code> to include dynamic data sources and
autosuggestion (<a
href="https://github.com/googleapis/sdk-platform-java/commit/9960262cf248400836c04063e6a701bec2aca1ba">9960262</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/sdk-platform-java/blob/main/CHANGELOG.md">com.google.api.grpc:proto-google-common-protos's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.1...v2.67.0">2.67.0</a>
(2026-02-18)</h2>
<h3>Features</h3>
<ul>
<li><strong>observability:</strong> introduce minimal tracing
implementation (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4105">#4105</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/e4e5e893e7a62bd12528e7d448dc2789f71946eb">e4e5e89</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgrade Google-Auth-Library to v1.43.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4114">#4114</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/825298b6bf225bb8536ecab9d788f82f3f8eec4d">825298b</a>)</li>
<li>Upgrade grpc to 1.76.3 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4106">#4106</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/c6555f5f0cd85683db76394271e1f57989cac7d0">c6555f5</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.0...v2.66.1">2.66.1</a>
(2026-02-04)</h2>
<h3>Documentation</h3>
<ul>
<li>[common-protos] update reference documentation for
<code>SelectionInput.DROPDOWN</code> to include dynamic data sources and
autosuggestion (<a
href="https://github.com/googleapis/sdk-platform-java/commit/9960262cf248400836c04063e6a701bec2aca1ba">9960262</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/50d2af33e055075693b8ee14cc8a2da107320144"><code>50d2af3</code></a>
chore(main): release 2.67.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4107">#4107</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/ffb6b02f9711d247204fce57d98d5f0fb974bf39"><code>ffb6b02</code></a>
chore(deps): update upper bound dependencies file (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4112">#4112</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/825298b6bf225bb8536ecab9d788f82f3f8eec4d"><code>825298b</code></a>
deps: Upgrade Google-Auth-Library to v1.43.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4114">#4114</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/3fa1ca3ffa0e4d103e2812bd5c29547b7e4d6410"><code>3fa1ca3</code></a>
chore: update googleapis commit at Thu Feb 5 03:00:22 UTC 2026 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4104">#4104</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/e4e5e893e7a62bd12528e7d448dc2789f71946eb"><code>e4e5e89</code></a>
feat(observability): introduce minimal tracing implementation (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4105">#4105</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/c6555f5f0cd85683db76394271e1f57989cac7d0"><code>c6555f5</code></a>
deps: Upgrade grpc to 1.76.3 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4106">#4106</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/117c390d24a734aafb0f994ded30a054c6eed901"><code>117c390</code></a>
chore(main): release 2.66.2-SNAPSHOT (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4102">#4102</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/ff33367579969c7ce65dd84a505f8d91b8ba67fd"><code>ff33367</code></a>
tests: Upgrade logback to 1.5.25 in tests (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4103">#4103</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/a4d8c44b60f3285244afbff7ef2cbfe032947688"><code>a4d8c44</code></a>
tests: Remove 3.25.8 from protobuf compatibility testing (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4101">#4101</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/3b280a3d65bc45368536e715a4fa6c04ddbfff66"><code>3b280a3</code></a>
chore(main): release 2.66.1 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4100">#4100</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.0...v2.67.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.google.api.grpc:proto-google-common-protos&package-manager=maven&previous-version=2.66.0&new-version=2.67.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index 92490dd67b..5c6c3378c1 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>proto-google-common-protos</artifactId>
-      <version>2.66.0</version>
+      <version>2.67.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 0703021c8315a55651b6f7446da8cc781f039f72 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 14:56:30 +0200
Subject: [PATCH 05/76] MINOR: Bump org.apache:apache from 33 to 37 (#1033)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [org.apache:apache](https://github.com/apache/maven-apache-parent)
from 33 to 37.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/maven-apache-parent/releases">org.apache:apache's
releases</a>.</em></p>
<blockquote>
<h2>Apache Parent POM version 37</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li>Disable parallel PUT on release (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/566">#566</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
</ul>
<h2>Apache Parent POM version 36</h2>
<!-- raw HTML omitted -->
<h2>:boom: Breaking changes</h2>
<ul>
<li>Update minimum maven version to match current stable version (3.6.3
-&gt; 3.9) (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/533">#533</a>)
<a
href="https://github.com/DomGarguilo"><code>@​DomGarguilo</code></a></li>
<li>Introduce javaVersion property for maven.compiler.* configuration
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/551">#551</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li>Switch JDK &gt;= 9 to only use maven.compiler.release (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/543">#543</a>)
<a href="https://github.com/gnodet"><code>@​gnodet</code></a></li>
</ul>
<h2>🚀 New features and improvements</h2>
<ul>
<li>Update minimum maven version to match current stable version (3.6.3
-&gt; 3.9) (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/533">#533</a>)
<a
href="https://github.com/DomGarguilo"><code>@​DomGarguilo</code></a></li>
<li>Introduce javaVersion property for maven.compiler.* configuration
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/551">#551</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li>Switch JDK &gt;= 9 to only use maven.compiler.release (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/543">#543</a>)
<a href="https://github.com/gnodet"><code>@​gnodet</code></a></li>
<li>Add default specification and implementation for javadoc and source
manifest entries (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/548">#548</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
</ul>
<h2>📝 Documentation updates</h2>
<ul>
<li>Clarify how to use Apache Snapshot repository (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/558">#558</a>)
<a href="https://github.com/kwin"><code>@​kwin</code></a></li>
<li>activate Fluido skin's anchorJs (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/553">#553</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
</ul>
<h2>👻 Maintenance</h2>
<ul>
<li>Avoid - WARNING: Use of the three-letter time zone ID ... on JDK 25
for RAT plugin (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/562">#562</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li>feat: enable prevent branch protection rules (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/535">#535</a>)
<a href="https://github.com/sebtiem"><code>@​sebtiem</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>Bump org.apache.maven.plugins:maven-release-plugin from 3.3.0 to
3.3.1 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/565">#565</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-release-plugin from 3.2.0 to
3.3.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/559">#559</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to
3.4.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/557">#557</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to
3.8.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/556">#556</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-war-plugin from 3.5.0 to 3.5.1
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/555">#555</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-resources-plugin from 3.3.1 to
3.4.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/554">#554</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/552">#552</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Upgrade maven-release-plugin to version 3.2.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/549">#549</a>)
<a href="https://github.com/kwin"><code>@​kwin</code></a></li>
<li>Bump org.apache.maven.plugins:maven-dependency-plugin from 3.8.1 to
3.9.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/542">#542</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-war-plugin from 3.4.0 to 3.5.0
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/546">#546</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump version.maven-plugin-tools from 3.15.1 to 3.15.2 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/547">#547</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-antrun-plugin from 3.1.0 to
3.2.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/545">#545</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.1 to
3.6.2 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/541">#541</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-scm-plugin from 2.1.0 to 2.2.1
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/540">#540</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-ear-plugin from 3.3.0 to 3.4.0
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/527">#527</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.3 to
3.12.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/538">#538</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.0 to
3.14.1 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/539">#539</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/apache/maven-apache-parent/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache:apache&package-manager=maven&previous-version=33&new-version=37)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 bom/pom.xml | 2 +-
 pom.xml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index e4ccee02db..267dcef73c 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -23,7 +23,7 @@ under the License.
   <parent>
     <groupId>org.apache</groupId>
     <artifactId>apache</artifactId>
-    <version>33</version>
+    <version>37</version>
     <relativePath></relativePath>
   </parent>
 
diff --git a/pom.xml b/pom.xml
index 61b5b3f0b2..25d49a0704 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@ under the License.
   <parent>
     <groupId>org.apache</groupId>
     <artifactId>apache</artifactId>
-    <version>35</version>
+    <version>37</version>
   </parent>
 
   <groupId>org.apache.arrow</groupId>

From e54681b80e84573f4cb6e7fdcb77b4247768965f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 16:20:40 +0200
Subject: [PATCH 06/76] MINOR: Bump com.diffplug.spotless:spotless-maven-plugin
 from 2.44.4 to 3.4.0 (#1088)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 2.44.4 to 3.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/diffplug/spotless/releases">com.diffplug.spotless:spotless-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>Maven Plugin v3.4.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>tableTest</code> format type for standalone
<code>.table</code> files. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2880">#2880</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Bump default <code>tabletest-formatter</code> version
<code>1.0.1</code> -&gt; <code>1.1.1</code>, now works with Java 17+.
(<a
href="https://redirect.github.com/diffplug/spotless/pull/2880">#2880</a>)</li>
</ul>
<h2>Lib v3.3.1</h2>
<h3>Fixed</h3>
<ul>
<li><code>GitPrePushHookInstaller</code> didn't work on windows, now
fixed. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2562">#2562</a>)</li>
</ul>
<h2>Lib v3.3.0</h2>
<h3>Added</h3>
<ul>
<li>Allow specifying path to Biome JSON config file directly in
<code>biome</code> step. Requires biome 2.x. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2548">#2548</a>)</li>
<li><code>GitPrePushHookInstaller</code>, a reusable library component
for installing a Git <code>pre-push</code> hook that runs formatter
checks. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2553">#2553</a>)</li>
<li>Allow setting Eclipse XML config from a string, not only from files
(<a
href="https://redirect.github.com/diffplug/spotless/pull/2361">#2361</a>)</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Bump default <code>gson</code> version to latest <code>2.11.0</code>
-&gt; <code>2.13.1</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2414">#2414</a>)</li>
<li>Bump default <code>jackson</code> version to latest
<code>2.18.1</code> -&gt; <code>2.19.2</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2558">#2558</a>)</li>
<li>Bump default <code>gherkin-utils</code> version to latest
<code>9.0.0</code> -&gt; <code>9.2.0</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2408">#2408</a>)</li>
<li>Bump default <code>cleanthat</code> version to latest
<code>2.22</code> -&gt; <code>2.23</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2556">#2556</a>)</li>
</ul>
<h2>Maven Plugin v3.3.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>tabletest-formatter</code> support for Java and Kotlin.
(<a
href="https://redirect.github.com/diffplug/spotless/pull/2860">#2860</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix the ability to specify a wildcard version (<code>*</code>) for
external formatter executables, which did not work. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2848">#2848</a>)</li>
<li>[fix] <code>ConcurrentModificationException</code> in
<code>expandWildcardImports</code> (<a
href="https://redirect.github.com/diffplug/spotless/issues/2830">#2830</a>)</li>
</ul>
<h2>Maven Plugin v3.2.1</h2>
<h3>Fixed</h3>
<ul>
<li><code>removeSemicolons()</code> should not be applied to multiline
strings in groovy <a
href="https://redirect.github.com/diffplug/spotless/issues/2780">#2780</a>
(<a
href="https://redirect.github.com/diffplug/spotless/issues/2792">#2792</a>)</li>
</ul>
<h2>Lib v3.2.0</h2>
<h3>Added</h3>
<ul>
<li>Support for <code>idea</code> (<a
href="https://redirect.github.com/diffplug/spotless/pull/2020">#2020</a>,
<a
href="https://redirect.github.com/diffplug/spotless/pull/2535">#2535</a>)</li>
<li>Add support for removing wildcard imports via
<code>removeWildcardImports</code> step. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2517">#2517</a>)</li>
<li>scalafmt: enforce version consistency between the version configured
in Spotless and the version declared in Scalafmt config file (<a
href="https://redirect.github.com/diffplug/spotless/issues/2460">#2460</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>SortPom</code> disable expandEmptyElements, to avoid empty
body warnings. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2520">#2520</a>)</li>
<li>Fix biome formatter for new major release 2.x of biome (<a
href="https://redirect.github.com/diffplug/spotless/pull/2537">#2537</a>)</li>
<li>Make sure npm-based formatters use the correct
<code>node_modules</code> directory when running in parallel. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2542">#2542</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Bump internal dependencies for npm-based formatters (<a
href="https://redirect.github.com/diffplug/spotless/pull/2542">#2542</a>)</li>
</ul>
<h2>Maven Plugin v3.2.0</h2>
<h3>Added</h3>
<ul>
<li>Add the ability to specify a wildcard version (<code>*</code>) for
external formatter executables. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2757">#2757</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Dramatic (~100x) performance improvement when using git
<code>ratchetFrom</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2805">#2805</a>)</li>
</ul>
<h3>Fixed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/diffplug/spotless/commit/708a1b0e6383ad2dd34cf3def185bb085a786789"><code>708a1b0</code></a>
Published maven/3.4.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/1cc0163c25b52824cd57b56cdcb8c4cb0c7b4795"><code>1cc0163</code></a>
Published gradle/8.4.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/a4cd808f6092c6ed9371205de4af5285beea9533"><code>a4cd808</code></a>
Published lib/4.5.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/9066bf6ede907e913fbe30259de0763f1b0b55ea"><code>9066bf6</code></a>
Add links to the changelog.</li>
<li><a
href="https://github.com/diffplug/spotless/commit/db8dc1cc8e83b18ef357a0e660f03556fd792247"><code>db8dc1c</code></a>
Fix for illegal mutation issue with <code>predeclareDeps</code> (<a
href="https://redirect.github.com/diffplug/spotless/issues/2892">#2892</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/0eb98a9574304e362f0ca6ddbfb71617de46df75"><code>0eb98a9</code></a>
chore: Updated gradle plugin change</li>
<li><a
href="https://github.com/diffplug/spotless/commit/3f7f12e649b1085a7937b8730e6a7689a52ca6da"><code>3f7f12e</code></a>
chore: Removes check for predeclare as it's not needed anymore</li>
<li><a
href="https://github.com/diffplug/spotless/commit/55c0c5c081b83ad35e92911718e3069a64467c2a"><code>55c0c5c</code></a>
fix: IsolatedProjectTest.predeclaredIsUnsupported() is now actually
supported...</li>
<li><a
href="https://github.com/diffplug/spotless/commit/47489afd92aa79f56372bd53e82d09a44f606a32"><code>47489af</code></a>
fix: avoid IllegalMutationException when root project uses
predeclareDeps() w...</li>
<li><a
href="https://github.com/diffplug/spotless/commit/4010e8b42c32b8dfac31a988c6820b6b0ef499bd"><code>4010e8b</code></a>
test: Introduce a test harnessing predeclared deps</li>
<li>Additional commits viewable in <a
href="https://github.com/diffplug/spotless/compare/maven/2.44.4...maven/3.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.diffplug.spotless:spotless-maven-plugin&package-manager=maven&previous-version=2.44.4&new-version=3.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré <jbonofre@apache.org>
Co-authored-by: JB Onofré <jb.onofre@dremio.com>
---
 bom/pom.xml                             |  8 ++++----
 flight/flight-integration-tests/pom.xml |  2 +-
 flight/flight-sql-jdbc-driver/pom.xml   |  2 +-
 memory/memory-core/pom.xml              |  4 ++--
 performance/pom.xml                     |  6 +++---
 pom.xml                                 | 14 +++++++-------
 tools/pom.xml                           |  2 +-
 7 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 267dcef73c..d97cc291c2 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -24,7 +24,7 @@ under the License.
     <groupId>org.apache</groupId>
     <artifactId>apache</artifactId>
     <version>37</version>
-    <relativePath></relativePath>
+    <relativePath/>
   </parent>
 
   <groupId>org.apache.arrow</groupId>
@@ -78,7 +78,7 @@ under the License.
   </issueManagement>
 
   <properties>
-    <arrow.vector.classifier></arrow.vector.classifier>
+    <arrow.vector.classifier/>
     <!-- org.apache:apache overrides -->
     <minimalJavaBuildVersion>17</minimalJavaBuildVersion>
     <maven.compiler.source>17</maven.compiler.source>
@@ -208,7 +208,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>2.44.4</version>
+          <version>3.4.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
@@ -235,7 +235,7 @@ under the License.
               <file>${maven.multiModuleProjectDirectory}/dev/license/asf-xml.license</file>
               <delimiter>(&lt;configuration|&lt;project)</delimiter>
             </licenseHeader>
-            <sortPom></sortPom>
+            <sortPom/>
           </pom>
         </configuration>
         <executions>
diff --git a/flight/flight-integration-tests/pom.xml b/flight/flight-integration-tests/pom.xml
index ec81162e59..f6ae8e16a5 100644
--- a/flight/flight-integration-tests/pom.xml
+++ b/flight/flight-integration-tests/pom.xml
@@ -101,7 +101,7 @@ under the License.
                 </filter>
               </filters>
               <transformers>
-                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"></transformer>
+                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                 <transformer implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
                   <resource>META-INF/LICENSE.txt</resource>
                   <file>src/shade/LICENSE.txt</file>
diff --git a/flight/flight-sql-jdbc-driver/pom.xml b/flight/flight-sql-jdbc-driver/pom.xml
index 55de7221ec..ff5763702b 100644
--- a/flight/flight-sql-jdbc-driver/pom.xml
+++ b/flight/flight-sql-jdbc-driver/pom.xml
@@ -138,7 +138,7 @@ under the License.
                 </relocation>
               </relocations>
               <transformers>
-                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"></transformer>
+                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                 <transformer implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
                   <resource>META-INF/LICENSE.txt</resource>
                   <file>src/shade/LICENSE.txt</file>
diff --git a/memory/memory-core/pom.xml b/memory/memory-core/pom.xml
index 1c7b6f8834..825b3dae4b 100644
--- a/memory/memory-core/pom.xml
+++ b/memory/memory-core/pom.xml
@@ -100,8 +100,8 @@ under the License.
             <phase>test</phase>
             <configuration>
               <!-- Do not inherit the default add-opens flag and excludes -->
-              <argLine combine.self="override"></argLine>
-              <excludes combine.self="override"></excludes>
+              <argLine combine.self="override"/>
+              <excludes combine.self="override"/>
               <includes>
                 <include>**/TestOpens.java</include>
               </includes>
diff --git a/performance/pom.xml b/performance/pom.xml
index 413d5ba1e0..d994bff45b 100644
--- a/performance/pom.xml
+++ b/performance/pom.xml
@@ -35,10 +35,10 @@ under the License.
     <skip.perf.benchmarks>true</skip.perf.benchmarks>
     <benchmark.filter>.*</benchmark.filter>
     <benchmark.forks>1</benchmark.forks>
-    <benchmark.jvmargs></benchmark.jvmargs>
+    <benchmark.jvmargs/>
     <benchmark.warmups>5</benchmark.warmups>
     <benchmark.runs>5</benchmark.runs>
-    <benchmark.list></benchmark.list>
+    <benchmark.list/>
     <benchmark.resultfile>jmh-result.json</benchmark.resultfile>
     <benchmark.resultformat>json</benchmark.resultformat>
   </properties>
@@ -143,7 +143,7 @@ under the License.
           <executable>java</executable>
           <arguments>
             <argument>-classpath</argument>
-            <classpath></classpath>
+            <classpath/>
             <argument>org.openjdk.jmh.Main</argument>
             <argument>${benchmark.filter}</argument>
             <argument>-f</argument>
diff --git a/pom.xml b/pom.xml
index 25d49a0704..06cb916b45 100644
--- a/pom.xml
+++ b/pom.xml
@@ -107,7 +107,7 @@ under the License.
     <dep.avro.version>1.12.1</dep.avro.version>
     <dep.parquet.version>1.17.0</dep.parquet.version>
     <dep.mockito-bom.version>5.23.0</dep.mockito-bom.version>
-    <arrow.vector.classifier></arrow.vector.classifier>
+    <arrow.vector.classifier/>
     <forkCount>2</forkCount>
     <checkstyle.version>10.23.0</checkstyle.version>
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
@@ -374,7 +374,7 @@ under the License.
                     </goals>
                   </pluginExecutionFilter>
                   <action>
-                    <ignore></ignore>
+                    <ignore/>
                   </action>
                 </pluginExecution>
                 <pluginExecution>
@@ -387,7 +387,7 @@ under the License.
                     </goals>
                   </pluginExecutionFilter>
                   <action>
-                    <ignore></ignore>
+                    <ignore/>
                   </action>
                 </pluginExecution>
                 <pluginExecution>
@@ -400,7 +400,7 @@ under the License.
                     </goals>
                   </pluginExecutionFilter>
                   <action>
-                    <ignore></ignore>
+                    <ignore/>
                   </action>
                 </pluginExecution>
                 <pluginExecution>
@@ -413,7 +413,7 @@ under the License.
                     </goals>
                   </pluginExecutionFilter>
                   <action>
-                    <ignore></ignore>
+                    <ignore/>
                   </action>
                 </pluginExecution>
                 <pluginExecution>
@@ -492,7 +492,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>2.44.4</version>
+          <version>3.4.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
@@ -734,7 +734,7 @@ under the License.
               <file>${maven.multiModuleProjectDirectory}/dev/license/asf-xml.license</file>
               <delimiter>(&lt;configuration|&lt;project)</delimiter>
             </licenseHeader>
-            <sortPom></sortPom>
+            <sortPom/>
           </pom>
           <java>
             <googleJavaFormat>
diff --git a/tools/pom.xml b/tools/pom.xml
index 64634b9abe..b4d64fd435 100644
--- a/tools/pom.xml
+++ b/tools/pom.xml
@@ -126,7 +126,7 @@ under the License.
                 </filter>
               </filters>
               <transformers>
-                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"></transformer>
+                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                 <transformer implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
                   <resource>META-INF/LICENSE.txt</resource>
                   <file>src/shade/LICENSE.txt</file>

From d8ad7b6765620c4f3f3078ee87c3d2cfb7423945 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 17:41:35 +0900
Subject: [PATCH 07/76] MINOR: [CI] Bump docker/login-action from 4.0.0 to
 4.1.0 (#1103)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [docker/login-action](https://github.com/docker/login-action) from
4.0.0 to 4.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<ul>
<li>Fix scoped Docker Hub cleanup path when registry is omitted by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1020.0 in <a
href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a>
<a
href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li>
<li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a
href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li>
<li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li>
<li>Bump flatted from 3.3.3 to 3.4.2 in <a
href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li>
<li>Bump glob from 10.3.12 to 10.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li>
<li>Bump handlebars from 4.7.8 to 4.7.9 in <a
href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li>
<li>Bump lodash from 4.17.23 to 4.18.1 in <a
href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li>
<li>Bump minimatch from 3.1.2 to 3.1.5 in <a
href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li>
<li>Bump picomatch from 4.0.3 to 4.0.4 in <a
href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li>
<li>Bump undici from 6.23.0 to 6.24.1 in <a
href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/4907a6ddec9925e35a0a9e82d7399ccc52663121"><code>4907a6d</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/930">#930</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li>
<li><a
href="https://github.com/docker/login-action/commit/1e233e691a8881d7f35ca7c2d5dfaaed80b39636"><code>1e233e6</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/6c24ead68057f18c30c808a431f0b85dc25663cb"><code>6c24ead</code></a>
build(deps): bump the aws-sdk-dependencies group with 2 updates</li>
<li><a
href="https://github.com/docker/login-action/commit/ee034d70944e3546349cd24295914f139342f1e6"><code>ee034d7</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/958">#958</a>
from docker/dependabot/npm_and_yarn/lodash-4.18.1</li>
<li><a
href="https://github.com/docker/login-action/commit/1527209db9734bd2352a2dc1a63d79c9aa5358bb"><code>1527209</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/937">#937</a>
from docker/dependabot/npm_and_yarn/proxy-agent-depen...</li>
<li><a
href="https://github.com/docker/login-action/commit/d39362aba4d72f8d9d93e0962119840690133e1b"><code>d39362a</code></a>
build(deps): bump lodash from 4.17.23 to 4.18.1</li>
<li><a
href="https://github.com/docker/login-action/commit/a6f092b568105cbb6d9deb7e55e0a4c5c1025fce"><code>a6f092b</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/60953f0bed2120ec69659d271fe18d34bc069779"><code>60953f0</code></a>
build(deps): bump the proxy-agent-dependencies group with 2 updates</li>
<li><a
href="https://github.com/docker/login-action/commit/62c688590fb4ab6c6e89a217ced0a7b2ddcf1340"><code>62c6885</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/936">#936</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/login-action/commit/102c0e672992d2e992c89b6f4808d65a353b5a1a"><code>102c0e6</code></a>
chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/b45d80f862d83dbcd57f89517bcf500b2ab88fb2...4907a6ddec9925e35a0a9e82d7399ccc52663121">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.0.0&new-version=4.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/rc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 9c75b8c807..8f52d54bd6 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
-      - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

From 13c8b9353b80f553e720ff50fce0cb103de87c55 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 14:23:37 +0200
Subject: [PATCH 08/76] MINOR: Bump checker.framework.version from 3.54.0 to
 3.55.1 (#1105)

Bumps `checker.framework.version` from 3.54.0 to 3.55.1.
Updates `org.checkerframework:checker-qual` from 3.54.0 to 3.55.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker-qual's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 3.55.1</h2>
<h2>Version 3.55.1 (2026-04-03)</h2>
<p>No user-visible changes.</p>
<h2>Checker Framework 3.54.1</h2>
<h2>Version 3.55.0 (2026-04-02)</h2>
<h3>User-visible changes</h3>
<p>The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.</p>
<p>Removed deprecated command-line option <code>-AskipDirs</code>; use
<code>-AskipFiles</code>.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeMirror</code>:</p>
<ul>
<li>Renamed <code>getEffectiveAnnotation*()</code> to
<code>getAnnotation*()</code>.</li>
<li>Renamed <code>hasEffectiveAnnotation*()</code> to
<code>hasAnnotation*()</code>.</li>
</ul>
<p>Removed deprecated method
<code>ObjectCreationNode.getConstructor()</code>; use
<code>getTypeToInstantiate()</code>.</p>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7079">#7079</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7489">#7489</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7539">#7539</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker-qual's
changelog</a>.</em></p>
<blockquote>
<h2>Version 3.55.1 (2026-04-03)</h2>
<p>No user-visible changes.</p>
<h2>Version 3.55.0 (2026-04-02)</h2>
<h3>User-visible changes</h3>
<p>The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.</p>
<p>Removed deprecated command-line option <code>-AskipDirs</code>; use
<code>-AskipFiles</code>.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeMirror</code>:</p>
<ul>
<li>Renamed <code>getEffectiveAnnotation*()</code> to
<code>getAnnotation*()</code>.</li>
<li>Renamed <code>hasEffectiveAnnotation*()</code> to
<code>hasAnnotation*()</code>.</li>
</ul>
<p>Removed deprecated method
<code>ObjectCreationNode.getConstructor()</code>; use
<code>getTypeToInstantiate()</code>.</p>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7079">#7079</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7489">#7489</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7539">#7539</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/bf4ceb7660825e275f8c7561056310c47d48b81b"><code>bf4ceb7</code></a>
new release 3.55.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/b8096660563a2349201e126c362c2000de20c1c5"><code>b809666</code></a>
Remove unneeded argument</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/448019e7d43607b0d1d23e94baae0cd937e0219b"><code>448019e</code></a>
Make scripts executable in .zip file</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/3bc1190be960534f1c5536ab74b760198ff5e70a"><code>3bc1190</code></a>
Update directory copying</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/22df6d61a52c4183401d2fa355a59645c16feca3"><code>22df6d6</code></a>
Update release date</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/3fc441bc5df12983f716282aeebaf8f6b934bfe6"><code>3fc441b</code></a>
Note about permissions</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6baaa5287134b9e616cbcbc40a413f21d498e1a1"><code>6baaa52</code></a>
Brevity</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/d4ea6b993144c91992077e864c8cbf07ee929dac"><code>d4ea6b9</code></a>
Set version number to 3.55.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6b03e94dcf412a24859cf5ac9d17c2a4de65d978"><code>6b03e94</code></a>
Improve release instructions</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/65613a0f0f05d39d74b36c40ba6ca398e1929157"><code>65613a0</code></a>
Fix Nullness extra tests</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-3.54.0...checker-framework-3.55.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.checkerframework:checker` from 3.54.0 to 3.55.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 3.55.1</h2>
<h2>Version 3.55.1 (2026-04-03)</h2>
<p>No user-visible changes.</p>
<h2>Checker Framework 3.54.1</h2>
<h2>Version 3.55.0 (2026-04-02)</h2>
<h3>User-visible changes</h3>
<p>The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.</p>
<p>Removed deprecated command-line option <code>-AskipDirs</code>; use
<code>-AskipFiles</code>.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeMirror</code>:</p>
<ul>
<li>Renamed <code>getEffectiveAnnotation*()</code> to
<code>getAnnotation*()</code>.</li>
<li>Renamed <code>hasEffectiveAnnotation*()</code> to
<code>hasAnnotation*()</code>.</li>
</ul>
<p>Removed deprecated method
<code>ObjectCreationNode.getConstructor()</code>; use
<code>getTypeToInstantiate()</code>.</p>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7079">#7079</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7489">#7489</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7539">#7539</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker's
changelog</a>.</em></p>
<blockquote>
<h2>Version 3.55.1 (2026-04-03)</h2>
<p>No user-visible changes.</p>
<h2>Version 3.55.0 (2026-04-02)</h2>
<h3>User-visible changes</h3>
<p>The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.</p>
<p>Removed deprecated command-line option <code>-AskipDirs</code>; use
<code>-AskipFiles</code>.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeMirror</code>:</p>
<ul>
<li>Renamed <code>getEffectiveAnnotation*()</code> to
<code>getAnnotation*()</code>.</li>
<li>Renamed <code>hasEffectiveAnnotation*()</code> to
<code>hasAnnotation*()</code>.</li>
</ul>
<p>Removed deprecated method
<code>ObjectCreationNode.getConstructor()</code>; use
<code>getTypeToInstantiate()</code>.</p>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7079">#7079</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7489">#7489</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7539">#7539</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/bf4ceb7660825e275f8c7561056310c47d48b81b"><code>bf4ceb7</code></a>
new release 3.55.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/b8096660563a2349201e126c362c2000de20c1c5"><code>b809666</code></a>
Remove unneeded argument</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/448019e7d43607b0d1d23e94baae0cd937e0219b"><code>448019e</code></a>
Make scripts executable in .zip file</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/3bc1190be960534f1c5536ab74b760198ff5e70a"><code>3bc1190</code></a>
Update directory copying</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/22df6d61a52c4183401d2fa355a59645c16feca3"><code>22df6d6</code></a>
Update release date</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/3fc441bc5df12983f716282aeebaf8f6b934bfe6"><code>3fc441b</code></a>
Note about permissions</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6baaa5287134b9e616cbcbc40a413f21d498e1a1"><code>6baaa52</code></a>
Brevity</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/d4ea6b993144c91992077e864c8cbf07ee929dac"><code>d4ea6b9</code></a>
Set version number to 3.55.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6b03e94dcf412a24859cf5ac9d17c2a4de65d978"><code>6b03e94</code></a>
Improve release instructions</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/65613a0f0f05d39d74b36c40ba6ca398e1929157"><code>65613a0</code></a>
Fix Nullness extra tests</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-3.54.0...checker-framework-3.55.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 06cb916b45..363ad7bd7d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
     <checkstyle.version>10.23.0</checkstyle.version>
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
-    <checker.framework.version>3.54.0</checker.framework.version>
+    <checker.framework.version>3.55.1</checker.framework.version>
     <logback.version>1.5.32</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>

From d952ed48ef257b90a2085bca574ddd9213b67c91 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 14:24:24 +0200
Subject: [PATCH 09/76] MINOR: Bump dep.hadoop.version from 3.4.3 to 3.5.0
 (#1104)

Bumps `dep.hadoop.version` from 3.4.3 to 3.5.0.
Updates `org.apache.hadoop:hadoop-client-runtime` from 3.4.3 to 3.5.0

Updates `org.apache.hadoop:hadoop-client-api` from 3.4.3 to 3.5.0

Updates `org.apache.hadoop:hadoop-common` from 3.4.3 to 3.5.0


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 363ad7bd7d..5ef8364176 100644
--- a/pom.xml
+++ b/pom.xml
@@ -102,7 +102,7 @@ under the License.
     <dep.grpc-bom.version>1.79.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.21.2</dep.jackson-bom.version>
-    <dep.hadoop.version>3.4.3</dep.hadoop.version>
+    <dep.hadoop.version>3.5.0</dep.hadoop.version>
     <dep.fbs.version>25.2.10</dep.fbs.version>
     <dep.avro.version>1.12.1</dep.avro.version>
     <dep.parquet.version>1.17.0</dep.parquet.version>

From e4f8c9251229846190716cce5a9772292952c761 Mon Sep 17 00:00:00 2001
From: Sutou Kouhei <kou@clear-code.com>
Date: Fri, 10 Apr 2026 14:31:54 +0900
Subject: [PATCH 10/76] GH-1107: Increase publish job timeout (#1108)

## What's Changed

We have many artifacts and need `sleep 1` per upload. So 5min timeout is
too short.

Closes #1107.
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5ca9cf9b73..a2c5a55544 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 30
     steps:
       - name: Download RC contents
         run: |

From 4ca6017bdd8590a6ad0a0a4154d993ec0c416076 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Apr 2026 17:37:40 +0900
Subject: [PATCH 11/76] MINOR: [CI] Bump actions/github-script from 8 to 9
 (#1110)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/github-script](https://github.com/actions/github-script)
from 8 to 9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/github-script/releases">actions/github-script's
releases</a>.</em></p>
<blockquote>
<h2>v9.0.0</h2>
<p><strong>New features:</strong></p>
<ul>
<li><strong><code>getOctokit</code> factory function</strong> —
Available directly in the script context. Create additional
authenticated Octokit clients with different tokens for multi-token
workflows, GitHub App tokens, and cross-org access. See <a
href="https://github.com/actions/github-script#creating-additional-clients-with-getoctokit">Creating
additional clients with <code>getOctokit</code></a> for details and
examples.</li>
<li><strong>Orchestration ID in user-agent</strong> — The
<code>ACTIONS_ORCHESTRATION_ID</code> environment variable is
automatically appended to the user-agent string for request
tracing.</li>
</ul>
<p><strong>Breaking changes:</strong></p>
<ul>
<li><strong><code>require('@actions/github')</code> no longer works in
scripts.</strong> The upgrade to <code>@actions/github</code> v9
(ESM-only) means <code>require('@actions/github')</code> will fail at
runtime. If you previously used patterns like <code>const { getOctokit }
= require('@actions/github')</code> to create secondary clients, use the
new injected <code>getOctokit</code> function instead — it's available
directly in the script context with no imports needed.</li>
<li><code>getOctokit</code> is now an injected function parameter.
Scripts that declare <code>const getOctokit = ...</code> or <code>let
getOctokit = ...</code> will get a <code>SyntaxError</code> because
JavaScript does not allow <code>const</code>/<code>let</code>
redeclaration of function parameters. Use the injected
<code>getOctokit</code> directly, or use <code>var getOctokit =
...</code> if you need to redeclare it.</li>
<li>If your script accesses other <code>@actions/github</code> internals
beyond the standard <code>github</code>/<code>octokit</code> client, you
may need to update those references for v9 compatibility.</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Add ACTIONS_ORCHESTRATION_ID to user-agent string by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li>
<li>ci: use deployment: false for integration test environments by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/github-script/pull/712">actions/github-script#712</a></li>
<li>feat!: add getOctokit to script context, upgrade
<code>@​actions/github</code> v9, <code>@​octokit/core</code> v7, and
related packages by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/github-script/pull/700">actions/github-script#700</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/github-script/compare/v8.0.0...v9.0.0">https://github.com/actions/github-script/compare/v8.0.0...v9.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/github-script/commit/3a2844b7e9c422d3c10d287c895573f7108da1b3"><code>3a2844b</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/github-script/issues/700">#700</a>
from actions/salmanmkc/expose-getoctokit + prepare re...</li>
<li><a
href="https://github.com/actions/github-script/commit/ca10bbdd1a7739de09e99a200c7a59f5d73a4079"><code>ca10bbd</code></a>
fix: use <code>@​octokit/core/</code>types import for v7
compatibility</li>
<li><a
href="https://github.com/actions/github-script/commit/86e48e20ac85c970ed1f96e718fd068173948b7b"><code>86e48e2</code></a>
merge: incorporate main branch changes</li>
<li><a
href="https://github.com/actions/github-script/commit/c1084728b5b935ec4ddc1e4cee877b01797b3ff9"><code>c108472</code></a>
chore: rebuild dist for v9 upgrade and getOctokit factory</li>
<li><a
href="https://github.com/actions/github-script/commit/afff112e4f8b57c718168af75b89ce00bc8d091d"><code>afff112</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/github-script/issues/712">#712</a>
from actions/salmanmkc/deployment-false + fix user-ag...</li>
<li><a
href="https://github.com/actions/github-script/commit/ff8117e5b78c415f814f39ad6998f424fee7b817"><code>ff8117e</code></a>
ci: fix user-agent test to handle orchestration ID</li>
<li><a
href="https://github.com/actions/github-script/commit/81c6b7876079abe10ff715951c9fc7b3e1ab389d"><code>81c6b78</code></a>
ci: use deployment: false to suppress deployment noise from integration
tests</li>
<li><a
href="https://github.com/actions/github-script/commit/3953caf8858d318f37b6cc53a9f5708859b5a7b7"><code>3953caf</code></a>
docs: update README examples from <a
href="https://github.com/v8"><code>@​v8</code></a> to <a
href="https://github.com/v9"><code>@​v9</code></a>, add getOctokit docs
and v9 brea...</li>
<li><a
href="https://github.com/actions/github-script/commit/c17d55b90dcdb3d554d0027a6c180a7adc2daf78"><code>c17d55b</code></a>
ci: add getOctokit integration test job</li>
<li><a
href="https://github.com/actions/github-script/commit/a047196d9a02fe92098771cafbb98c2f1814e408"><code>a047196</code></a>
test: add getOctokit integration tests via callAsyncFunction</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/github-script/compare/v8...v9">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/github-script&package-manager=github_actions&previous-version=8&new-version=9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/comment_bot.yml | 2 +-
 .github/workflows/dev_pr.yml      | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/comment_bot.yml b/.github/workflows/comment_bot.yml
index b4dbc92dfb..507d6a969c 100644
--- a/.github/workflows/comment_bot.yml
+++ b/.github/workflows/comment_bot.yml
@@ -30,7 +30,7 @@ jobs:
     if: github.event.comment.body == 'take'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |-
diff --git a/.github/workflows/dev_pr.yml b/.github/workflows/dev_pr.yml
index 84740628ee..20946c8185 100644
--- a/.github/workflows/dev_pr.yml
+++ b/.github/workflows/dev_pr.yml
@@ -50,28 +50,28 @@ jobs:
 
       - name: Ensure PR title format
         id: title-format
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);
             return scripts.check_title_format({core, github, context});
 
       - name: Label PR
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);
             await scripts.apply_labels({core, github, context});
 
       - name: Ensure PR is labeled
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);
             await scripts.check_labels({core, github, context});
 
       - name: Ensure PR is linked to an issue
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);

From 0d55ba78aeed3e6b28e3d65ced37c360f5e0ed4e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Apr 2026 17:37:53 +0900
Subject: [PATCH 12/76] MINOR: [CI] Bump actions/upload-artifact from 7.0.0 to
 7.0.1 (#1111)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[actions/upload-artifact](https://github.com/actions/upload-artifact)
from 7.0.0 to 7.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li>
<li>Include changes in typespec/ts-http-runtime 0.3.5 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a>
Include changes in typespec/ts-http-runtime 0.3.5</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a>
Readme: bump all the example versions to v7 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a>
Update the readme with direct upload details (<a
href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=7.0.0&new-version=7.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/rc.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 8f52d54bd6..2658f1da00 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -71,7 +71,7 @@ jobs:
         run: |
           dev/release/run_rat.sh "${TAR_GZ}"
       - name: Upload source archive
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-source
           path: |
@@ -148,7 +148,7 @@ jobs:
       - name: Compress into single artifact to keep directory structure
         run: tar -cvzf jni-linux-${{ matrix.platform.arch }}.tar.gz jni/
       - name: Upload artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: jni-linux-${{ matrix.platform.arch }}
           path: jni-linux-${{ matrix.platform.arch }}.tar.gz
@@ -278,7 +278,7 @@ jobs:
       - name: Compress into single artifact to keep directory structure
         run: tar -cvzf jni-macos-${{ matrix.platform.arch }}.tar.gz jni/
       - name: Upload artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: jni-macos-${{ matrix.platform.arch }}
           path: jni-macos-${{ matrix.platform.arch }}.tar.gz
@@ -356,7 +356,7 @@ jobs:
         shell: bash
         run: tar -cvzf jni-windows-${{ matrix.platform.arch }}.tar.gz jni/
       - name: Upload artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: jni-windows-${{ matrix.platform.arch }}
           path: jni-windows-${{ matrix.platform.arch }}.tar.gz
@@ -428,12 +428,12 @@ jobs:
           cp -a target/site/apidocs reference
           tar -cvzf reference.tar.gz reference
       - name: Upload binaries
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-binaries
           path: binaries/*
       - name: Upload docs
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: reference
           path: reference.tar.gz
@@ -471,7 +471,7 @@ jobs:
       - name: Compress into single artifact to keep directory structure
         run: tar -cvzf html.tar.gz -C docs/build html
       - name: Upload artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-html
           path: html.tar.gz

From 8d3e8dd2f01f7ddc22cda5aa04cde30eb5f6d308 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 15:18:55 +0200
Subject: [PATCH 13/76] MINOR: Bump
 com.google.api.grpc:proto-google-common-protos from 2.67.0 to 2.70.0 (#1124)

Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.67.0 to 2.70.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/sdk-platform-java/releases">com.google.api.grpc:proto-google-common-protos's
releases</a>.</em></p>
<blockquote>
<h2>v2.68.0</h2>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.67.0...v2.68.0">2.68.0</a>
(2026-03-17)</h2>
<h3>Features</h3>
<ul>
<li>Add client request duration metric. (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4132">#4132</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/6a763979c2c5427f0a7ba23708fb7948520662d8">6a76397</a>)</li>
<li>Add more attributes to golden signals metrics. (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4135">#4135</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/59d0624ec5a85580a503f719897597161f529e3f">59d0624</a>)</li>
<li><strong>gax-httpjson:</strong> add HttpJsonErrorParser utility (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4137">#4137</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/a1b7565ef752259d79d3f1288b85120c6ac7452b">a1b7565</a>)</li>
<li><strong>generator:</strong> add extra allowed modules that will not
be removed from the monorepo if they are present (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4124">#4124</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/774fe6ede6bf25e150fb405dfe3bac9d85e21169">774fe6e</a>)</li>
<li><strong>o11y:</strong> introduce <code>gcp.client.repo</code> and
<code>gcp.client.artifact</code> attributes (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4120">#4120</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/105f644209cb78845a423d949cb7633a86d07868">105f644</a>)</li>
<li><strong>o11y:</strong> Introduce <code>rpc.system.name</code> and
<code>rpc.method</code> in gRPC (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4121">#4121</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/7ab6d2e5784f264558b7aca6f23e771361dbea3a">7ab6d2e</a>)</li>
<li><strong>o11y:</strong> introduce server.port attribute (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4128">#4128</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/56aa3438393e1992bb8f688291fb12030ec9bc0e">56aa343</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add null checks for ApiTracerFactory in ClientContext (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4122">#4122</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/4b3dbe29b32dd0fba6c7a5f4a08fafa2798eeca5">4b3dbe2</a>)</li>
<li>Decrease log level for directpath warnings outside GCE (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4139">#4139</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/c9651e7fa1501726798c0e38365e4b7c0acabc55">c9651e7</a>)</li>
<li><strong>gax-grpc:</strong> add pick_first fallback to direct path
service config (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4143">#4143</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/b150fe9ccfd5a97319388be4079699722aa033dc">b150fe9</a>)</li>
<li>Populate method level attributes in metrics recording (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4149">#4149</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/7b7e6c99251e1aecb1831084f5576aa9e8e48930">7b7e6c9</a>)</li>
<li>suppress warnings in generated projects for non-idiomatic durations
(<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4119">#4119</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/4206e6ed7546d6b8330dcb8dc29179e59677ccd3">4206e6e</a>)</li>
<li>Use ServiceName + MethodName as the regex for Otel (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/2543">#2543</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/b9ae73fba59ba32e9688d11c2b3db51fe0d68d8d">b9ae73f</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>hermetic_build:</strong> fix config field name in readme (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4130">#4130</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/a0c8f67f5a425d9a365b8e451b18add2c5947a11">a0c8f67</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/sdk-platform-java/blob/main/CHANGELOG.md">com.google.api.grpc:proto-google-common-protos's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.67.0...v2.68.0">2.68.0</a>
(2026-03-17)</h2>
<h3>Features</h3>
<ul>
<li>Add client request duration metric. (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4132">#4132</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/6a763979c2c5427f0a7ba23708fb7948520662d8">6a76397</a>)</li>
<li>Add more attributes to golden signals metrics. (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4135">#4135</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/59d0624ec5a85580a503f719897597161f529e3f">59d0624</a>)</li>
<li><strong>gax-httpjson:</strong> add HttpJsonErrorParser utility (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4137">#4137</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/a1b7565ef752259d79d3f1288b85120c6ac7452b">a1b7565</a>)</li>
<li><strong>generator:</strong> add extra allowed modules that will not
be removed from the monorepo if they are present (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4124">#4124</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/774fe6ede6bf25e150fb405dfe3bac9d85e21169">774fe6e</a>)</li>
<li><strong>o11y:</strong> introduce <code>gcp.client.repo</code> and
<code>gcp.client.artifact</code> attributes (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4120">#4120</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/105f644209cb78845a423d949cb7633a86d07868">105f644</a>)</li>
<li><strong>o11y:</strong> Introduce <code>rpc.system.name</code> and
<code>rpc.method</code> in gRPC (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4121">#4121</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/7ab6d2e5784f264558b7aca6f23e771361dbea3a">7ab6d2e</a>)</li>
<li><strong>o11y:</strong> introduce server.port attribute (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4128">#4128</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/56aa3438393e1992bb8f688291fb12030ec9bc0e">56aa343</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add null checks for ApiTracerFactory in ClientContext (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4122">#4122</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/4b3dbe29b32dd0fba6c7a5f4a08fafa2798eeca5">4b3dbe2</a>)</li>
<li>Decrease log level for directpath warnings outside GCE (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4139">#4139</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/c9651e7fa1501726798c0e38365e4b7c0acabc55">c9651e7</a>)</li>
<li><strong>gax-grpc:</strong> add pick_first fallback to direct path
service config (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4143">#4143</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/b150fe9ccfd5a97319388be4079699722aa033dc">b150fe9</a>)</li>
<li>Populate method level attributes in metrics recording (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4149">#4149</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/7b7e6c99251e1aecb1831084f5576aa9e8e48930">7b7e6c9</a>)</li>
<li>suppress warnings in generated projects for non-idiomatic durations
(<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4119">#4119</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/4206e6ed7546d6b8330dcb8dc29179e59677ccd3">4206e6e</a>)</li>
<li>Use ServiceName + MethodName as the regex for Otel (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/2543">#2543</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/b9ae73fba59ba32e9688d11c2b3db51fe0d68d8d">b9ae73f</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>hermetic_build:</strong> fix config field name in readme (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4130">#4130</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/a0c8f67f5a425d9a365b8e451b18add2c5947a11">a0c8f67</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/27fe524365a5bcecfab71165c3d2ec95ff85b5a4"><code>27fe524</code></a>
chore(main): release 2.62.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3884">#3884</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/a660a869d2edbfc4b98e4f06c4885f520d45d869"><code>a660a86</code></a>
chore: Update the upper bound dependencies file (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3886">#3886</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/592e899c516288b0a60b69525ba12d6f29bc6200"><code>592e899</code></a>
feat: Set sampledToLocalTracing flag to true for all gRPC
MethodDescriptors (...</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/fc80c7b6e0e2b1d1100cc836a864a128bee426e5"><code>fc80c7b</code></a>
chore: Fix dependency CI tests (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3883">#3883</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/210464d5409fea56967a28f7eafe76e71a2ef5ef"><code>210464d</code></a>
ci: Test upper bound dependenices file in Github CI (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3877">#3877</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/f392d901bb77402972ee3c75e84a519b13382ade"><code>f392d90</code></a>
chore: Update auto triage guidelines (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3882">#3882</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/7b1a15149db9106cfd4b6a65ed93b92432baf461"><code>7b1a151</code></a>
ci: Fix gemini cli issues triage (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3881">#3881</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/00195e637101037eb16d544a770754459173e7e7"><code>00195e6</code></a>
chore: Enable Gemini CLI Github Actions (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3880">#3880</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/c34e3848ad771c66d30a9dd38322d23286931277"><code>c34e384</code></a>
chore: Add initial GEMINI.md file (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3879">#3879</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/48792bcb295a151797dfdeaeb0ed33a2940603ad"><code>48792bc</code></a>
chore(main): release 2.61.1-SNAPSHOT (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3876">#3876</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.67.0...gax/v2.70.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.google.api.grpc:proto-google-common-protos&package-manager=maven&previous-version=2.67.0&new-version=2.70.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index 5c6c3378c1..d199f70da4 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>proto-google-common-protos</artifactId>
-      <version>2.67.0</version>
+      <version>2.70.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 3dca92baf2a806802e437f84bfe06947d4433343 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 15:46:36 +0200
Subject: [PATCH 14/76] MINOR: Bump com.google.guava:guava-bom from 33.5.0-jre
 to 33.6.0-jre (#1123)

Bumps [com.google.guava:guava-bom](https://github.com/google/guava) from
33.5.0-jre to 33.6.0-jre.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/guava/releases">com.google.guava:guava-bom's
releases</a>.</em></p>
<blockquote>
<h2>33.6.0</h2>
<h3>Maven</h3>
<pre lang="xml"><code>&lt;dependency&gt;
  &lt;groupId&gt;com.google.guava&lt;/groupId&gt;
  &lt;artifactId&gt;guava&lt;/artifactId&gt;
  &lt;version&gt;33.6.0-jre&lt;/version&gt;
  &lt;!-- or, for Android: --&gt;
  &lt;version&gt;33.6.0-android&lt;/version&gt;
&lt;/dependency&gt;
</code></pre>
<h3>Jar files</h3>
<ul>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/guava/33.6.0-jre/guava-33.6.0-jre.jar">33.6.0-jre.jar</a></li>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/guava/33.6.0-android/guava-33.6.0-android.jar">33.6.0-android.jar</a></li>
</ul>
<p>Guava requires <a
href="https://github.com/google/guava/wiki/UseGuavaInYourBuild#what-about-guavas-own-dependencies">one
runtime dependency</a>, which you can download here:</p>
<ul>
<li><a
href="https://repo1.maven.org/maven2/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar">failureaccess-1.0.3.jar</a></li>
</ul>
<h3>Javadoc</h3>
<ul>
<li><a
href="https://guava.dev/releases/33.6.0-jre/api/docs/">33.6.0-jre</a></li>
<li><a
href="https://guava.dev/releases/33.6.0-android/api/docs/">33.6.0-android</a></li>
</ul>
<h3>JDiff</h3>
<ul>
<li><a
href="https://guava.dev/releases/33.6.0-jre/api/diffs/">33.6.0-jre vs.
33.5.0-jre</a></li>
<li><a
href="https://guava.dev/releases/33.6.0-android/api/diffs/">33.6.0-android
vs. 33.5.0-android</a></li>
<li><a
href="https://guava.dev/releases/33.6.0-android/api/androiddiffs/">33.6.0-android
vs. 33.6.0-jre</a></li>
</ul>
<h3>Changelog</h3>
<ul>
<li>Migrated some classes from <code>finalize()</code> to
<code>PhantomReference</code> in preparation for <a
href="https://openjdk.org/jeps/421">the removal of finalization</a>.
(786b619dd6, 7c6b17c, aeef90988d)</li>
<li><code>cache</code>: Deprecated <code>CacheBuilder</code> APIs that
use <code>TimeUnit</code> in favor of those that use
<code>Duration</code>. (73f8b0bb84)</li>
<li><code>collect</code>: Added <code>toImmutableSortedMap</code>
collectors that use the natural comparator. (64d70b9f94)</li>
<li><code>collect</code>: Changed <code>ConcurrentHashMultiset</code>,
<code>ImmutableMap</code> and <code>TreeMultiset</code> deserialization
to <a href="https://openjdk.org/jeps/500">avoid mutating
<code>final</code> fields</a>. In extremely unlikely scenarios in which
an instance of that type contains an object that refers back to that
instance, this could lead to <a
href="https://docs.oracle.com/en/java/javase/26/docs/specs/serialization/input.html#the-readresolve-method:~:text=in%20cases%20where%20an%20object%20being%20serialized%20nominates%20a%20replacement%20object%20whose%20object%20graph%20has%20a%20reference%20to%20the%20original%20object">a
broken instance</a> that throws <code>NullPointerException</code> when
used. (8240c7e596, 046468055f)</li>
<li><code>graph</code>: Removed <code>@Beta</code> from all APIs in the
package. (dae9566b73)</li>
<li><code>graph</code>: Added support to
<code>Graphs.transitiveClosure()</code> for different strategies for
adding self-loops. (2e13df25b2)</li>
<li><code>graph</code>: Added an <code>asNetwork()</code> view to
<code>Graph</code> and <code>ValueGraph</code>. (909c593c61)</li>
<li><code>hash</code>: Added <code>BloomFilter.serializedSize()</code>.
(df9bcc251a)</li>
<li><code>net</code>: Added <code>HttpHeaders.CDN_CACHE_CONTROL</code>.
(75331b5030)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/google/guava/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.google.guava:guava-bom&package-manager=maven&previous-version=33.5.0-jre&new-version=33.6.0-jre)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 5ef8364176..a388c90fee 100644
--- a/pom.xml
+++ b/pom.xml
@@ -97,7 +97,7 @@ under the License.
     <dep.junit.platform.version>1.9.0</dep.junit.platform.version>
     <dep.junit.jupiter.version>5.12.2</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.17</dep.slf4j.version>
-    <dep.guava-bom.version>33.5.0-jre</dep.guava-bom.version>
+    <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.12.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.79.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>

From 980b5146b5c659e5a06c4592b59cef0f2514ea72 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 15:57:26 +0200
Subject: [PATCH 15/76] MINOR: Bump org.bouncycastle:bcpkix-jdk18on from 1.83
 to 1.84 (#1122)

Bumps
[org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) from
1.83 to 1.84.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html">org.bouncycastle:bcpkix-jdk18on's
changelog</a>.</em></p>
<blockquote>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/bcgit/bc-java/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.bouncycastle:bcpkix-jdk18on&package-manager=maven&previous-version=1.83&new-version=1.84)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 483c019cdc..1f9bc3e00e 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -165,7 +165,7 @@ under the License.
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcpkix-jdk18on</artifactId>
-      <version>1.83</version>
+      <version>1.84</version>
     </dependency>
 
     <dependency>

From 09038fbb578d38e98878359557b1e13dcb96b04f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 06:15:04 +0200
Subject: [PATCH 16/76] MINOR: Bump checker.framework.version from 3.55.1 to
 4.0.0 (#1113)

Bumps `checker.framework.version` from 3.55.1 to 4.0.0.
Updates `org.checkerframework:checker-qual` from 3.55.1 to 4.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker-qual's
releases</a>.</em></p>
<blockquote>
<h2>Release 4.0.0 of the Checker Framework</h2>
<h2>Version 4.0.0 (2026-04-07)</h2>
<h3>User-visible changes</h3>
<p>To run the Checker Framework, you need to use a JDK 17 or later
version of javac. That is, you need to use JDK 17 or later when
compiling your code.</p>
<p>The Checker Framework can type-check any Java project, including
projects that compile to Java 8 or 11 bytecodes and run on JRE versions
8 or 11. That is, your code can run under any release of Java, from Java
8 onward.</p>
<p>The type qualifiers and utility libraries in
<code>checker-qual.jar</code> and <code>checker-util.jar</code> still
use Java 11 bytecode. Thus, they may be used in projects that run under
Java 11 or later.</p>
<h3>Changes since version 3.0.0</h3>
<p>Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600 issues. Thanks to everyone who contributed!</p>
<p>New checkers include:</p>
<ul>
<li>The <a
href="https://checkerframework.org/manual/#index-checker">Index
Checker</a> warns about out-of-bounds accesses to arrays and
strings.</li>
<li>The <a
href="https://checkerframework.org/manual/#initialized-fields-checker">Initialized
Fields Checker</a> warns if a constructor does not initialize a
field.</li>
<li>The <a
href="https://checkerframework.org/manual/#resource-leak-checker">Resource
Leak Checker</a> guarantees that every resource is closed rather than
leaked. Examples of resources are a channel, executor,
<code>ExecutionControl</code>, file, <code>FileLock</code>,
<code>Formatter</code>, reader, <code>Scanner</code>, socket, stream,
writer, etc.</li>
<li>The <a
href="https://checkerframework.org/manual/#sql-quotes-checker">SQL
Quotes Checker</a> helps prevent SQL injection vulnerabilities.</li>
</ul>
<p>New command-line arguments include:</p>
<ul>
<li><code>-AskipFiles</code>, <code>-AonlyFiles</code></li>
<li><code>-AassumeSideEffectFree</code>,
<code>-AassumeDeterministic</code>, <code>-AassumePure</code>,
<code>-AassumePureGetters</code></li>
<li><code>-AuseConservativeDefaultsForUncheckedCode</code></li>
<li><code>-AignoreRawTypeArguments</code></li>
<li><code>-AwarnRedundantAnnotations</code></li>
<li><code>-Ainfer=ajava</code>, <code>-AinferOutputDirectory</code>,
<code>-AinferOutputOriginal</code>,
<code>-AshowWpiFailedInferences</code></li>
<li><code>-AshowSuppressWarningsStrings</code>,
<code>-AwarnUnneededSuppressionsExceptions</code></li>
<li><code>-AshowPrefixInWarningMessages</code></li>
<li><code>-AstubNoWarnIfNotFound</code>, <code>-AstubWarnNote</code>,
<code>-AmergeStubsWithSource</code></li>
<li><code>-Aonelinemsg</code>, <code>-AdumpOnErrors</code>,
<code>-AexceptionLineSeparator</code></li>
<li><code>-ApermitMissingJdk</code>, <code>-AparseAllJdk</code></li>
<li><code>-AslowTypecheckingSeconds</code></li>
<li><code>-Aversion</code>, <code>-AprintGitProperties</code></li>
<li>You can pass an option to only a particular checker (not all
checkers) by using an underscore prefix.</li>
</ul>
<p>Other improvements include thousands of enhancements and bug fixes --
too many to list here.</p>
<h3>Implementation details</h3>
<p>All previously-deprecated methods and classes have been removed. If
your project builds upon the Checker Framework, we suggest that you
upgrade to version 3.55.1, resolve all the deprecation warnings, then
upgrade to version 4.0.0.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker-qual's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.0.0 (2026-04-07)</h2>
<h3>User-visible changes</h3>
<p>To run the Checker Framework, you need to use a JDK 17 or later
version of
javac. That is, you need to use JDK 17 or later when compiling your
code.</p>
<p>The Checker Framework can type-check any Java project, including
projects that
compile to Java 8 or 11 bytecodes and run on JRE versions 8 or 11. That
is,
your code can run under any release of Java, from Java 8 onward.</p>
<p>The type qualifiers and utility libraries in
<code>checker-qual.jar</code> and
<code>checker-util.jar</code> still use Java 11 bytecode. Thus, they may
be used in
projects that run under Java 11 or later.</p>
<h3>Changes since version 3.0.0</h3>
<p>Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600
issues.  Thanks to everyone who contributed!</p>
<p>New checkers include:</p>
<ul>
<li>The <a
href="https://checkerframework.org/manual/#index-checker">Index
Checker</a> warns
about out-of-bounds accesses to arrays and strings.</li>
<li>The <a
href="https://checkerframework.org/manual/#initialized-fields-checker">Initialized
Fields
Checker</a>
warns if a constructor does not initialize a field.</li>
<li>The <a
href="https://checkerframework.org/manual/#resource-leak-checker">Resource
Leak
Checker</a>
guarantees that every resource is closed rather than leaked. Examples of
resources are a channel, executor, <code>ExecutionControl</code>, file,
<code>FileLock</code>,
<code>Formatter</code>, reader, <code>Scanner</code>, socket, stream,
writer, etc.</li>
<li>The <a
href="https://checkerframework.org/manual/#sql-quotes-checker">SQL
Quotes
Checker</a> helps
prevent SQL injection vulnerabilities.</li>
</ul>
<p>New command-line arguments include:</p>
<ul>
<li><code>-AskipFiles</code>, <code>-AonlyFiles</code></li>
<li><code>-AassumeSideEffectFree</code>,
<code>-AassumeDeterministic</code>, <code>-AassumePure</code>,
<code>-AassumePureGetters</code></li>
<li><code>-AuseConservativeDefaultsForUncheckedCode</code></li>
<li><code>-AignoreRawTypeArguments</code></li>
<li><code>-AwarnRedundantAnnotations</code></li>
<li><code>-Ainfer=ajava</code>, <code>-AinferOutputDirectory</code>,
<code>-AinferOutputOriginal</code>,
<code>-AshowWpiFailedInferences</code></li>
<li><code>-AshowSuppressWarningsStrings</code>,
<code>-AwarnUnneededSuppressionsExceptions</code></li>
<li><code>-AshowPrefixInWarningMessages</code></li>
<li><code>-AstubNoWarnIfNotFound</code>, <code>-AstubWarnNote</code>,
<code>-AmergeStubsWithSource</code></li>
<li><code>-Aonelinemsg</code>, <code>-AdumpOnErrors</code>,
<code>-AexceptionLineSeparator</code></li>
<li><code>-ApermitMissingJdk</code>, <code>-AparseAllJdk</code></li>
<li><code>-AslowTypecheckingSeconds</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/479d0875daa271447e2822c657896b5f9d02ce24"><code>479d087</code></a>
new release 4.0.0</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/bfff75751f4fa4094b7d3015c4b2cfbc2893fbc5"><code>bfff757</code></a>
Put the manual in the right place.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/c532f6d12fd5352610f70215f010786e9a2e9924"><code>c532f6d</code></a>
Put a copy of manual.pdf at top level of website as expected.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/5e53e6cfd1e5535623ea260342391037106778ec"><code>5e53e6c</code></a>
No closed issues.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e67ae858ed36f81ac586fbf42821fa3a483e7f23"><code>e67ae85</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4192d0d88bc272c571a8dd3454d499982cd0ee42"><code>4192d0d</code></a>
Remove file SKIP-REQUIRE-JAVADOC</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/7d6d85687d2298dbe85d59692ab85d03566a29e7"><code>7d6d856</code></a>
Remove or update references to JDK 8-16</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/b1e3761bbf0dfb1185d7e8e0b850ef97cafd5ea8"><code>b1e3761</code></a>
Remove all deprecated methods</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/a1b30642b07d64603a9ec9ef093f910e5be0bf41"><code>a1b3064</code></a>
Directly use Java 17 and below Javac APIs. (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7582">#7582</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4efdbdbbda3ac5230bcae57341098816aa71abfb"><code>4efdbdb</code></a>
Remove support for Java 8 from scripts and build scripts. (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7575">#7575</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-3.55.1...checker-framework-4.0.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.checkerframework:checker` from 3.55.1 to 4.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker's
releases</a>.</em></p>
<blockquote>
<h2>Release 4.0.0 of the Checker Framework</h2>
<h2>Version 4.0.0 (2026-04-07)</h2>
<h3>User-visible changes</h3>
<p>To run the Checker Framework, you need to use a JDK 17 or later
version of javac. That is, you need to use JDK 17 or later when
compiling your code.</p>
<p>The Checker Framework can type-check any Java project, including
projects that compile to Java 8 or 11 bytecodes and run on JRE versions
8 or 11. That is, your code can run under any release of Java, from Java
8 onward.</p>
<p>The type qualifiers and utility libraries in
<code>checker-qual.jar</code> and <code>checker-util.jar</code> still
use Java 11 bytecode. Thus, they may be used in projects that run under
Java 11 or later.</p>
<h3>Changes since version 3.0.0</h3>
<p>Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600 issues. Thanks to everyone who contributed!</p>
<p>New checkers include:</p>
<ul>
<li>The <a
href="https://checkerframework.org/manual/#index-checker">Index
Checker</a> warns about out-of-bounds accesses to arrays and
strings.</li>
<li>The <a
href="https://checkerframework.org/manual/#initialized-fields-checker">Initialized
Fields Checker</a> warns if a constructor does not initialize a
field.</li>
<li>The <a
href="https://checkerframework.org/manual/#resource-leak-checker">Resource
Leak Checker</a> guarantees that every resource is closed rather than
leaked. Examples of resources are a channel, executor,
<code>ExecutionControl</code>, file, <code>FileLock</code>,
<code>Formatter</code>, reader, <code>Scanner</code>, socket, stream,
writer, etc.</li>
<li>The <a
href="https://checkerframework.org/manual/#sql-quotes-checker">SQL
Quotes Checker</a> helps prevent SQL injection vulnerabilities.</li>
</ul>
<p>New command-line arguments include:</p>
<ul>
<li><code>-AskipFiles</code>, <code>-AonlyFiles</code></li>
<li><code>-AassumeSideEffectFree</code>,
<code>-AassumeDeterministic</code>, <code>-AassumePure</code>,
<code>-AassumePureGetters</code></li>
<li><code>-AuseConservativeDefaultsForUncheckedCode</code></li>
<li><code>-AignoreRawTypeArguments</code></li>
<li><code>-AwarnRedundantAnnotations</code></li>
<li><code>-Ainfer=ajava</code>, <code>-AinferOutputDirectory</code>,
<code>-AinferOutputOriginal</code>,
<code>-AshowWpiFailedInferences</code></li>
<li><code>-AshowSuppressWarningsStrings</code>,
<code>-AwarnUnneededSuppressionsExceptions</code></li>
<li><code>-AshowPrefixInWarningMessages</code></li>
<li><code>-AstubNoWarnIfNotFound</code>, <code>-AstubWarnNote</code>,
<code>-AmergeStubsWithSource</code></li>
<li><code>-Aonelinemsg</code>, <code>-AdumpOnErrors</code>,
<code>-AexceptionLineSeparator</code></li>
<li><code>-ApermitMissingJdk</code>, <code>-AparseAllJdk</code></li>
<li><code>-AslowTypecheckingSeconds</code></li>
<li><code>-Aversion</code>, <code>-AprintGitProperties</code></li>
<li>You can pass an option to only a particular checker (not all
checkers) by using an underscore prefix.</li>
</ul>
<p>Other improvements include thousands of enhancements and bug fixes --
too many to list here.</p>
<h3>Implementation details</h3>
<p>All previously-deprecated methods and classes have been removed. If
your project builds upon the Checker Framework, we suggest that you
upgrade to version 3.55.1, resolve all the deprecation warnings, then
upgrade to version 4.0.0.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.0.0 (2026-04-07)</h2>
<h3>User-visible changes</h3>
<p>To run the Checker Framework, you need to use a JDK 17 or later
version of
javac. That is, you need to use JDK 17 or later when compiling your
code.</p>
<p>The Checker Framework can type-check any Java project, including
projects that
compile to Java 8 or 11 bytecodes and run on JRE versions 8 or 11. That
is,
your code can run under any release of Java, from Java 8 onward.</p>
<p>The type qualifiers and utility libraries in
<code>checker-qual.jar</code> and
<code>checker-util.jar</code> still use Java 11 bytecode. Thus, they may
be used in
projects that run under Java 11 or later.</p>
<h3>Changes since version 3.0.0</h3>
<p>Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600
issues.  Thanks to everyone who contributed!</p>
<p>New checkers include:</p>
<ul>
<li>The <a
href="https://checkerframework.org/manual/#index-checker">Index
Checker</a> warns
about out-of-bounds accesses to arrays and strings.</li>
<li>The <a
href="https://checkerframework.org/manual/#initialized-fields-checker">Initialized
Fields
Checker</a>
warns if a constructor does not initialize a field.</li>
<li>The <a
href="https://checkerframework.org/manual/#resource-leak-checker">Resource
Leak
Checker</a>
guarantees that every resource is closed rather than leaked. Examples of
resources are a channel, executor, <code>ExecutionControl</code>, file,
<code>FileLock</code>,
<code>Formatter</code>, reader, <code>Scanner</code>, socket, stream,
writer, etc.</li>
<li>The <a
href="https://checkerframework.org/manual/#sql-quotes-checker">SQL
Quotes
Checker</a> helps
prevent SQL injection vulnerabilities.</li>
</ul>
<p>New command-line arguments include:</p>
<ul>
<li><code>-AskipFiles</code>, <code>-AonlyFiles</code></li>
<li><code>-AassumeSideEffectFree</code>,
<code>-AassumeDeterministic</code>, <code>-AassumePure</code>,
<code>-AassumePureGetters</code></li>
<li><code>-AuseConservativeDefaultsForUncheckedCode</code></li>
<li><code>-AignoreRawTypeArguments</code></li>
<li><code>-AwarnRedundantAnnotations</code></li>
<li><code>-Ainfer=ajava</code>, <code>-AinferOutputDirectory</code>,
<code>-AinferOutputOriginal</code>,
<code>-AshowWpiFailedInferences</code></li>
<li><code>-AshowSuppressWarningsStrings</code>,
<code>-AwarnUnneededSuppressionsExceptions</code></li>
<li><code>-AshowPrefixInWarningMessages</code></li>
<li><code>-AstubNoWarnIfNotFound</code>, <code>-AstubWarnNote</code>,
<code>-AmergeStubsWithSource</code></li>
<li><code>-Aonelinemsg</code>, <code>-AdumpOnErrors</code>,
<code>-AexceptionLineSeparator</code></li>
<li><code>-ApermitMissingJdk</code>, <code>-AparseAllJdk</code></li>
<li><code>-AslowTypecheckingSeconds</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/479d0875daa271447e2822c657896b5f9d02ce24"><code>479d087</code></a>
new release 4.0.0</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/bfff75751f4fa4094b7d3015c4b2cfbc2893fbc5"><code>bfff757</code></a>
Put the manual in the right place.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/c532f6d12fd5352610f70215f010786e9a2e9924"><code>c532f6d</code></a>
Put a copy of manual.pdf at top level of website as expected.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/5e53e6cfd1e5535623ea260342391037106778ec"><code>5e53e6c</code></a>
No closed issues.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e67ae858ed36f81ac586fbf42821fa3a483e7f23"><code>e67ae85</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4192d0d88bc272c571a8dd3454d499982cd0ee42"><code>4192d0d</code></a>
Remove file SKIP-REQUIRE-JAVADOC</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/7d6d85687d2298dbe85d59692ab85d03566a29e7"><code>7d6d856</code></a>
Remove or update references to JDK 8-16</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/b1e3761bbf0dfb1185d7e8e0b850ef97cafd5ea8"><code>b1e3761</code></a>
Remove all deprecated methods</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/a1b30642b07d64603a9ec9ef093f910e5be0bf41"><code>a1b3064</code></a>
Directly use Java 17 and below Javac APIs. (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7582">#7582</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4efdbdbbda3ac5230bcae57341098816aa71abfb"><code>4efdbdb</code></a>
Remove support for Java 8 from scripts and build scripts. (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7575">#7575</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-3.55.1...checker-framework-4.0.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index a388c90fee..0c5a00ded4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
     <checkstyle.version>10.23.0</checkstyle.version>
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
-    <checker.framework.version>3.55.1</checker.framework.version>
+    <checker.framework.version>4.0.0</checker.framework.version>
     <logback.version>1.5.32</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>

From 0f0a58433b46004ff9869a2512beded177340bca Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 06:17:22 +0200
Subject: [PATCH 17/76] MINOR: Bump io.grpc:grpc-bom from 1.79.0 to 1.80.0
 (#1093)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.79.0
to 1.80.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-java/releases">io.grpc:grpc-bom's
releases</a>.</em></p>
<blockquote>
<h2>V1.80.0</h2>
<p><strong>API Changes</strong></p>
<ul>
<li>core: Added PickResult.copyWithSubchannel() and
PickResult.copyWithStreamTracerFactory() to simplify updating PickResult
while preserving metadata. Load balancing policies should now ensure
ForwardingSubchannel decorators are unwrapped before being returned in a
pick result. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12658">#12658</a>)
(eae16b251)</li>
</ul>
<p><strong>Bug Fixes</strong></p>
<ul>
<li>core: Fixed the retry backoff jitter range to [0.8, 1.2] to align
with the gRPC A6 specification. Retries will now occur more consistently
around the calculated backoff interval. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12639">#12639</a>)
(024fdd0ea)
core: Fixed a race condition in RetriableStream where inFlightSubStreams
counting could become inconsistent during concurrent retry and deadline
events. This ensures that client calls (such as blockingUnaryCall) do
not hang indefinitely and correctly receive a close signal. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12649">#12649</a>)
(73abb4854)</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>api: Trigger R8's ServiceLoader optimization to reduce necessary
configuration when using R8 Full Mode (470219f9c). This allows gRPC to
avoid reflection, and the need to specify -keeps for various class’s
constructors.
Upgrade to protobuf 33.4 (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12615">#12615</a>)
(50c18f183)</li>
<li>cronet: Introduced CRONET_READ_BUFFER_SIZE_KEY to allow customizing
the read buffer size per-stream via CallOptions. Increasing the buffer
size from the 4KB default can significantly improve performance for
large messages by reducing JNI and context-switching overhead.
(31fdb6c22)</li>
<li>api: Moved FlagResetRule to api/testFixtures and updated
ManagedChannelRegistry to honor the GRPC_ENABLE_RFC3986_URIS feature
flag. This ensures that target parsing is consistent across the library
when the new URI parser is enabled. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12608">#12608</a>)</li>
<li>api: Updated NameResolverRegistry to natively support io.grpc.Uri.
This is a foundational change that allows gRPC's name resolution system
to handle URIs parsed with the new RFC 3986-compliant parser, ensuring
more robust target handling. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12609">#12609</a>)
(990348876)</li>
<li>xds: Removed the GRPC_EXPERIMENTAL_XDS_SNI feature flag. SNI
determination via xDS is now always enabled and follows gRFC A101, where
SNI is derived from xDS configurations like auto_host_sni or
UpstreamTlsContext.sni. This ensures that no SNI is sent if not
explicitly configured, unless the legacy channel authority fallback is
enabled. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12625">#12625</a>)
(ac44e9681)</li>
</ul>
<p><strong>New Features</strong></p>
<ul>
<li>core: pick_first shuffling now a weighted shuffle and observes
weights from EDS (34dd29042). This finishes the <a
href="https://github.com/grpc/proposal/blob/master/A113-pick-first-weighted-shuffling.md">gRFC
A113 pick_first: Weighted Random Shuffling</a> support</li>
<li>netty: Added RFC 3986 support to the unix: name resolver. This
enables proper parsing of Unix domain socket URIs, including correct
handling of query and fragment components in both hierarchical (e.g.,
unix:///path) and opaque (e.g., unix:/path) formats. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12659">#12659</a>)</li>
</ul>
<p><strong>Thanks to</strong></p>
<ul>
<li><a
href="https://github.com/becomeStar"><code>@​becomeStar</code></a></li>
<li><a
href="https://github.com/aymanm-google"><code>@​aymanm-google</code></a></li>
<li><a
href="https://github.com/PetitBaguette"><code>@​PetitBaguette</code></a></li>
<li><a
href="https://github.com/stagegrowth"><code>@​stagegrowth</code></a></li>
<li><a href="https://github.com/wcchoi"><code>@​wcchoi</code></a></li>
<li><a
href="https://github.com/Gyuhyeok99"><code>@​Gyuhyeok99</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-java/commit/6c231b4c534d887bc6407f8af52733d996f19819"><code>6c231b4</code></a>
Bump version to 1.80.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/daf7a6c3c0496dce3f9d9c26aeae2479a3a4d7de"><code>daf7a6c</code></a>
Update README etc to reference 1.80.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/b7f9074e23fa543e9a804e20df8a8a656feb39ea"><code>b7f9074</code></a>
Revert &quot;fix(xds): Allow and normalize trailing dot (FQDN) in
matchHostName (#...</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/09a6e2ef6ebdbee4d3980d5ac6bd3e3e1c2d9755"><code>09a6e2e</code></a>
Revert &quot;netty: Preserve early server handshake failure cause in
logs&quot;</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/31fdb6c2268b4b1c8ba6c995ee46c58e84a831aa"><code>31fdb6c</code></a>
Add <code>CRONET_READ_BUFFER_SIZE_KEY</code> API to
CronetClientStream</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/470219f9ca330887215d3192f72095aa844d84fb"><code>470219f</code></a>
Trigger R8's ServiceLoader optimization</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/50ead96f4718569782cc7a3f694c9aa755722bac"><code>50ead96</code></a>
netty: Preserve early server handshake failure cause in logs</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/eae16b2517e294cde94c2a8b1171c0131fa7991a"><code>eae16b2</code></a>
unwrap ForwardingSubchannel during Picks (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12658">#12658</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/d9320eea62534e8a87319c1124a3a0f8443e43a8"><code>d9320ee</code></a>
netty: Add RFC 3986 support to the 'unix:' name resolver.</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/d5536b34b26788993c9b0ae4212f22a35a9ecf3c"><code>d5536b3</code></a>
netty: factor out some duplicated code into a helper method</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-java/compare/v1.79.0...v1.80.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 0c5a00ded4..738aea03b4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
     <dep.slf4j.version>2.0.17</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.12.Final</dep.netty-bom.version>
-    <dep.grpc-bom.version>1.79.0</dep.grpc-bom.version>
+    <dep.grpc-bom.version>1.80.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.21.2</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>

From e5482cd63d2043c0e418f1adc7bcd1e5192c5078 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?= <jbonofre@apache.org>
Date: Sun, 10 May 2026 08:15:56 +0200
Subject: [PATCH 18/76] MINOR: Fix Gandiva JNI build against Arrow C++ 24.0.0
 (#1140)

Arrow C++ 24.0.0 introduced two breaking changes for the JNI build:

1. `arrow::decimal()` was removed; replaced with `arrow::decimal128()`
in the Gandiva JNI source.

2. xsimd >= 14.0.0 is now a required dependency. The Docker image's
vcpkg registry only ships xsimd 13.2.0, so the Linux JNI CMake
configuration was failing. Fixed by passing `xsimd_SOURCE=BUNDLED` to
the Arrow C++ CMake configure step so Arrow downloads and uses xsimd
14.0.0 directly, and by passing the vcpkg toolchain file to the Arrow
C++ configure step so other vcpkg-managed dependencies are still
resolved correctly.
---
 .env                               | 2 +-
 compose.yaml                       | 3 ++-
 gandiva/src/main/cpp/jni_common.cc | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.env b/.env
index 2bd7255476..51daa0406c 100644
--- a/.env
+++ b/.env
@@ -53,4 +53,4 @@ MAVEN=3.9.9
 # Versions for various dependencies used to build artifacts
 # Keep in sync with apache/arrow
 ARROW_REPO_ROOT=./arrow
-VCPKG="4334d8b4c8916018600212ab4dd4bbdc343065d1"    # 2025.09.17 Release
+VCPKG="66c0373dc7fca549e5803087b9487edfe3aca0a1"    # 2026.01.16 Release
diff --git a/compose.yaml b/compose.yaml
index fb290b22fe..4fd825e5a5 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -109,5 +109,6 @@ services:
       ARROW_JAVA_CDATA: "ON"
       CCACHE_DIR: "/ccache"
     command:
-      ["git config --global --add safe.directory /arrow-java && \
+      ["/bin/bash", "-c",
+       "git config --global --add safe.directory /arrow-java &&
         /arrow-java/ci/scripts/jni_manylinux_build.sh /arrow-java /arrow /build/java /arrow-java/jni"]
diff --git a/gandiva/src/main/cpp/jni_common.cc b/gandiva/src/main/cpp/jni_common.cc
index 2851250072..ec4888a512 100644
--- a/gandiva/src/main/cpp/jni_common.cc
+++ b/gandiva/src/main/cpp/jni_common.cc
@@ -221,7 +221,7 @@ DataTypePtr ProtoTypeToDataType(const gandiva::types::ExtGandivaType& ext_type)
       return arrow::date64();
     case gandiva::types::DECIMAL:
       // TODO: error handling
-      return arrow::decimal(ext_type.precision(), ext_type.scale());
+      return arrow::decimal128(ext_type.precision(), ext_type.scale());
     case gandiva::types::TIME32:
       return ProtoTypeToTime32(ext_type);
     case gandiva::types::TIME64:

From 138e8521b17a2b83814b8714c7d8e0f94fe13656 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 05:20:41 +0200
Subject: [PATCH 19/76] MINOR: Bump com.fasterxml.jackson:jackson-bom from
 2.21.2 to 2.21.3 (#1133)

Bumps
[com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom)
from 2.21.2 to 2.21.3.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/374fbd08ee91a6c91626bae1d6497df21c89b541"><code>374fbd0</code></a>
[maven-release-plugin] prepare release jackson-bom-2.21.3</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/7059df78cc36832349acad026169ff890f4c718c"><code>7059df7</code></a>
Prep for 2.21.3 release</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/2fd60bdab3228f6b99dce81326d9fd7eaf587401"><code>2fd60bd</code></a>
Merge branch '2.20' into 2.21</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/b82a3640491f66be2e56bef377b5002cd9d1567b"><code>b82a364</code></a>
Merge branch '2.19' into 2.20</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/ef4e013e95fc64583b0a414711648a84fc50be46"><code>ef4e013</code></a>
Merge branch '2.18' into 2.19</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/536ae51c1db9dfbfc8dda697ccfd6545cf626d2b"><code>536ae51</code></a>
Post-release dep version bump</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/536c5339035643fdca46ddd947f253afd072f764"><code>536c533</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/426b778e5ea490d164e572a63319c7cf2f362f2f"><code>426b778</code></a>
[maven-release-plugin] prepare release jackson-bom-2.18.7</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/a73cda9be3e57f29c53fea748f1f867eaa1457ab"><code>a73cda9</code></a>
Prep for 2.18.7 release</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/76b4a05087a9e42eb1b26f59d5b7028b0496da5e"><code>76b4a05</code></a>
Post-release dep version bump</li>
<li>Additional commits viewable in <a
href="https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.2...jackson-bom-2.21.3">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 738aea03b4..a5058a6336 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,7 +101,7 @@ under the License.
     <dep.netty-bom.version>4.2.12.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.80.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>
-    <dep.jackson-bom.version>2.21.2</dep.jackson-bom.version>
+    <dep.jackson-bom.version>2.21.3</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>
     <dep.fbs.version>25.2.10</dep.fbs.version>
     <dep.avro.version>1.12.1</dep.avro.version>

From 5dc3ea699a4b7f8e4799c8ee318b96c9a9cc4f31 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 07:58:24 +0200
Subject: [PATCH 20/76] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-7 to
 1.5.7-8 (#1132)

Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-7 to 1.5.7-8.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/luben/zstd-jni/commit/0afb51a8420183cfb894063ea06cb08b91f63ce2"><code>0afb51a</code></a>
Use gcc on AIX</li>
<li><a
href="https://github.com/luben/zstd-jni/commit/1addabc11201bc2a33df8cbd4f90c0508a273d46"><code>1addabc</code></a>
v1.5.7-8</li>
<li><a
href="https://github.com/luben/zstd-jni/commit/3044e793cb449c0d55367a2232955136ee0d95f2"><code>3044e79</code></a>
More validation</li>
<li><a
href="https://github.com/luben/zstd-jni/commit/8257354d97008c8cee736246bd45277e0998ce06"><code>8257354</code></a>
Remove the check for OSGI when trying to load from JAR</li>
<li><a
href="https://github.com/luben/zstd-jni/commit/702105065a4973e4faf179a32dd535e7ef64a93a"><code>7021050</code></a>
Revert &quot;Test on RISE RISC-V runners&quot;</li>
<li><a
href="https://github.com/luben/zstd-jni/commit/9a1ed43541d6bd833eaa4c7537624e15fbc95151"><code>9a1ed43</code></a>
Test on RISE RISC-V runners</li>
<li><a
href="https://github.com/luben/zstd-jni/commit/92a338167cc6221b618f34e22010ec62ff2eea95"><code>92a3381</code></a>
ignore .DS_Store</li>
<li>See full diff in <a
href="https://github.com/luben/zstd-jni/compare/v1.5.7-7...v1.5.7-8">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 compression/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compression/pom.xml b/compression/pom.xml
index 9014b6913a..f3de6fc248 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
     <dependency>
       <groupId>com.github.luben</groupId>
       <artifactId>zstd-jni</artifactId>
-      <version>1.5.7-7</version>
+      <version>1.5.7-8</version>
     </dependency>
   </dependencies>
 </project>

From 5e2fb636514c708cf27bd367c8f452d72ab5fdef Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:45:59 +0200
Subject: [PATCH 21/76] MINOR: Bump
 com.google.api.grpc:proto-google-common-protos from 2.70.0 to 2.71.0 (#1144)

Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.70.0 to 2.71.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/647366865339840bbf1561e0f0cf776c7c88642a"><code>6473668</code></a>
chore(main): release 2.63.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3927">#3927</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/8015e7e48422b56f9c7e353447a7fcc75fe1787c"><code>8015e7e</code></a>
chore: update googleapis commit at Fri Oct 3 02:28:22 UTC 2025 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3923">#3923</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/48075a80cea71fd3bc7697bca106633fb433f8a1"><code>48075a8</code></a>
chore: Upper bound file deps change has chore type (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3949">#3949</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/1d7466332b5dc13fde6ed687247873135a5fa919"><code>1d74663</code></a>
deps: update google auth library dependencies to v1.40.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3945">#3945</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/7fb4f155eef478c1a66bc2f1fdecd7565d225b3e"><code>7fb4f15</code></a>
deps: Upgrade Google Http Java Client to v2.0.2 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3946">#3946</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/feabef32c4c45be0fb1db3615568365b902ece24"><code>feabef3</code></a>
feat(librariangen): add bazel package (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3940">#3940</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/8d6c1f915ba5f0c4ac9b89120e63dddd62e37a22"><code>8d6c1f9</code></a>
deps: Bump Guava to v33.5.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3943">#3943</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/180b9a017e839d5f3c34a980d7c0706cac30a38c"><code>180b9a0</code></a>
build(deps): update dependency
com.google.cloud:google-cloud-shared-config to...</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/3f548fbcee1b2fc3f9aff7d12977e7d364ecfcf9"><code>3f548fb</code></a>
deps: update upper bound dependencies file (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3947">#3947</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/a1b5ba3bec5d3facdb1b5550b82dcc1c3172bd8b"><code>a1b5ba3</code></a>
chore: Manage errorprone and j2objc versions in pom-parent (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3948">#3948</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/sdk-platform-java/compare/gax/v2.70.0...gax/v2.71.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.google.api.grpc:proto-google-common-protos&package-manager=maven&previous-version=2.70.0&new-version=2.71.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index d199f70da4..15b870905d 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>proto-google-common-protos</artifactId>
-      <version>2.70.0</version>
+      <version>2.71.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 30d528fa9992c9ed16a01853a2ed285f0efcbd21 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:52:35 +0200
Subject: [PATCH 22/76] MINOR: Bump checker.framework.version from 4.0.0 to
 4.1.0 (#1131)

Bumps `checker.framework.version` from 4.0.0 to 4.1.0.
Updates `org.checkerframework:checker-qual` from 4.0.0 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker-qual's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.1.0</h2>
<h2>Version 4.1.0 (2026-05-01)</h2>
<h3>User-visible changes</h3>
<p>Removed deprecated script <code>checker/bin-devel/build.sh</code>;
use <code>./gradlew assemble</code> instead.</p>
<p>Removed deprecated names &quot;builder&quot;,
&quot;object.construction&quot;, and &quot;objectconstruction&quot; for
the Called Methods Checker.</p>
<h3>Implementation details</h3>
<p>New method annotation <code>@DoesNotUnrefineReceiver</code>.</p>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new method <code>hasDoesNotUnrefineReceiver()</code>.</li>
<li><code>isAliasedTypeAnnotation()</code> is now protected rather than
public.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/6890">#6890</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7364">#7364</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7488">#7488</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker-qual's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.1.0 (2026-05-01)</h2>
<h3>User-visible changes</h3>
<p>Removed deprecated script <code>checker/bin-devel/build.sh</code>;
use <code>./gradlew assemble</code>
instead.</p>
<p>Removed deprecated names &quot;builder&quot;,
&quot;object.construction&quot;, and
&quot;objectconstruction&quot; for the Called Methods Checker.</p>
<h3>Implementation details</h3>
<p>New method annotation <code>@DoesNotUnrefineReceiver</code>.</p>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new method <code>hasDoesNotUnrefineReceiver()</code>.</li>
<li><code>isAliasedTypeAnnotation()</code> is now protected rather than
public.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/6890">#6890</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7364">#7364</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7488">#7488</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/b8a7ca60a241c37d6889e8ecd38ba5fe6234e4d6"><code>b8a7ca6</code></a>
new release 4.1.0</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/f1563d2caeb6120b97b2dab32bc592ecf23b0848"><code>f1563d2</code></a>
Update for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/786773754bb83c294f3c04629027660fb289d699"><code>7867737</code></a>
Set environment variable <code>GH_TOKEN</code></li>
<li><a
href="https://github.com/typetools/checker-framework/commit/771b037663bdd490f04245437dff8ae6ebb1c64b"><code>771b037</code></a>
Tweak documentation (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7668">#7668</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/71735d1ec23ef765d8e559c92cb736630b0efaa3"><code>71735d1</code></a>
Fix documentation typo</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6465706e3b4a69f95b2421da4284b47ccb49b81a"><code>6465706</code></a>
Make <code>isAliasedTypeAnnotation()</code> protected (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7667">#7667</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/8af69bca25fbd1d293a46ea224567feabce34370"><code>8af69bc</code></a>
Update cimg/base Docker tag to v2026.04</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/fa3ad9b59ac273df809e390fbcf2667e7977cce7"><code>fa3ad9b</code></a>
How to update the Hevea version number</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/18002bf382ef24f3a4605dc17725bd9909c4497f"><code>18002bf</code></a>
Use environment variable</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/dd8381c0344e7a3befb65c1e13b19b37aeb636c7"><code>dd8381c</code></a>
Set up GitHub Actions CI</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.0.0...checker-framework-4.1.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.checkerframework:checker` from 4.0.0 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.1.0</h2>
<h2>Version 4.1.0 (2026-05-01)</h2>
<h3>User-visible changes</h3>
<p>Removed deprecated script <code>checker/bin-devel/build.sh</code>;
use <code>./gradlew assemble</code> instead.</p>
<p>Removed deprecated names &quot;builder&quot;,
&quot;object.construction&quot;, and &quot;objectconstruction&quot; for
the Called Methods Checker.</p>
<h3>Implementation details</h3>
<p>New method annotation <code>@DoesNotUnrefineReceiver</code>.</p>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new method <code>hasDoesNotUnrefineReceiver()</code>.</li>
<li><code>isAliasedTypeAnnotation()</code> is now protected rather than
public.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/6890">#6890</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7364">#7364</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7488">#7488</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.1.0 (2026-05-01)</h2>
<h3>User-visible changes</h3>
<p>Removed deprecated script <code>checker/bin-devel/build.sh</code>;
use <code>./gradlew assemble</code>
instead.</p>
<p>Removed deprecated names &quot;builder&quot;,
&quot;object.construction&quot;, and
&quot;objectconstruction&quot; for the Called Methods Checker.</p>
<h3>Implementation details</h3>
<p>New method annotation <code>@DoesNotUnrefineReceiver</code>.</p>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new method <code>hasDoesNotUnrefineReceiver()</code>.</li>
<li><code>isAliasedTypeAnnotation()</code> is now protected rather than
public.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/6890">#6890</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7364">#7364</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7488">#7488</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/b8a7ca60a241c37d6889e8ecd38ba5fe6234e4d6"><code>b8a7ca6</code></a>
new release 4.1.0</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/f1563d2caeb6120b97b2dab32bc592ecf23b0848"><code>f1563d2</code></a>
Update for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/786773754bb83c294f3c04629027660fb289d699"><code>7867737</code></a>
Set environment variable <code>GH_TOKEN</code></li>
<li><a
href="https://github.com/typetools/checker-framework/commit/771b037663bdd490f04245437dff8ae6ebb1c64b"><code>771b037</code></a>
Tweak documentation (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7668">#7668</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/71735d1ec23ef765d8e559c92cb736630b0efaa3"><code>71735d1</code></a>
Fix documentation typo</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6465706e3b4a69f95b2421da4284b47ccb49b81a"><code>6465706</code></a>
Make <code>isAliasedTypeAnnotation()</code> protected (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7667">#7667</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/8af69bca25fbd1d293a46ea224567feabce34370"><code>8af69bc</code></a>
Update cimg/base Docker tag to v2026.04</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/fa3ad9b59ac273df809e390fbcf2667e7977cce7"><code>fa3ad9b</code></a>
How to update the Hevea version number</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/18002bf382ef24f3a4605dc17725bd9909c4497f"><code>18002bf</code></a>
Use environment variable</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/dd8381c0344e7a3befb65c1e13b19b37aeb636c7"><code>dd8381c</code></a>
Set up GitHub Actions CI</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.0.0...checker-framework-4.1.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index a5058a6336..e0754f7789 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
     <checkstyle.version>10.23.0</checkstyle.version>
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
-    <checker.framework.version>4.0.0</checker.framework.version>
+    <checker.framework.version>4.1.0</checker.framework.version>
     <logback.version>1.5.32</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>

From b068e28343d54604b1966e916a376ea4c1491f48 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:52:55 +0200
Subject: [PATCH 23/76] MINOR: Bump com.github.ben-manes.caffeine:caffeine from
 3.2.3 to 3.2.4 (#1130)

Bumps
[com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine)
from 3.2.3 to 3.2.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ben-manes/caffeine/releases">com.github.ben-manes.caffeine:caffeine's
releases</a>.</em></p>
<blockquote>
<h2>3.2.4</h2>
<ul>
<li>Improved access expiration's read performance by avoiding false
sharing effects caused by the timestamp update</li>
<li>Fixed head-of-line blocking of expiration queues caused by in-flight
async entries (<a
href="https://redirect.github.com/ben-manes/caffeine/issues/1954">#1954</a>)</li>
<li>Fixed various minor issues found using AI audits</li>
<li>Added <a
href="https://docs.oracle.com/en/java/javase/25/docs/api//java.base/java/io/ObjectInputFilter.html">ObjectInputFilter</a>
support to JCache</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ben-manes/caffeine/commit/836b65c0a83e5d1641ded9c6de578654bc04b2e9"><code>836b65c</code></a>
use a consistent expiration tolerance calculation</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/0dc7daf962730048fe46ae4626827afbb97ddf92"><code>0dc7daf</code></a>
resurrect in-flight async entries on expiration</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/0bac8b54fd634ffe95d35ccd1d94daba95e7b369"><code>0bac8b5</code></a>
handle head-of-line blocking of expiration queues (fixes <a
href="https://redirect.github.com/ben-manes/caffeine/issues/1954">#1954</a>)</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/ff258366de0a89129152ead72524ce88f8fca67b"><code>ff25836</code></a>
test polish</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/f3a6176e2e3a7fe085214472858c6029c108fc3f"><code>f3a6176</code></a>
Fix JCache close/createCache races and recursive teardown</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/622fbe7dbf7606f114b956205706935be2fcf3c8"><code>622fbe7</code></a>
Fix removal in identity views and widen hill-climber counters</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/8da5a7a05d8b725c9dbd577be8ffaf2372aa7e23"><code>8da5a7a</code></a>
defer weighing the entry until after the putIfAbsent hit fast-path</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/94ad0ff8556c9923a8d9746ab85af9ee830dd051"><code>94ad0ff</code></a>
Record eviction stats before notifying the removal listener
consistently</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/f94c0113d0c98dc0afaadf1f6748ea280aa4dff7"><code>f94c011</code></a>
Auto-assert eviction stats alongside
notifications.withCause.exclusively</li>
<li><a
href="https://github.com/ben-manes/caffeine/commit/2e945e090fbff4f96251dfe1bacba3780a5bdb0c"><code>2e945e0</code></a>
Skip timestamp writes within tolerance on the read path.</li>
<li>Additional commits viewable in <a
href="https://github.com/ben-manes/caffeine/compare/v3.2.3...v3.2.4">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 1f9bc3e00e..a813b2e168 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -176,7 +176,7 @@ under the License.
     <dependency>
       <groupId>com.github.ben-manes.caffeine</groupId>
       <artifactId>caffeine</artifactId>
-      <version>3.2.3</version>
+      <version>3.2.4</version>
     </dependency>
 
     <dependency>

From e6d9248447ef90d2d9a1412bfdee7019377e0603 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:53:10 +0200
Subject: [PATCH 24/76] MINOR: Bump
 com.gradle:common-custom-user-data-maven-extension from 2.1.0 to 2.2.0
 (#1128)

Bumps
[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)
from 2.1.0 to 2.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/common-custom-user-data-maven-extension/releases">com.gradle:common-custom-user-data-maven-extension's
releases</a>.</em></p>
<blockquote>
<h2>2.2.0</h2>
<ul>
<li>[NEW] Add AI tag to the Build Scan when invoked by an AI Agent</li>
<li>[NEW] Add custom value to the Build Scan indicating which AI Agent
invoked the build</li>
<li>[NEW] Add link in Build Scan to GitHub PR</li>
<li>[NEW] For GitHub PRs, capture <code>GITHUB_BASE_REF</code> as the
value <code>PR base branch</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/d594c600651c22fb242ae7989704dedd55354941"><code>d594c60</code></a>
[maven-release-plugin] prepare release v2.2.0</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/0a48e7af84f66dbcab13a1ed922b37ae20036cea"><code>0a48e7a</code></a>
Merge pull request <a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/375">#375</a>
from gradle/cj/github-pr-base-branch</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/02f60010470630dc040841fb3103b16307b1c22f"><code>02f6001</code></a>
Capture GITHUB_BASE_REF as 'PR base branch' for GitHub PR builds</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/fc03fa942b75a6e85d20055d193874f134d3953f"><code>fc03fa9</code></a>
Add recent feature additions to changes.md</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/15015551ae69bc5cc65d5c00e1e38f84868beb44"><code>1501555</code></a>
Merge pull request <a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/370">#370</a>
from gradle/add-ai-agent-metadata</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/de773aef7d7ee25182e8233dff2624c45bb2f1bf"><code>de773ae</code></a>
[Renovate Bot] Update dependency org.apache.maven:maven-core to v3.9.15
(<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/374">#374</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/074832a77b9f4695f05d9b7e58955a787451c674"><code>074832a</code></a>
[Renovate Bot] Update dependency maven to v3.9.15 (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/373">#373</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/9de6cf166eab1220a012322d51ce9628820e08b4"><code>9de6cf1</code></a>
Merge pull request <a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/372">#372</a>
from gradle/renovate/github-actions</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/ea1e3fcf40fdf65864361024935fee8f6032b6f8"><code>ea1e3fc</code></a>
[Renovate Bot] Update actions/upload-artifact digest to 043fb46</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/438484954c53f3c0aff0c913de0cc4b0d7ddcaf6"><code>4384849</code></a>
Match AI tags/values to CCUD Gradle</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/common-custom-user-data-maven-extension/compare/v2.1.0...v2.2.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .mvn/extensions.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index f52dfafb4a..e909f05105 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -28,6 +28,6 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>common-custom-user-data-maven-extension</artifactId>
-        <version>2.1.0</version>
+        <version>2.2.0</version>
     </extension>
 </extensions>

From 331e9ee0968ab92499ed362ed276fa85e60b870d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:53:29 +0200
Subject: [PATCH 25/76] MINOR: Bump commons-codec:commons-codec from 1.21.0 to
 1.22.0 (#1127)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[commons-codec:commons-codec](https://github.com/apache/commons-codec)
from 1.21.0 to 1.22.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt">commons-codec:commons-codec's
changelog</a>.</em></p>
<blockquote>
<h2>Apache Commons Codec 1.22.0 Release Notes</h2>
<p>The Apache Commons Codec team is pleased to announce the release of
Apache Commons Codec 1.22.0.</p>
<p>The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In
addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.</p>
<p>This is a feature and maintenance release. Java 8 or later is
required.</p>
<h2>New features</h2>
<ul>
<li>CODEC-326: Add Base58 support. Thanks to Inkeet, Gary Gregory, Wolff
Bock von Wuelfingen.</li>
<li>
<pre><code> Add
BaseNCodecInputStream.AbstracBuilder.setByteArray(byte[]). Thanks to
Gary Gregory.
</code></pre>
</li>
<li>CODEC-335: Add GitIdentifiers to compute Git blob and tree object
identifiers. Thanks to Piotr P. Karwasz, Gary Gregory.</li>
</ul>
<h2>Fixed Bugs</h2>
<ul>
<li>CODEC-249: Fix Incorrect transform of CH digraph according Metaphone
basic rules <a
href="https://redirect.github.com/apache/commons-codec/issues/423">#423</a>.
Thanks to Shalu Jha, Andrey, Gary Gregory.</li>
<li>CODEC-317: ColognePhonetic can create duplicate consecutive codes in
some cases. Thanks to DRUser123, Shalu Jha, Gary Gregory.</li>
<li>
<pre><code> Add boundary tests for BinaryCodec.fromAscii partial-bit
inputs [#425](https://github.com/apache/commons-codec/issues/425).
Thanks to fancying, Gary Gregory.
</code></pre>
</li>
<li>CODEC-336: Base64.Builder.setUrlSafe(boolean) Javadoc incorrectly
states null is accepted for primitive boolean parameter. Thanks to
Partha Paul, Gary Gregory.</li>
</ul>
<h2>Changes</h2>
<ul>
<li>
<pre><code> Bump org.apache.commons:commons-parent from 96 to 98. Thanks
to Gary Gregory.
</code></pre>
</li>
</ul>
<p>For complete information on Apache Commons Codec, including
instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons Codec
website:</p>
<p><a
href="https://commons.apache.org/proper/commons-codec/">https://commons.apache.org/proper/commons-codec/</a></p>
<p>Download page: <a
href="https://commons.apache.org/proper/commons-codec/download_codec.cgi">https://commons.apache.org/proper/commons-codec/download_codec.cgi</a></p>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/apache/commons-codec/commit/81a6295f071df5819893422a397d94bc396f2edd"><code>81a6295</code></a>
Prepare for the release candidate 1.22.0 RC1</li>
<li><a
href="https://github.com/apache/commons-codec/commit/73104b011a9758896904831f9b1bd29aad077f11"><code>73104b0</code></a>
Prepare for the next release candidate</li>
<li><a
href="https://github.com/apache/commons-codec/commit/8e36214fa2760d37e4e9c83336ed5bb324c23482"><code>8e36214</code></a>
In-line single use test local variables</li>
<li><a
href="https://github.com/apache/commons-codec/commit/9bd67e787d88705baa26e85f3a9609dec015ba5b"><code>9bd67e7</code></a>
Use vararg syntax</li>
<li><a
href="https://github.com/apache/commons-codec/commit/25e52b06a3c24dc06216e7d29321a2f01c60ec6f"><code>25e52b0</code></a>
Use vararg syntax</li>
<li><a
href="https://github.com/apache/commons-codec/commit/e2ebaca8b30d1d04d0eb6a4e811a6d26631f4d31"><code>e2ebaca</code></a>
Bump github/codeql-action from 4.35.1 to 4.35.2</li>
<li><a
href="https://github.com/apache/commons-codec/commit/33998a05a8adc84ca944bad2e5c7215309d1477b"><code>33998a0</code></a>
Bump actions/upload-artifact from 7.0.0 to 7.0.1</li>
<li><a
href="https://github.com/apache/commons-codec/commit/50c6583280cb3ed67407dcaeb31df4f8fa8ede20"><code>50c6583</code></a>
Bump actions/cache from 5.0.4 to 5.0.5</li>
<li><a
href="https://github.com/apache/commons-codec/commit/b2be3a82b2d0902e89718a56c6afb5850d020668"><code>b2be3a8</code></a>
Add <a
href="https://github.com/Override"><code>@​Override</code></a></li>
<li><a
href="https://github.com/apache/commons-codec/commit/20f09bfcfdce88760ec9be095b848e85d9084acf"><code>20f09bf</code></a>
Use final.</li>
<li>Additional commits viewable in <a
href="https://github.com/apache/commons-codec/compare/rel/commons-codec-1.21.0...rel/commons-codec-1.22.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 vector/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vector/pom.xml b/vector/pom.xml
index 4d247961c9..9b40e8820c 100644
--- a/vector/pom.xml
+++ b/vector/pom.xml
@@ -60,7 +60,7 @@ under the License.
     <dependency>
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>
-      <version>1.21.0</version>
+      <version>1.22.0</version>
     </dependency>
     <dependency>
       <groupId>org.apache.arrow</groupId>

From 0f7665f2b78a5f6bcfb37924fbee05a45adfb5f8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 12 May 2026 09:31:15 +0200
Subject: [PATCH 26/76] MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.37 to
 11.37.1 (#1143)

Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.37 to 11.37.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt">com.nimbusds:oauth2-oidc-sdk's
changelog</a>.</em></p>
<blockquote>
<p>version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.</p>
<p>version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.</p>
<p>version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.</p>
<p>version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).</p>
<p>version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.</p>
<p>version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.</p>
<p>version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.</p>
<p>version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.</p>
<p>version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.</p>
<p>version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.</p>
<p>version 2.9 (2013-09-17)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/2a0f2715d0943405b445f2ccf001a072044ef685"><code>2a0f271</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/fac7277ad412ee74e2e46eb89f6f75de6228a4e4"><code>fac7277</code></a>
Bumps Nimbus JOSE+JWT, BouncyCastle</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/517deb7444d54ee9c11c2bab42715fbc87871714"><code>517deb7</code></a>
[maven-release-plugin] prepare release 11.37.1</li>
<li>See full diff in <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.37.1..11.37">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.nimbusds:oauth2-oidc-sdk&package-manager=maven&previous-version=11.37&new-version=11.37.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index a813b2e168..ea33091101 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -182,7 +182,7 @@ under the License.
     <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>oauth2-oidc-sdk</artifactId>
-      <version>11.37</version>
+      <version>11.37.1</version>
     </dependency>
 
   </dependencies>

From 3bc34b041761081ac32a7cd3b167f9ab8b628677 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 13 May 2026 13:51:48 +0200
Subject: [PATCH 27/76] MINOR: Bump commons-io:commons-io from 2.21.0 to 2.22.0
 (#1126)

Bumps commons-io:commons-io from 2.21.0 to 2.22.0.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=commons-io:commons-io&package-manager=maven&previous-version=2.21.0&new-version=2.22.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dataset/pom.xml                     | 2 +-
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dataset/pom.xml b/dataset/pom.xml
index 7a0210ce95..cb889ecd7d 100644
--- a/dataset/pom.xml
+++ b/dataset/pom.xml
@@ -156,7 +156,7 @@ under the License.
     <dependency>
       <groupId>commons-io</groupId>
       <artifactId>commons-io</artifactId>
-      <version>2.21.0</version>
+      <version>2.22.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index ea33091101..237b25d0e5 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -105,7 +105,7 @@ under the License.
     <dependency>
       <groupId>commons-io</groupId>
       <artifactId>commons-io</artifactId>
-      <version>2.21.0</version>
+      <version>2.22.0</version>
       <scope>test</scope>
     </dependency>
 

From af86cd3a7c17237368ea8411ed32e21b262c5b7b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 15:22:37 +0200
Subject: [PATCH 28/76] MINOR: Bump org.apache.calcite.avatica:avatica from
 1.26.0 to 1.27.0 (#986)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[org.apache.calcite.avatica:avatica](https://github.com/apache/calcite-avatica)
from 1.26.0 to 1.27.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/apache/calcite-avatica/commit/7754d942f858e5521966c1771cf2e111e8a7ef87"><code>7754d94</code></a>
[CALCITE-7200] Release Avatica 1.27.0</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/1e05be2bbe3e63eafe7b157beb8cbe00abaa15f2"><code>1e05be2</code></a>
[CALCITE-7171] Update Jackson from 2.15.4 to 2.18.4.1 and switch to
using jac...</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/9698a96a36275736f48afc0a0b0a81dfaadc77a6"><code>9698a96</code></a>
[CALCITE-7177] Update Guava from 33.4.0-jre to 33.4.8-jre in
Avatica</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/0aec6258a2cdae73463c69810dbfce3c26792088"><code>0aec625</code></a>
Bump rexml from 3.4.1 to 3.4.2 in /site</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/5954d1ae00a4be4947c1040f8e6b0b4372c628c1"><code>5954d1a</code></a>
[CALCITE-7165] Update OWASP plugin version to 12.1.3 for JDKs &gt;=
11</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/7b6f14c9a79ad18820482f43442e14f72566afb4"><code>7b6f14c</code></a>
[CALCITE-7172] Update chekstyle version from 10.19.0 to 10.26.1 in
Avatica</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/3ee1fd772c91a6eeaf0dbabcb27a6f6240ac7970"><code>3ee1fd7</code></a>
[CALCITE-7169] Update protobuf from 3.25.5 to 3.25.8 in Avatica</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/927dc10699d257457a234078f75e2fafe671be64"><code>927dc10</code></a>
[CALCITE-7168] Update httpcore5 from 5.3.1 to 5.3.5 in Avatica</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/458189ff52e2c2624b3d3d1096cfe1fc29f47af8"><code>458189f</code></a>
[CALCITE-7167] Upgrade Jetty from 9.4.56.v20240826 to 9.4.58.v20250814
in Ava...</li>
<li><a
href="https://github.com/apache/calcite-avatica/commit/592a39e43b5dd59b3eaf9f9266cb02a9c4ce4065"><code>592a39e</code></a>
[CALCITE-7166] Update Gradle from 8.7 to 8.14.3 in Avatica</li>
<li>Additional commits viewable in <a
href="https://github.com/apache/calcite-avatica/compare/rel/avatica-1.26.0...rel/avatica-1.27.0">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré <jbonofre@apache.org>
---
 flight/flight-sql-jdbc-core/pom.xml           |  2 +-
 ...owFlightJdbcVectorSchemaRootResultSet.java |  2 +-
 .../accessor/ArrowFlightJdbcAccessor.java     | 24 +++++++++++++++++++
 flight/flight-sql-jdbc-driver/pom.xml         |  1 +
 4 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 237b25d0e5..96a11f2b9a 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -159,7 +159,7 @@ under the License.
     <dependency>
       <groupId>org.apache.calcite.avatica</groupId>
       <artifactId>avatica</artifactId>
-      <version>1.26.0</version>
+      <version>1.27.0</version>
     </dependency>
 
     <dependency>
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
index 49334951de..5d02d6e843 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
@@ -128,7 +128,7 @@ public Object getObject(int columnIndex) throws SQLException {
     if (metaData.type.id == Types.TIMESTAMP_WITH_TIMEZONE) {
       return accessor.getTimestamp(localCalendar);
     } else {
-      return AvaticaSite.get(accessor, metaData.type.id, localCalendar);
+      return AvaticaSite.get(accessor, metaData.type.id, true, localCalendar);
     }
   }
 
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java
index f0fa55fa82..cd762fb1ac 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java
@@ -36,6 +36,10 @@
 import java.util.Calendar;
 import java.util.Map;
 import java.util.function.IntSupplier;
+import org.joou.UByte;
+import org.joou.UInteger;
+import org.joou.ULong;
+import org.joou.UShort;
 
 /** Base Jdbc Accessor. */
 public abstract class ArrowFlightJdbcAccessor implements Accessor {
@@ -99,6 +103,26 @@ public long getLong() throws SQLException {
     throw getOperationNotSupported(this.getClass());
   }
 
+  @Override
+  public UByte getUByte() throws SQLException {
+    throw getOperationNotSupported(this.getClass());
+  }
+
+  @Override
+  public UShort getUShort() throws SQLException {
+    throw getOperationNotSupported(this.getClass());
+  }
+
+  @Override
+  public UInteger getUInt() throws SQLException {
+    throw getOperationNotSupported(this.getClass());
+  }
+
+  @Override
+  public ULong getULong() throws SQLException {
+    throw getOperationNotSupported(this.getClass());
+  }
+
   @Override
   public float getFloat() throws SQLException {
     throw getOperationNotSupported(this.getClass());
diff --git a/flight/flight-sql-jdbc-driver/pom.xml b/flight/flight-sql-jdbc-driver/pom.xml
index ff5763702b..801089d090 100644
--- a/flight/flight-sql-jdbc-driver/pom.xml
+++ b/flight/flight-sql-jdbc-driver/pom.xml
@@ -159,6 +159,7 @@ under the License.
                   <artifact>org.apache.calcite.avatica:*</artifact>
                   <excludes>
                     <exclude>META-INF/services/java.sql.Driver</exclude>
+                    <exclude>META-INF/README.txt</exclude>
                   </excludes>
                 </filter>
                 <filter>

From 8c36d02205974c0cb912b11383e26f141ee2971e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 17:45:09 +0200
Subject: [PATCH 29/76] MINOR: Bump org.apache:apache from 37 to 38 (#1156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [org.apache:apache](https://github.com/apache/maven-apache-parent)
from 37 to 38.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/maven-apache-parent/releases">org.apache:apache's
releases</a>.</em></p>
<blockquote>
<h2>Apache Parent POM version 38</h2>
<!-- raw HTML omitted -->
<h2>👻 Maintenance</h2>
<ul>
<li>Update banner links (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/576">#576</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>Bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to
3.10.1 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/578">#578</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-invoker-plugin from 3.9.1 to
3.10.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/575">#575</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to
3.5.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/572">#572</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/573">#573</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump
org.apache.apache.resources:apache-source-release-assembly-descriptor
from 1.7 to 1.8 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/571">#571</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump version.maven-surefire from 3.5.4 to 3.5.5 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/570">#570</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-dependency-plugin from 3.9.0 to
3.10.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/568">#568</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to
3.15.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/567">#567</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/apache/maven-apache-parent/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache:apache&package-manager=maven&previous-version=37&new-version=38)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 bom/pom.xml | 2 +-
 pom.xml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index d97cc291c2..083ee1e0de 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -23,7 +23,7 @@ under the License.
   <parent>
     <groupId>org.apache</groupId>
     <artifactId>apache</artifactId>
-    <version>37</version>
+    <version>38</version>
     <relativePath/>
   </parent>
 
diff --git a/pom.xml b/pom.xml
index e0754f7789..d6d36e5607 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@ under the License.
   <parent>
     <groupId>org.apache</groupId>
     <artifactId>apache</artifactId>
-    <version>37</version>
+    <version>38</version>
   </parent>
 
   <groupId>org.apache.arrow</groupId>

From c49d97625524a9ba3cb72380f88a2ee12f435695 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 17:45:26 +0200
Subject: [PATCH 30/76] MINOR: Bump org.immutables:value-annotations from
 2.12.1 to 2.12.2 (#1157)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[org.immutables:value-annotations](https://github.com/immutables/immutables)
from 2.12.1 to 2.12.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/immutables/immutables/releases">org.immutables:value-annotations's
releases</a>.</em></p>
<blockquote>
<h2>2.12.2</h2>
<h2>Maintenance release</h2>
<h3>What's Changed</h3>
<ul>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1642">#1642</a>
Fix to find nested elements on plain element with nested elements with
mongo backend by <a
href="https://github.com/rgatbert"><code>@​rgatbert</code></a> in <a
href="https://redirect.github.com/immutables/immutables/pull/1643">immutables/immutables#1643</a></li>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1642">#1642</a>
Fix for further problems to find nested elements on plain element with
nested elements with mongo backend by <a
href="https://github.com/rgatbert"><code>@​rgatbert</code></a> in <a
href="https://redirect.github.com/immutables/immutables/pull/1644">immutables/immutables#1644</a></li>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1645">#1645</a>
enhance docs about records for implementationNestedInBuilder by <a
href="https://github.com/bmarwell"><code>@​bmarwell</code></a> in <a
href="https://redirect.github.com/immutables/immutables/pull/1646">immutables/immutables#1646</a></li>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1655">#1655</a>
Fix TYPE_USE <code>@Nullable</code> on concrete array types by <a
href="https://github.com/viditochani"><code>@​viditochani</code></a> in
<a
href="https://redirect.github.com/immutables/immutables/pull/1658">immutables/immutables#1658</a></li>
</ul>
<h3>New Contributors</h3>
<ul>
<li><a href="https://github.com/rgatbert"><code>@​rgatbert</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutables/immutables/pull/1643">immutables/immutables#1643</a></li>
<li><a href="https://github.com/bmarwell"><code>@​bmarwell</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutables/immutables/pull/1646">immutables/immutables#1646</a></li>
<li><a
href="https://github.com/viditochani"><code>@​viditochani</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutables/immutables/pull/1658">immutables/immutables#1658</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutables/immutables/compare/2.12.1...2.12.2">https://github.com/immutables/immutables/compare/2.12.1...2.12.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/immutables/immutables/commit/6f1918f2ed84bf110fcb9f3dcd5fcf630bcad6d7"><code>6f1918f</code></a>
v2.12.2</li>
<li><a
href="https://github.com/immutables/immutables/commit/71d350b769c0b391c38b3fe35564ced71caff065"><code>71d350b</code></a>
node24 v5 github actions</li>
<li><a
href="https://github.com/immutables/immutables/commit/bb26b408e435b7c7c39ce72c945b5e5b2b34e9b6"><code>bb26b40</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1655">#1655</a>
additional ECJ workaround</li>
<li><a
href="https://github.com/immutables/immutables/commit/da6acc841b58abdbf8ad76f96aefa94f17f6fa15"><code>da6acc8</code></a>
Merge pull request <a
href="https://redirect.github.com/immutables/immutables/issues/1658">#1658</a>
from viditochani/fix-concrete-array-nullable</li>
<li><a
href="https://github.com/immutables/immutables/commit/ccd68963ab2a234b7b7f60006938cd4d727b89b5"><code>ccd6896</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1655">#1655</a>
Fix TYPE_USE <a
href="https://github.com/Nullable"><code>@​Nullable</code></a> on
concrete array types</li>
<li><a
href="https://github.com/immutables/immutables/commit/78f43d47541af1f535a6ed48578651a609481c87"><code>78f43d4</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1649">#1649</a>
Jackson3 meta-annotated package</li>
<li><a
href="https://github.com/immutables/immutables/commit/f3fe649b15d96500f8d1c93ad02cace88747cf13"><code>f3fe649</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1640">#1640</a>
Where.WITH_COPY for copy methods</li>
<li><a
href="https://github.com/immutables/immutables/commit/83cdfdb423100ed823f965130cd9153aa3a56b2a"><code>83cdfdb</code></a>
Change JUnit5 dependency to use BOM</li>
<li><a
href="https://github.com/immutables/immutables/commit/cf04f2c106e35edf1a313900a61c80e7f0913637"><code>cf04f2c</code></a>
Upgrade jackson3: 3.0.1 -&gt; 3.1.0</li>
<li><a
href="https://github.com/immutables/immutables/commit/31308e78e1cd39eba120b7e615723de24b3c1507"><code>31308e7</code></a>
Upgrade jackson: 2.19.2 -&gt; 2.21.2</li>
<li>Additional commits viewable in <a
href="https://github.com/immutables/immutables/compare/2.12.1...2.12.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.immutables:value-annotations&package-manager=maven&previous-version=2.12.1&new-version=2.12.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index d6d36e5607..dabb02594a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -183,7 +183,7 @@ under the License.
       <dependency>
         <groupId>org.immutables</groupId>
         <artifactId>value-annotations</artifactId>
-        <version>2.12.1</version>
+        <version>2.12.2</version>
         <scope>provided</scope>
       </dependency>
       <dependency>

From d88adb33b00e8a7c3b743312b11c05ed36d2bd37 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 18:42:53 +0200
Subject: [PATCH 31/76] MINOR: Bump io.netty:netty-bom from 4.2.12.Final to
 4.2.13.Final (#1155)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.12.Final to 4.2.13.Final.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netty/netty/releases">io.netty:netty-bom's
releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.13.Final</h2>
<h2>CVEs Fixed</h2>
<ul>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-rgrr-p7gp-5xj7">CVE-2026-42586</a>
(netty-codec-redis)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr">CVE-2026-42578</a>
(netty-handler-proxy)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-rwm7-x88c-3g2p">CVE-2026-42577</a>
(netty-transport-native-epoll)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv">CVE-2026-42587</a>
(netty-codec-http, netty-codec-http2)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv">CVE-2026-41417</a>
(netty-codec-http)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9">CVE-2026-42581</a>
(netty-codec-http)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723">CVE-2026-42580</a>
(netty-codec-http)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv">CVE-2026-42585</a>
(netty-codec-http)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm">CVE-2026-42579</a>
(netty-codec-dns)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw">CVE-2026-42582</a>
(netty-codec-http3)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6">CVE-2026-42583</a>
(netty-codec, netty-codec-compression)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3">CVE-2026-42584</a>
(netty-codec-http)</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-jfg9-48mv-9qgx">CVE-2026-44248</a>
(netty-codec-mqtt)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Kqueue: sendfile EINTR doesn't advance offset — data duplication by
<a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16544">netty/netty#16544</a></li>
<li>Replace usage of strerror with thread-safe alternative by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16547">netty/netty#16547</a></li>
<li>Fix implementation of strerror_r_xsi for GNU by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16546">netty/netty#16546</a></li>
<li>Lazy init ArrayList in DefaultHeaders.getAll by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16526">netty/netty#16526</a></li>
<li>Less logging in AWS-LC build by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16565">netty/netty#16565</a></li>
<li>Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating
the SSLContext by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16545">netty/netty#16545</a></li>
<li>Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder
on heartbeat by <a
href="https://github.com/netty-project-bot"><code>@​netty-project-bot</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16543">netty/netty#16543</a></li>
<li>Avoid leak in PemReader on OutOfDirectMemoryError by <a
href="https://github.com/raipc"><code>@​raipc</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16551">netty/netty#16551</a></li>
<li>IoUring: Disable test while we debug to unblock other builds by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16581">netty/netty#16581</a></li>
<li>Include user properties and subscription IDs in
MqttProperties#isEmpty by <a
href="https://github.com/ShadowySpirits"><code>@​ShadowySpirits</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16575">netty/netty#16575</a></li>
<li>Native DNS resolver: Guard against malloc failures by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16559">netty/netty#16559</a></li>
<li>Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by <a
href="https://github.com/netty-project-bot"><code>@​netty-project-bot</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16578">netty/netty#16578</a></li>
<li>Fix parsing HTTP chunks with multiple extensions by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16579">netty/netty#16579</a></li>
<li>Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in
/codec-native-quic by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/netty/netty/pull/16572">netty/netty#16572</a></li>
<li>Revert to PR build to Ubuntu 22.04 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16595">netty/netty#16595</a></li>
<li>Native transports: Correctly create pipe when pipe2 is not supported
by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16592">netty/netty#16592</a></li>
<li>Epoll: Cleanup code to always return negative value on failure by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16591">netty/netty#16591</a></li>
<li>Fix component search fast path by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16548">netty/netty#16548</a></li>
<li>Stabilize read-only toStringMultipleThreads1 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16608">netty/netty#16608</a></li>
<li>Stabilize more AbstractByteBufTests by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16611">netty/netty#16611</a></li>
<li>Remove note about needing 256-bit for PQC by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16605">netty/netty#16605</a></li>
<li>Stabilize testSessionInvalidate for Conscrypt by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16615">netty/netty#16615</a></li>
<li>Quic: Correctly handle SSL_CTX_new failures by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16622">netty/netty#16622</a></li>
<li>Make LocalIoHandle public by <a
href="https://github.com/rdicroce"><code>@​rdicroce</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16621">netty/netty#16621</a></li>
<li>Quic: Fix shadowing of variable which leads to incorrectly handling
errors by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16623">netty/netty#16623</a></li>
<li>Auto-port 4.2: Use stream error for maxContentLength exceeded in
InboundHttp2ToHttpAdapter by <a
href="https://github.com/netty-project-bot"><code>@​netty-project-bot</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16629">netty/netty#16629</a></li>
<li>Fix <code>shutdownInput</code> bug in kqueue for empty recv buffer
by <a href="https://github.com/chrisvest"><code>@​chrisvest</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16630">netty/netty#16630</a></li>
<li>fix FFM address semantics in directBufferAddress by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16603">netty/netty#16603</a></li>
<li>HTTP2: Ensure HTTP2 preface is always send as first message by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16636">netty/netty#16636</a></li>
<li>Move Http2FrameCodecSubClassTest to correct package by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16640">netty/netty#16640</a></li>
<li>Kqueue: Fix usage of LOCAL_PEERPID by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16637">netty/netty#16637</a></li>
<li>Avoid ArrayQueue allocation in HttpServerCodec by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16596">netty/netty#16596</a></li>
<li>Fix file descriptor reuse bug in kqueue by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16650">netty/netty#16650</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netty/netty/commit/b3844c8108b42f68d56144b36d4d1ed96078a688"><code>b3844c8</code></a>
[maven-release-plugin] prepare release netty-4.2.13.Final</li>
<li><a
href="https://github.com/netty/netty/commit/82f47fa53571d04d8add02e3a01762cebd139a00"><code>82f47fa</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/ada0999ae6a011c787203108c8d987e0bc25b82d"><code>ada0999</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/b4051e230e2fd349892f3739d6770b006c1d7528"><code>b4051e2</code></a>
Fix BrotliDecoder not forwarding all decompressed chunks</li>
<li><a
href="https://github.com/netty/netty/commit/67207c19218d7962f772af234f89de4424c7cf07"><code>67207c1</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/541ca7c645b8bd04901b54136b745622be289d19"><code>541ca7c</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/943edb361423eee5574b636a8c2bf6baf5cb2464"><code>943edb3</code></a>
Fix codec-dns tests</li>
<li><a
href="https://github.com/netty/netty/commit/6459a284e6653c90fe4b15c0e8516d8302b1cd0e"><code>6459a28</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/b4ba61bd9059156cc9dcece7a81ea389efe571c2"><code>b4ba61b</code></a>
Fix checkstyle in HttpObjectDecoder</li>
<li><a
href="https://github.com/netty/netty/commit/977661f71f7511ad68ca17cabd7b5185efb978f4"><code>977661f</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/netty/netty/compare/netty-4.2.12.Final...netty-4.2.13.Final">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.netty:netty-bom&package-manager=maven&previous-version=4.2.12.Final&new-version=4.2.13.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index dabb02594a..df387a067d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
     <dep.junit.jupiter.version>5.12.2</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.17</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
-    <dep.netty-bom.version>4.2.12.Final</dep.netty-bom.version>
+    <dep.netty-bom.version>4.2.13.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.80.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.21.3</dep.jackson-bom.version>

From 28367478a6ae695e409368b6f68b9ea22730fd9c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 19 May 2026 15:47:49 +0200
Subject: [PATCH 32/76] MINOR: Bump io.grpc:grpc-bom from 1.80.0 to 1.81.0
 (#1154)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.80.0
to 1.81.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-java/releases">io.grpc:grpc-bom's
releases</a>.</em></p>
<blockquote>
<h2>V1.81.0</h2>
<p>In this release we drop support for Android API level 22 or lower
(Lollipop or earlier), following Google Play Service’s <a
href="https://developers.google.com/android/guides/setup">discontinued
updates for Lollipop (API levels 21 &amp; 22)</a> and now requires a
minimum of API level 23 (Android 6.0 Marshmallow).</p>
<p><strong>API Changes</strong></p>
<ul>
<li>api: Deprecate LoadBalancer.handleResolvedAddresses(). Developers
maintaining custom LoadBalancer implementations should transition to
using LoadBalancer.acceptResolvedAddresses(). Unlike the deprecated
method, acceptResolvedAddresses() returns a Status object, allowing the
load balancer to explicitly report success or reject the update if the
provided addresses or configuration are invalid. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/11623">#11623</a>)</li>
</ul>
<p><strong>Behavior Changes</strong></p>
<ul>
<li>core: Enable dns &quot;caching&quot; on Android for 30 seconds to
reduce CPU impact of a refresh loop with an LB policy (0675f70af).
DnsNameResolver ignores re-resolution requests on OpenJDK-like platforms
if it has been too soon since the last DNS query because
InetAddress.getAllByName() has a cache with a fixed entry lifetime, but
this logic was disabled for Android which does not have that style of
cache. Android’s cache uses the result TTL, which will rarely be less
than 30 seconds. This change would probably be most noticeable when 1)
changing to a different network (e.g., from wifi to mobile), 2) the
server has different addresses for different networks, and 3) the app is
not using AndroidChannelBuilder with an
<code>android.context.Context</code>. For reference, it seems Chrome
caches for 1 minute</li>
</ul>
<p><strong>Bug Fixes</strong></p>
<ul>
<li>opentelemetry: Fix baggage propagation, the baggage propagation for
opentelemetry introduced in <a
href="https://redirect.github.com/grpc/grpc-java/pull/12389">#12389</a>
was broken. The context is decided once and used for all recording for
the call, thus guaranteeing all record()s have consistent
information.</li>
<li>core: Address a race condition where
<code>ManagedChannelOrphanWrapper</code> could incorrectly log a
&quot;not shutdown properly&quot; warning during garbage collection when
using directExecutor(). (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12705">#12705</a>)
(d459338d9)</li>
<li>xds: Fix xDS HTTP CONNECT's transport socket name bug which is now
corrected to use <code>typeUrl</code>. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12740">#12740</a>)
(eac9fe961)</li>
<li>xds: Fix an issue where subchannel metrics were dropping their
association with the <code>backend_service</code>. This ensures xDS load
balancing metrics are reported accurately. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12735">#12735</a>)</li>
</ul>
<p><strong>New Features</strong></p>
<ul>
<li>netty: Add tcp metrics, by implementing a few of the metrics defined
in <a
href="https://redirect.github.com/grpc/proposal/pull/519">A80</a>.</li>
<li>api: Add a CallOption for a custom label on per-RPC metrics
(0e39b2967). This CallOption is copied by grpc-opentelemetry to the
<code>grpc.client.call.custom</code> label as defined by <a
href="https://github.com/grpc/proposal/blob/master/A108-otel-custom-per-call-label.md">gRFC
A108</a>. See also the <a
href="https://grpc.io/docs/guides/opentelemetry-metrics/">gRPC
OpenTelemetry Metrics guide</a> (update <a
href="https://redirect.github.com/grpc/grpc.io/pull/1505">in-progress</a>)</li>
<li>xds: Add support for Weighted Round Robin (WRR) load balancing
driven by custom backend metrics, implementing the behavior defined in
gRFC A114. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12645">#12645</a>)</li>
<li>utils: Update <code>AdvancedTlsX509KeyManager</code> so that
developers can now preserve and use key aliases when dynamically
reloading TLS certificates. (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12686">#12686</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Update the &quot;Outgoing Flow Control&quot; section in the Manual
Flow Control example to say onNext() does not block, but rather queues
the messages in memory and advises developers to use
CallStreamObserver.isReady() to prevent this memory exhaustion (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12700">#12700</a>)
(a3a9ffcbe) (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12726">#12726</a>)
(65ae2efda)</li>
<li>examples: Clean up Health example, and document need for
grpc-services (3ed732fc0)</li>
</ul>
<p><strong>Dependencies</strong></p>
<ul>
<li>Upgrade Dependencies (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12719">#12719</a>)
(16e17abba). Google-auth-library: 1.42.1, animal-sniffer: 1.27,
assertj-core:3.27.7, error_prone_annotations:2.48.0,
proto-google-common-protos:2.64.1, google-cloud-logging:3.23.10,
jetty-http2-server:12.1.7, jetty-ee10-servlet:12.1.7, lincheck:3.4,
opentelemetry-api:1.60.1,
opentelemetry-exporter-prometheus:1.60.1-alpha,
opentelemetry-gcp-resources:1.54.0-alpha,
opentelemetry-sdk-extension-autoconfigure:1.60.1,
opentelemetry-sdk-testing:1.60.1, robolectric:4.16.1,
tomcat-embed-core:10.1.52, tomcat-embed-core9: 9.0.115,</li>
<li>Upgrade Netty to 4.1.132 and netty-tcnative to 2.0.75
(1528f809c)</li>
</ul>
<p><strong>Thanks to</strong></p>
<ul>
<li><a
href="https://github.com/becomeStar"><code>@​becomeStar</code></a></li>
<li><a
href="https://github.com/benjaminp"><code>@​benjaminp</code></a></li>
<li><a
href="https://github.com/JoeCqupt"><code>@​JoeCqupt</code></a></li>
<li><a href="https://github.com/Kainsin"><code>@​Kainsin</code></a></li>
<li><a
href="https://github.com/merlimat"><code>@​merlimat</code></a></li>
<li><a
href="https://github.com/SreeramdasLavanya"><code>@​SreeramdasLavanya</code></a></li>
<li><a
href="https://github.com/themechbro"><code>@​themechbro</code></a></li>
<li><a
href="https://github.com/zhangweikop"><code>@​zhangweikop</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-java/commit/6951542f66c59f63cbf5348b38a2306a3964adda"><code>6951542</code></a>
Bump version to 1.81.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/e94188e81298c36ac9654dc76025940171abc0a4"><code>e94188e</code></a>
Update README etc to reference 1.81.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/4813c6d06089d49a479f7f1786297dc3d8c0e549"><code>4813c6d</code></a>
core,xds: Fix backend_service plumbing for subchannel metrics (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12735">#12735</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/6737eb583a273dd13bf9e7b82cc1d9df75e551bd"><code>6737eb5</code></a>
Revert &quot;Replace javax ThreadSafe annotation with errorprone
ThreadSafe (<a
href="https://redirect.github.com/grpc/grpc-java/issues/1274">#1274</a>...</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/ef3531325ba98fa043f6f7f16fa0715e9296d7a3"><code>ef35313</code></a>
Replace javax ThreadSafe annotation with errorprone ThreadSafe (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12742">#12742</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/3ed732fc09c41b185cd03fdd6864c4ebb82f3a80"><code>3ed732f</code></a>
examples: Clean up Health, and document need for grpc-services</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/eac9fe9612881d54d51ddc5496599ba9a8201021"><code>eac9fe9</code></a>
xds: fix xDS HTTP CONNECT's transport socket name bug (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12740">#12740</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/1528f809c9e506cf2e7052e3f41fd8b75636d3d3"><code>1528f80</code></a>
Upgrade Netty to 4.1.132 and netty-tcnative to 2.0.75</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/d057a7ebee2945fc0a9ca58b36afdb5b37a99680"><code>d057a7e</code></a>
[xds] Implement A114: WRR support for custom backend metrics (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12645">#12645</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/842636f88452c30769a5561f7659db6e4f9fc2a0"><code>842636f</code></a>
xds: Add configuration objects for ExtAuthz, GrpcService and Bootstrap
change...</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-java/compare/v1.80.0...v1.81.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.grpc:grpc-bom&package-manager=maven&previous-version=1.80.0&new-version=1.81.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré <jbonofre@apache.org>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index df387a067d..a28d7167e1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
     <dep.slf4j.version>2.0.17</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.13.Final</dep.netty-bom.version>
-    <dep.grpc-bom.version>1.80.0</dep.grpc-bom.version>
+    <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.21.3</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>

From 4899492a26f941d955f5567797aa697262e747dd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 19 May 2026 15:48:10 +0200
Subject: [PATCH 33/76] MINOR: Bump parquet.version from 1.17.0 to 1.17.1
 (#1152)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps `parquet.version` from 1.17.0 to 1.17.1.
Updates `org.apache.parquet:parquet-avro` from 1.17.0 to 1.17.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/parquet-mr/releases">org.apache.parquet:parquet-avro's
releases</a>.</em></p>
<blockquote>
<h2>Apache Parquet Java 1.17.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix reading of proto Uint32Value by <a
href="https://github.com/0x26res"><code>@​0x26res</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3113">apache/parquet-java#3113</a></li>
<li>Bump jackson dependencies from 2.19.2 to 2.21.2 by <a
href="https://github.com/manuzhang"><code>@​manuzhang</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3460">apache/parquet-java#3460</a></li>
<li>Bump jackson.version from 2.21.2 to 2.21.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/apache/parquet-java/pull/3538">apache/parquet-java#3538</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1">https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1</a></p>
<h2>Apache Parquet Java 1.17.1 RC0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix reading of proto Uint32Value by <a
href="https://github.com/0x26res"><code>@​0x26res</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3113">apache/parquet-java#3113</a></li>
<li>Bump jackson dependencies from 2.19.2 to 2.21.2 by <a
href="https://github.com/manuzhang"><code>@​manuzhang</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3460">apache/parquet-java#3460</a></li>
<li>Bump jackson.version from 2.21.2 to 2.21.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/apache/parquet-java/pull/3538">apache/parquet-java#3538</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0">https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/apache/parquet-java/commit/78a8d3230eb4769db93de5f2f2e18363c04cae81"><code>78a8d32</code></a>
[maven-release-plugin] prepare release apache-parquet-1.17.1-rc0</li>
<li><a
href="https://github.com/apache/parquet-java/commit/b4351b2bbb08b30a1e5dafed0b7d995179c8208f"><code>b4351b2</code></a>
Bump version to 1.17.1-SNAPSHOT (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3544">#3544</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/aa65eb460b204622f20848787b329d395b727756"><code>aa65eb4</code></a>
Bump jackson.version from 2.21.2 to 2.21.3 (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3538">#3538</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/ef00c4634233c714b3fd8d82a09a6c7e58c4e8a3"><code>ef00c46</code></a>
<a
href="https://redirect.github.com/apache/parquet-mr/issues/3112">GH-3112</a>:
Fix reading of proto Uint32Value (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3113">#3113</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/0f91a199853bfcb48aff9af919ae4967f305ef7e"><code>0f91a19</code></a>
<a
href="https://redirect.github.com/apache/parquet-mr/issues/3410">GH-3410</a>:
Bump jackson dependencies from 2.19.2 to 2.21.2 (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3460">#3460</a>)</li>
<li>See full diff in <a
href="https://github.com/apache/parquet-mr/compare/apache-parquet-1.17.0...apache-parquet-1.17.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.apache.parquet:parquet-hadoop` from 1.17.0 to 1.17.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/parquet-mr/releases">org.apache.parquet:parquet-hadoop's
releases</a>.</em></p>
<blockquote>
<h2>Apache Parquet Java 1.17.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix reading of proto Uint32Value by <a
href="https://github.com/0x26res"><code>@​0x26res</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3113">apache/parquet-java#3113</a></li>
<li>Bump jackson dependencies from 2.19.2 to 2.21.2 by <a
href="https://github.com/manuzhang"><code>@​manuzhang</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3460">apache/parquet-java#3460</a></li>
<li>Bump jackson.version from 2.21.2 to 2.21.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/apache/parquet-java/pull/3538">apache/parquet-java#3538</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1">https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1</a></p>
<h2>Apache Parquet Java 1.17.1 RC0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix reading of proto Uint32Value by <a
href="https://github.com/0x26res"><code>@​0x26res</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3113">apache/parquet-java#3113</a></li>
<li>Bump jackson dependencies from 2.19.2 to 2.21.2 by <a
href="https://github.com/manuzhang"><code>@​manuzhang</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3460">apache/parquet-java#3460</a></li>
<li>Bump jackson.version from 2.21.2 to 2.21.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/apache/parquet-java/pull/3538">apache/parquet-java#3538</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0">https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/apache/parquet-java/commit/78a8d3230eb4769db93de5f2f2e18363c04cae81"><code>78a8d32</code></a>
[maven-release-plugin] prepare release apache-parquet-1.17.1-rc0</li>
<li><a
href="https://github.com/apache/parquet-java/commit/b4351b2bbb08b30a1e5dafed0b7d995179c8208f"><code>b4351b2</code></a>
Bump version to 1.17.1-SNAPSHOT (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3544">#3544</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/aa65eb460b204622f20848787b329d395b727756"><code>aa65eb4</code></a>
Bump jackson.version from 2.21.2 to 2.21.3 (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3538">#3538</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/ef00c4634233c714b3fd8d82a09a6c7e58c4e8a3"><code>ef00c46</code></a>
<a
href="https://redirect.github.com/apache/parquet-mr/issues/3112">GH-3112</a>:
Fix reading of proto Uint32Value (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3113">#3113</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/0f91a199853bfcb48aff9af919ae4967f305ef7e"><code>0f91a19</code></a>
<a
href="https://redirect.github.com/apache/parquet-mr/issues/3410">GH-3410</a>:
Bump jackson dependencies from 2.19.2 to 2.21.2 (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3460">#3460</a>)</li>
<li>See full diff in <a
href="https://github.com/apache/parquet-mr/compare/apache-parquet-1.17.0...apache-parquet-1.17.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dataset/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dataset/pom.xml b/dataset/pom.xml
index cb889ecd7d..5acc837860 100644
--- a/dataset/pom.xml
+++ b/dataset/pom.xml
@@ -32,7 +32,7 @@ under the License.
 
   <properties>
     <arrow.cpp.build.dir>../../../cpp/release-build/</arrow.cpp.build.dir>
-    <parquet.version>1.17.0</parquet.version>
+    <parquet.version>1.17.1</parquet.version>
     <avro.version>1.12.1</avro.version>
   </properties>
 

From ef359de2cf33f3020eb7c41cd4a5eee564b99bf6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 08:27:25 +0200
Subject: [PATCH 34/76] MINOR: Bump dep.slf4j.version from 2.0.17 to 2.0.18
 (#1151)

Bumps `dep.slf4j.version` from 2.0.17 to 2.0.18.
Updates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.18

Updates `org.slf4j:slf4j-jdk14` from 2.0.17 to 2.0.18

Updates `org.slf4j:jul-to-slf4j` from 2.0.17 to 2.0.18

Updates `org.slf4j:jcl-over-slf4j` from 2.0.17 to 2.0.18

Updates `org.slf4j:log4j-over-slf4j` from 2.0.17 to 2.0.18


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index a28d7167e1..2f55d591fd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -96,7 +96,7 @@ under the License.
     <target.gen.source.path>${project.build.directory}/generated-sources</target.gen.source.path>
     <dep.junit.platform.version>1.9.0</dep.junit.platform.version>
     <dep.junit.jupiter.version>5.12.2</dep.junit.jupiter.version>
-    <dep.slf4j.version>2.0.17</dep.slf4j.version>
+    <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.13.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>

From 4ecc92f817fc71fcf94e0df87d2c6c1bc9877847 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 11:32:03 +0200
Subject: [PATCH 35/76] MINOR: Bump org.apache.parquet:parquet-variant from
 1.17.0 to 1.17.1 (#1150)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[org.apache.parquet:parquet-variant](https://github.com/apache/parquet-mr)
from 1.17.0 to 1.17.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/parquet-mr/releases">org.apache.parquet:parquet-variant's
releases</a>.</em></p>
<blockquote>
<h2>Apache Parquet Java 1.17.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix reading of proto Uint32Value by <a
href="https://github.com/0x26res"><code>@​0x26res</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3113">apache/parquet-java#3113</a></li>
<li>Bump jackson dependencies from 2.19.2 to 2.21.2 by <a
href="https://github.com/manuzhang"><code>@​manuzhang</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3460">apache/parquet-java#3460</a></li>
<li>Bump jackson.version from 2.21.2 to 2.21.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/apache/parquet-java/pull/3538">apache/parquet-java#3538</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1">https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1</a></p>
<h2>Apache Parquet Java 1.17.1 RC0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix reading of proto Uint32Value by <a
href="https://github.com/0x26res"><code>@​0x26res</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3113">apache/parquet-java#3113</a></li>
<li>Bump jackson dependencies from 2.19.2 to 2.21.2 by <a
href="https://github.com/manuzhang"><code>@​manuzhang</code></a> in <a
href="https://redirect.github.com/apache/parquet-java/pull/3460">apache/parquet-java#3460</a></li>
<li>Bump jackson.version from 2.21.2 to 2.21.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/apache/parquet-java/pull/3538">apache/parquet-java#3538</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0">https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/apache/parquet-java/commit/78a8d3230eb4769db93de5f2f2e18363c04cae81"><code>78a8d32</code></a>
[maven-release-plugin] prepare release apache-parquet-1.17.1-rc0</li>
<li><a
href="https://github.com/apache/parquet-java/commit/b4351b2bbb08b30a1e5dafed0b7d995179c8208f"><code>b4351b2</code></a>
Bump version to 1.17.1-SNAPSHOT (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3544">#3544</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/aa65eb460b204622f20848787b329d395b727756"><code>aa65eb4</code></a>
Bump jackson.version from 2.21.2 to 2.21.3 (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3538">#3538</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/ef00c4634233c714b3fd8d82a09a6c7e58c4e8a3"><code>ef00c46</code></a>
<a
href="https://redirect.github.com/apache/parquet-mr/issues/3112">GH-3112</a>:
Fix reading of proto Uint32Value (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3113">#3113</a>)</li>
<li><a
href="https://github.com/apache/parquet-java/commit/0f91a199853bfcb48aff9af919ae4967f305ef7e"><code>0f91a19</code></a>
<a
href="https://redirect.github.com/apache/parquet-mr/issues/3410">GH-3410</a>:
Bump jackson dependencies from 2.19.2 to 2.21.2 (<a
href="https://redirect.github.com/apache/parquet-mr/issues/3460">#3460</a>)</li>
<li>See full diff in <a
href="https://github.com/apache/parquet-mr/compare/apache-parquet-1.17.0...apache-parquet-1.17.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache.parquet:parquet-variant&package-manager=maven&previous-version=1.17.0&new-version=1.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2f55d591fd..0ce71f74cc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,7 +105,7 @@ under the License.
     <dep.hadoop.version>3.5.0</dep.hadoop.version>
     <dep.fbs.version>25.2.10</dep.fbs.version>
     <dep.avro.version>1.12.1</dep.avro.version>
-    <dep.parquet.version>1.17.0</dep.parquet.version>
+    <dep.parquet.version>1.17.1</dep.parquet.version>
     <dep.mockito-bom.version>5.23.0</dep.mockito-bom.version>
     <arrow.vector.classifier/>
     <forkCount>2</forkCount>

From 755ce550c4dfc1771c2b350a0159b5e7f903debb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 10:32:04 +0200
Subject: [PATCH 36/76] MINOR: Bump org.immutables:value from 2.12.1 to 2.12.2
 (#1168)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [org.immutables:value](https://github.com/immutables/immutables)
from 2.12.1 to 2.12.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/immutables/immutables/releases">org.immutables:value's
releases</a>.</em></p>
<blockquote>
<h2>2.12.2</h2>
<h2>Maintenance release</h2>
<h3>What's Changed</h3>
<ul>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1642">#1642</a>
Fix to find nested elements on plain element with nested elements with
mongo backend by <a
href="https://github.com/rgatbert"><code>@​rgatbert</code></a> in <a
href="https://redirect.github.com/immutables/immutables/pull/1643">immutables/immutables#1643</a></li>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1642">#1642</a>
Fix for further problems to find nested elements on plain element with
nested elements with mongo backend by <a
href="https://github.com/rgatbert"><code>@​rgatbert</code></a> in <a
href="https://redirect.github.com/immutables/immutables/pull/1644">immutables/immutables#1644</a></li>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1645">#1645</a>
enhance docs about records for implementationNestedInBuilder by <a
href="https://github.com/bmarwell"><code>@​bmarwell</code></a> in <a
href="https://redirect.github.com/immutables/immutables/pull/1646">immutables/immutables#1646</a></li>
<li><a
href="https://redirect.github.com/immutables/immutables/issues/1655">#1655</a>
Fix TYPE_USE <code>@Nullable</code> on concrete array types by <a
href="https://github.com/viditochani"><code>@​viditochani</code></a> in
<a
href="https://redirect.github.com/immutables/immutables/pull/1658">immutables/immutables#1658</a></li>
</ul>
<h3>New Contributors</h3>
<ul>
<li><a href="https://github.com/rgatbert"><code>@​rgatbert</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutables/immutables/pull/1643">immutables/immutables#1643</a></li>
<li><a href="https://github.com/bmarwell"><code>@​bmarwell</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutables/immutables/pull/1646">immutables/immutables#1646</a></li>
<li><a
href="https://github.com/viditochani"><code>@​viditochani</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutables/immutables/pull/1658">immutables/immutables#1658</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutables/immutables/compare/2.12.1...2.12.2">https://github.com/immutables/immutables/compare/2.12.1...2.12.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/immutables/immutables/commit/6f1918f2ed84bf110fcb9f3dcd5fcf630bcad6d7"><code>6f1918f</code></a>
v2.12.2</li>
<li><a
href="https://github.com/immutables/immutables/commit/71d350b769c0b391c38b3fe35564ced71caff065"><code>71d350b</code></a>
node24 v5 github actions</li>
<li><a
href="https://github.com/immutables/immutables/commit/bb26b408e435b7c7c39ce72c945b5e5b2b34e9b6"><code>bb26b40</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1655">#1655</a>
additional ECJ workaround</li>
<li><a
href="https://github.com/immutables/immutables/commit/da6acc841b58abdbf8ad76f96aefa94f17f6fa15"><code>da6acc8</code></a>
Merge pull request <a
href="https://redirect.github.com/immutables/immutables/issues/1658">#1658</a>
from viditochani/fix-concrete-array-nullable</li>
<li><a
href="https://github.com/immutables/immutables/commit/ccd68963ab2a234b7b7f60006938cd4d727b89b5"><code>ccd6896</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1655">#1655</a>
Fix TYPE_USE <a
href="https://github.com/Nullable"><code>@​Nullable</code></a> on
concrete array types</li>
<li><a
href="https://github.com/immutables/immutables/commit/78f43d47541af1f535a6ed48578651a609481c87"><code>78f43d4</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1649">#1649</a>
Jackson3 meta-annotated package</li>
<li><a
href="https://github.com/immutables/immutables/commit/f3fe649b15d96500f8d1c93ad02cace88747cf13"><code>f3fe649</code></a>
<a
href="https://redirect.github.com/immutables/immutables/issues/1640">#1640</a>
Where.WITH_COPY for copy methods</li>
<li><a
href="https://github.com/immutables/immutables/commit/83cdfdb423100ed823f965130cd9153aa3a56b2a"><code>83cdfdb</code></a>
Change JUnit5 dependency to use BOM</li>
<li><a
href="https://github.com/immutables/immutables/commit/cf04f2c106e35edf1a313900a61c80e7f0913637"><code>cf04f2c</code></a>
Upgrade jackson3: 3.0.1 -&gt; 3.1.0</li>
<li><a
href="https://github.com/immutables/immutables/commit/31308e78e1cd39eba120b7e615723de24b3c1507"><code>31308e7</code></a>
Upgrade jackson: 2.19.2 -&gt; 2.21.2</li>
<li>Additional commits viewable in <a
href="https://github.com/immutables/immutables/compare/2.12.1...2.12.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.immutables:value&package-manager=maven&previous-version=2.12.1&new-version=2.12.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 0ce71f74cc..e69357c6af 100644
--- a/pom.xml
+++ b/pom.xml
@@ -314,7 +314,7 @@ under the License.
               <path>
                 <groupId>org.immutables</groupId>
                 <artifactId>value</artifactId>
-                <version>2.12.1</version>
+                <version>2.12.2</version>
               </path>
             </annotationProcessorPaths>
           </configuration>

From b58ce11516afd0aa2959673dac74ca0258ca2166 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 10:54:46 +0200
Subject: [PATCH 37/76] MINOR: Bump com.google.protobuf:protobuf-bom from
 4.34.1 to 4.35.0 (#1167)

Bumps
[com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf)
from 4.34.1 to 4.35.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/protocolbuffers/protobuf/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.google.protobuf:protobuf-bom&package-manager=maven&previous-version=4.34.1&new-version=4.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index e69357c6af..2b629673ef 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,7 +100,7 @@ under the License.
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.13.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>
-    <dep.protobuf-bom.version>4.34.1</dep.protobuf-bom.version>
+    <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.21.3</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>
     <dep.fbs.version>25.2.10</dep.fbs.version>

From 7fc14a532492f00e0744d8316fa8fb2f6970d31e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 11:15:13 +0200
Subject: [PATCH 38/76] MINOR: Bump io.netty:netty-bom from 4.2.13.Final to
 4.2.14.Final (#1166)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.13.Final to 4.2.14.Final.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netty/netty/releases">io.netty:netty-bom's
releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.14.Final</h2>
<h2>What's Changed</h2>
<ul>
<li>HTTP: Fix revapi failure introduced by
84530fa81e12dcd1d42310bb20c1385cb44128d8 by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16748">netty/netty#16748</a></li>
<li>HTTP: Re-add constructor to HttpProxyHandler that was removed by
mistake by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16747">netty/netty#16747</a></li>
<li>Marshalling: Explicit document security requirements by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16752">netty/netty#16752</a></li>
<li>Fix io_uring op completion TRACE logging by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16755">netty/netty#16755</a></li>
<li>Quic: Ensure writes are done before notify close promise of
QuicheQui… by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16758">netty/netty#16758</a></li>
<li>Avoid re-parsing openssl key material with non-cached provider by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16759">netty/netty#16759</a></li>
<li>Pin HTTP/RTSP version + method normalization to Locale.US by <a
href="https://github.com/daguimu"><code>@​daguimu</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16765">netty/netty#16765</a></li>
<li>Fill MsgHdrMemoryArray#hdrs with null entry on release by <a
href="https://github.com/tsegismont"><code>@​tsegismont</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16764">netty/netty#16764</a></li>
<li>Revapi: Use default &quot;oldVersion&quot; by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16774">netty/netty#16774</a></li>
<li>Adaptive: Fix concurrency issue in adaptive allocator by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16767">netty/netty#16767</a></li>
<li>Auto-port 4.2: Make bulk byte moving in ByteBuf faster by <a
href="https://github.com/netty-project-bot"><code>@​netty-project-bot</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16781">netty/netty#16781</a></li>
<li>Pin multipart Content-Type / Content-Transfer-Encoding case folding
to Locale.US by <a
href="https://github.com/daguimu"><code>@​daguimu</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16768">netty/netty#16768</a></li>
<li>Remove dead native declarations by <a
href="https://github.com/pandareen"><code>@​pandareen</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16783">netty/netty#16783</a></li>
<li>Isolate tests that modify available Security providers by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16793">netty/netty#16793</a></li>
<li>Remove test annotations from a method that isn't a test by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16792">netty/netty#16792</a></li>
<li>Enable OpenSslCachingKeyMaterialProvider to evict stale entries
after cert rotation by <a
href="https://github.com/zhangweikop"><code>@​zhangweikop</code></a> in
<a
href="https://redirect.github.com/netty/netty/pull/16523">netty/netty#16523</a></li>
<li>IoUring: extend user data from short to long by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16682">netty/netty#16682</a></li>
<li>Revert CompositeByteBuf component search fast path by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16811">netty/netty#16811</a></li>
<li>HTTP2: Use 100 as default max concurrent streams setting by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16804">netty/netty#16804</a></li>
<li>Fix ResumptionController wrapping by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16815">netty/netty#16815</a></li>
<li>Resolve all localhost addresses without querying DNS servers by <a
href="https://github.com/JulianVennen"><code>@​JulianVennen</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16749">netty/netty#16749</a></li>
<li>IpFilter: Fix ClassCastException caused by IpSubnetFilter if only
ipv6 rules are configured but remote peer is using ipv4 by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16803">netty/netty#16803</a></li>
<li>Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled
without Unsafe by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16788">netty/netty#16788</a></li>
<li>Route synchronous onLookupComplete exceptions via
fireExceptionCaught by <a
href="https://github.com/kwondh5217"><code>@​kwondh5217</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16794">netty/netty#16794</a></li>
<li>IoUring: Stop generic FileRegion drain loop when transferred()
reaches count() by <a
href="https://github.com/LuciferYang"><code>@​LuciferYang</code></a> in
<a
href="https://redirect.github.com/netty/netty/pull/16826">netty/netty#16826</a></li>
<li>MQTT: Allow MQTT 5 CONNECT with password only by <a
href="https://github.com/shblue21"><code>@​shblue21</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16833">netty/netty#16833</a></li>
<li>Fix MQTT decoder size check after variable header replay by <a
href="https://github.com/daguimu"><code>@​daguimu</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16787">netty/netty#16787</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/pandareen"><code>@​pandareen</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/16783">netty/netty#16783</a></li>
<li><a
href="https://github.com/zhangweikop"><code>@​zhangweikop</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/16523">netty/netty#16523</a></li>
<li><a
href="https://github.com/JulianVennen"><code>@​JulianVennen</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/16749">netty/netty#16749</a></li>
<li><a
href="https://github.com/kwondh5217"><code>@​kwondh5217</code></a> made
their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/16794">netty/netty#16794</a></li>
<li><a href="https://github.com/shblue21"><code>@​shblue21</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/16833">netty/netty#16833</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netty/netty/compare/netty-4.2.13.Final...netty-4.2.14.Final">https://github.com/netty/netty/compare/netty-4.2.13.Final...netty-4.2.14.Final</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netty/netty/commit/0a60b753d5b0de9f58e245538d61c11dc6cfc4b2"><code>0a60b75</code></a>
[maven-release-plugin] prepare release netty-4.2.14.Final</li>
<li><a
href="https://github.com/netty/netty/commit/72df658e5fdd1cc6d65bce1e0917ec31a9560269"><code>72df658</code></a>
Fix MQTT decoder size check after variable header replay (<a
href="https://redirect.github.com/netty/netty/issues/16787">#16787</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/7125dba6b20822aa72dd8359b350c2f3b9a545d9"><code>7125dba</code></a>
MQTT: Allow MQTT 5 CONNECT with password only (<a
href="https://redirect.github.com/netty/netty/issues/16833">#16833</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/9e19320a5855746970d05a5cd785d73a17cc694d"><code>9e19320</code></a>
IoUring: Stop generic FileRegion drain loop when transferred() reaches
count(...</li>
<li><a
href="https://github.com/netty/netty/commit/4ce9f17f05c67b72c87bc83951800bad245fe162"><code>4ce9f17</code></a>
Route synchronous onLookupComplete exceptions via fireExceptionCaught
(<a
href="https://redirect.github.com/netty/netty/issues/16794">#16794</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/f7b1b7de625031cc60e6eaecb889c97303588759"><code>f7b1b7d</code></a>
Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without
Unsafe...</li>
<li><a
href="https://github.com/netty/netty/commit/0ccb265cadf91b2e09c2f479c9194d193d7a5dbc"><code>0ccb265</code></a>
IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6
rules ...</li>
<li><a
href="https://github.com/netty/netty/commit/a6aeb6deffda3e45904edd05abc5cdddcd438794"><code>a6aeb6d</code></a>
Resolve all localhost addresses without querying DNS servers (<a
href="https://redirect.github.com/netty/netty/issues/16749">#16749</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/c328ba2ab89d2c90c80be1d2de1cfbb8f94c438b"><code>c328ba2</code></a>
Fix ResumptionController wrapping (<a
href="https://redirect.github.com/netty/netty/issues/16815">#16815</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/bc5862ba488c569c888d3b82048083041f66e880"><code>bc5862b</code></a>
HTTP2: Use 100 as default max concurrent streams setting (<a
href="https://redirect.github.com/netty/netty/issues/16804">#16804</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netty/netty/compare/netty-4.2.13.Final...netty-4.2.14.Final">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.netty:netty-bom&package-manager=maven&previous-version=4.2.13.Final&new-version=4.2.14.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2b629673ef..322e35f8b4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
     <dep.junit.jupiter.version>5.12.2</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
-    <dep.netty-bom.version>4.2.13.Final</dep.netty-bom.version>
+    <dep.netty-bom.version>4.2.14.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.21.3</dep.jackson-bom.version>

From 96339f6c2f35c3e6676e62fded200c0934f9d8d3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 11:22:01 +0200
Subject: [PATCH 39/76] MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.37.1
 to 11.37.2 (#1164)

Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.37.1 to 11.37.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt">com.nimbusds:oauth2-oidc-sdk's
changelog</a>.</em></p>
<blockquote>
<p>version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.</p>
<p>version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.</p>
<p>version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.</p>
<p>version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).</p>
<p>version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.</p>
<p>version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.</p>
<p>version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.</p>
<p>version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.</p>
<p>version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.</p>
<p>version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.</p>
<p>version 2.9 (2013-09-17)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/fedf633e67229b69f5f5ca378a588eca8ce7d117"><code>fedf633</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/29b77a0d34b72768194e8e2a53c0f56916bbee86"><code>29b77a0</code></a>
Updates to JSON Smart 2.6.0</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/6e53206950bcbf0c8e5f9ad7b6fe6f3081803f86"><code>6e53206</code></a>
[maven-release-plugin] prepare release 11.37.2</li>
<li>See full diff in <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.37.2..11.37.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.nimbusds:oauth2-oidc-sdk&package-manager=maven&previous-version=11.37.1&new-version=11.37.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 96a11f2b9a..3741ee083c 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -182,7 +182,7 @@ under the License.
     <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>oauth2-oidc-sdk</artifactId>
-      <version>11.37.1</version>
+      <version>11.37.2</version>
     </dependency>
 
   </dependencies>

From 6a6b8c1c8f3364da125df743c4b00a212d91c449 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 13:15:12 +0200
Subject: [PATCH 40/76] MINOR: Bump com.gradle:develocity-maven-extension from
 2.4.0 to 2.4.1 (#1161)

Bumps com.gradle:develocity-maven-extension from 2.4.0 to 2.4.1.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:develocity-maven-extension&package-manager=maven&previous-version=2.4.0&new-version=2.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .mvn/extensions.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index e909f05105..38b3c807b7 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -23,7 +23,7 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>develocity-maven-extension</artifactId>
-        <version>2.4.0</version>
+        <version>2.4.1</version>
     </extension>
     <extension>
         <groupId>com.gradle</groupId>

From 315fd710cdf2a418e21cb567bedc8d7473e17ec7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 28 May 2026 11:20:28 +0200
Subject: [PATCH 41/76] MINOR: [CI] Bump docker/login-action from 4.1.0 to
 4.2.0 (#1160)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [docker/login-action](https://github.com/docker/login-action) from
4.1.0 to 4.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.0</h2>
<ul>
<li>Bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 in <a
href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1050.0 in <a
href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li>
<li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a
href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li>
<li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li>
<li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a
href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li>
<li>Bump postcss from 8.5.6 to 8.5.10 in <a
href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li>
<li>Bump tar from 6.2.1 to 7.5.15 in <a
href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li>
<li>Bump vite from 7.3.1 to 7.3.3 in <a
href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/650006c6eb7dba73a995cc03b0b2d7f5ca915bee"><code>650006c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/960">#960</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li>
<li><a
href="https://github.com/docker/login-action/commit/99df1a3f6d65e48177ea57671a50e2242eae4b63"><code>99df1a3</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/3ab375f324f46da5f6901efeda4be4e2566ebaa2"><code>3ab375f</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/39d85804ae465a1816c68ff58158ec66883981b4"><code>39d8580</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/970">#970</a>
from docker/dependabot/npm_and_yarn/docker/actions-to...</li>
<li><a
href="https://github.com/docker/login-action/commit/4eefcd33ca7213989697445a78b6730274bfaba6"><code>4eefcd3</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/56d092c8b3f04006c22f4fc20a2b3d2442caed56"><code>56d092c</code></a>
build(deps): bump <code>@​docker/actions-toolkit</code> from 0.86.0 to
0.90.0</li>
<li><a
href="https://github.com/docker/login-action/commit/e2e31ca87063ae00fd41ad3b9c548dd8ec24c5ff"><code>e2e31ca</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/976">#976</a>
from docker/dependabot/npm_and_yarn/actions/core-3.0.1</li>
<li><a
href="https://github.com/docker/login-action/commit/0bced941e843afc786fbfd58b1c6c13ca11e09c9"><code>0bced94</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/3e75a0f266b07e09777a621d0ca5f4432ef9f10c"><code>3e75a0f</code></a>
build(deps): bump <code>@​actions/core</code> from 3.0.0 to 3.0.1</li>
<li><a
href="https://github.com/docker/login-action/commit/365bebd9d646160567ebad47824f026e09ee6970"><code>365bebd</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/984">#984</a>
from docker/dependabot/github_actions/aws-actions/con...</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.1.0&new-version=4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/rc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 2658f1da00..f0e99f1219 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
-      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

From da97828bfe2818e1233ef8c421e89e238fff8340 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:43:15 +0200
Subject: [PATCH 42/76] MINOR: Bump checker.framework.version from 4.1.0 to
 4.2.0 (#1170)

Bumps `checker.framework.version` from 4.1.0 to 4.2.0.
Updates `org.checkerframework:checker-qual` from 4.1.0 to 4.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker-qual's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.2.0</h2>
<h2>Version 4.2.0 (2026-06-01)</h2>
<h3>User-visible changes</h3>
<p>Renamed error message key
&quot;createsmustcallfor.target.unparseable&quot; to
&quot;createsmustcallfor.target.unparsable&quot;.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new overload <code>canonicalAnnotation(AnnotationMirror,
TypeMirror)</code>.</li>
</ul>
<p>In <code>TypeHierarchy</code>:</p>
<ul>
<li>new methods <code>equalsShallowEffective()</code>.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7676">#7676</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7679">#7679</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7680">#7680</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7695">#7695</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7697">#7697</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7699">#7699</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7700">#7700</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7727">#7727</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker-qual's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.2.0 (2026-06-01)</h2>
<h3>User-visible changes</h3>
<p>Renamed error message key
&quot;createsmustcallfor.target.unparseable&quot; to
&quot;createsmustcallfor.target.unparsable&quot;.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new overload <code>canonicalAnnotation(AnnotationMirror,
TypeMirror)</code>.</li>
</ul>
<p>In <code>TypeHierarchy</code>:</p>
<ul>
<li>new methods <code>equalsShallowEffective()</code>.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7676">#7676</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7679">#7679</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7680">#7680</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7695">#7695</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7697">#7697</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7699">#7699</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7700">#7700</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7727">#7727</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/231e85507cb0166a94145d2e35b8d3d355c3ced6"><code>231e855</code></a>
new release 4.2.0</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e59f66f668bfffbadbd3185c103a898ee69fa745"><code>e59f66f</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/bcc021ff1928ddb3e2ca9afa876bb16a6e924396"><code>bcc021f</code></a>
Fix problem with type var in a method reference (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7729">#7729</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/91392e5f6a521ee48baa974f39038a3ff309c5e3"><code>91392e5</code></a>
Use gradle-git-properties version 4</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/cdae25801e483901ce5ebd814ad5286f5e332531"><code>cdae258</code></a>
Increase constraint limit (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7752">#7752</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/dbb553d23011306ced4a7d49fac82aa2df850e9d"><code>dbb553d</code></a>
Fix check of receiver override (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7746">#7746</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/264c73dbc2cde531fe88f6546c76727de348d3af"><code>264c73d</code></a>
Fix &quot;unneeded.suppression&quot; warning (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7747">#7747</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/d118b89190356b846201f2488b96710dfee11aef"><code>d118b89</code></a>
New methods <code>equalsShallowEffective()</code> (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7745">#7745</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/a916913c161d0cf6078c32e823d724a4c31890ae"><code>a916913</code></a>
Simplify logic (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7744">#7744</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/227974fbf0e546621a53da5f2db0de83fee61c46"><code>227974f</code></a>
Update plugin com-gradleup-shadow to v9.4.2 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7749">#7749</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.1.0...checker-framework-4.2.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.checkerframework:checker` from 4.1.0 to 4.2.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.2.0</h2>
<h2>Version 4.2.0 (2026-06-01)</h2>
<h3>User-visible changes</h3>
<p>Renamed error message key
&quot;createsmustcallfor.target.unparseable&quot; to
&quot;createsmustcallfor.target.unparsable&quot;.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new overload <code>canonicalAnnotation(AnnotationMirror,
TypeMirror)</code>.</li>
</ul>
<p>In <code>TypeHierarchy</code>:</p>
<ul>
<li>new methods <code>equalsShallowEffective()</code>.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7676">#7676</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7679">#7679</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7680">#7680</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7695">#7695</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7697">#7697</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7699">#7699</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7700">#7700</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7727">#7727</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.2.0 (2026-06-01)</h2>
<h3>User-visible changes</h3>
<p>Renamed error message key
&quot;createsmustcallfor.target.unparseable&quot; to
&quot;createsmustcallfor.target.unparsable&quot;.</p>
<h3>Implementation details</h3>
<p>In <code>AnnotatedTypeFactory</code>:</p>
<ul>
<li>new overload <code>canonicalAnnotation(AnnotationMirror,
TypeMirror)</code>.</li>
</ul>
<p>In <code>TypeHierarchy</code>:</p>
<ul>
<li>new methods <code>equalsShallowEffective()</code>.</li>
</ul>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7676">#7676</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7679">#7679</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7680">#7680</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7695">#7695</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7697">#7697</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7699">#7699</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7700">#7700</a>,
<a
href="https://redirect.github.com/typetools/checker-framework/issues/7727">#7727</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/231e85507cb0166a94145d2e35b8d3d355c3ced6"><code>231e855</code></a>
new release 4.2.0</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e59f66f668bfffbadbd3185c103a898ee69fa745"><code>e59f66f</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/bcc021ff1928ddb3e2ca9afa876bb16a6e924396"><code>bcc021f</code></a>
Fix problem with type var in a method reference (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7729">#7729</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/91392e5f6a521ee48baa974f39038a3ff309c5e3"><code>91392e5</code></a>
Use gradle-git-properties version 4</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/cdae25801e483901ce5ebd814ad5286f5e332531"><code>cdae258</code></a>
Increase constraint limit (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7752">#7752</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/dbb553d23011306ced4a7d49fac82aa2df850e9d"><code>dbb553d</code></a>
Fix check of receiver override (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7746">#7746</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/264c73dbc2cde531fe88f6546c76727de348d3af"><code>264c73d</code></a>
Fix &quot;unneeded.suppression&quot; warning (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7747">#7747</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/d118b89190356b846201f2488b96710dfee11aef"><code>d118b89</code></a>
New methods <code>equalsShallowEffective()</code> (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7745">#7745</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/a916913c161d0cf6078c32e823d724a4c31890ae"><code>a916913</code></a>
Simplify logic (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7744">#7744</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/227974fbf0e546621a53da5f2db0de83fee61c46"><code>227974f</code></a>
Update plugin com-gradleup-shadow to v9.4.2 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7749">#7749</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.1.0...checker-framework-4.2.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 322e35f8b4..81da2a2866 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
     <checkstyle.version>10.23.0</checkstyle.version>
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
-    <checker.framework.version>4.1.0</checker.framework.version>
+    <checker.framework.version>4.2.0</checker.framework.version>
     <logback.version>1.5.32</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>

From 035d96b256cc5eb687add6af2f5326ac5523f272 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:57:55 +0200
Subject: [PATCH 43/76] MINOR: Bump dep.junit.jupiter.version from 5.12.2 to
 6.1.0 (#1162)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps `dep.junit.jupiter.version` from 5.12.2 to 6.1.0.
Updates `org.junit.jupiter:junit-jupiter-engine` from 5.12.2 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-engine's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0</p>
<p>See <a href="https://docs.junit.org/6.1.0/release-notes.html">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/JarvisCraft"><code>@​JarvisCraft</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5633">junit-team/junit-framework#5633</a></li>
<li><a href="https://github.com/Maran23"><code>@​Maran23</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5644">junit-team/junit-framework#5644</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0">https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0</a></p>
<p>JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage
6.1.0-RC1</p>
<p>See <a href="https://docs.junit.org/6.1.0-RC1/release-notes/">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/mariokhoury4"><code>@​mariokhoury4</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/4574">junit-team/junit-framework#4574</a></li>
<li><a href="https://github.com/Ogu1208"><code>@​Ogu1208</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5145">junit-team/junit-framework#5145</a></li>
<li><a
href="https://github.com/HyungGeun94"><code>@​HyungGeun94</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5271">junit-team/junit-framework#5271</a></li>
<li><a
href="https://github.com/yalishevant"><code>@​yalishevant</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5316">junit-team/junit-framework#5316</a></li>
<li><a
href="https://github.com/JINU-CHANG"><code>@​JINU-CHANG</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5290">junit-team/junit-framework#5290</a></li>
<li><a href="https://github.com/jaschdoc"><code>@​jaschdoc</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5427">junit-team/junit-framework#5427</a></li>
<li><a
href="https://github.com/kawshikbuet17"><code>@​kawshikbuet17</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5561">junit-team/junit-framework#5561</a></li>
<li><a href="https://github.com/msridhar"><code>@​msridhar</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5602">junit-team/junit-framework#5602</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1">https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1</a></p>
<p>JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage
6.1.0-M1</p>
<p>See <a href="https://docs.junit.org/6.1.0-M1/release-notes/">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/vy"><code>@​vy</code></a> made their
first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5041">junit-team/junit-framework#5041</a></li>
<li><a href="https://github.com/Pankraz76"><code>@​Pankraz76</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5006">junit-team/junit-framework#5006</a></li>
<li><a href="https://github.com/arukiidou"><code>@​arukiidou</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5066">junit-team/junit-framework#5066</a></li>
<li><a href="https://github.com/laeubi"><code>@​laeubi</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5092">junit-team/junit-framework#5092</a></li>
<li><a href="https://github.com/jihun4452"><code>@​jihun4452</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5088">junit-team/junit-framework#5088</a></li>
<li><a
href="https://github.com/TWiStErRob"><code>@​TWiStErRob</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5133">junit-team/junit-framework#5133</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1">https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1</a></p>
<p>JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3</p>
<p>See <a href="https://docs.junit.org/6.0.3/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3">https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3</a></p>
<p>JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2</p>
<p>See <a href="https://docs.junit.org/6.0.2/release-notes.html">Release
Notes</a>.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0dc3af1cb1973d257b5bc75d81e02454d5e4e556"><code>0dc3af1</code></a>
Release 6.1.0</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/1d130020c85170edcb46ce7ed1f7f78824e37c04"><code>1d13002</code></a>
Prepare 6.1.0 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/072b2175bbd7b0b3b26f5d928550ec7a21e68268"><code>072b217</code></a>
Update plugin spotless to v8.5.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5668">#5668</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/3a53480218f4b752a9ca77506e10632cd483c0f8"><code>3a53480</code></a>
Update Gradle to v9.5.1 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5666">#5666</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0e18a20a9f98d063ae02b3ba19329143f5c7f034"><code>0e18a20</code></a>
Update zizmorcore/zizmor-action action to v0.5.4 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5669">#5669</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0a2634fb9cbbd057b02cf629d7d272c16d62be4b"><code>0a2634f</code></a>
Update github/codeql-action action to v4.35.5 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5671">#5671</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/4dbd5561b00ac761a62c516bfaec51c212a2d60c"><code>4dbd556</code></a>
Restructure workflows to have single &quot;status&quot; job (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5670">#5670</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/f2194cebe377512cb0ade388c62a881a0bcf5d3e"><code>f2194ce</code></a>
Increase timeout to reduce flakiness</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/5c8fdd2df65b763151cccbe669ea9e1c3155efcd"><code>5c8fdd2</code></a>
Update dependency org.apache.groovy:groovy to v5.0.6 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5659">#5659</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/43c6982324602582902c9bdb213fd5e007f9cf3d"><code>43c6982</code></a>
Update dependency org.slf4j:slf4j-jdk14 to v2.0.18 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5667">#5667</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r5.12.2...r6.1.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.junit.jupiter:junit-jupiter-api` from 5.12.2 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-api's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0</p>
<p>See <a href="https://docs.junit.org/6.1.0/release-notes.html">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/JarvisCraft"><code>@​JarvisCraft</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5633">junit-team/junit-framework#5633</a></li>
<li><a href="https://github.com/Maran23"><code>@​Maran23</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5644">junit-team/junit-framework#5644</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0">https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0</a></p>
<p>JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage
6.1.0-RC1</p>
<p>See <a href="https://docs.junit.org/6.1.0-RC1/release-notes/">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/mariokhoury4"><code>@​mariokhoury4</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/4574">junit-team/junit-framework#4574</a></li>
<li><a href="https://github.com/Ogu1208"><code>@​Ogu1208</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5145">junit-team/junit-framework#5145</a></li>
<li><a
href="https://github.com/HyungGeun94"><code>@​HyungGeun94</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5271">junit-team/junit-framework#5271</a></li>
<li><a
href="https://github.com/yalishevant"><code>@​yalishevant</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5316">junit-team/junit-framework#5316</a></li>
<li><a
href="https://github.com/JINU-CHANG"><code>@​JINU-CHANG</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5290">junit-team/junit-framework#5290</a></li>
<li><a href="https://github.com/jaschdoc"><code>@​jaschdoc</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5427">junit-team/junit-framework#5427</a></li>
<li><a
href="https://github.com/kawshikbuet17"><code>@​kawshikbuet17</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5561">junit-team/junit-framework#5561</a></li>
<li><a href="https://github.com/msridhar"><code>@​msridhar</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5602">junit-team/junit-framework#5602</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1">https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1</a></p>
<p>JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage
6.1.0-M1</p>
<p>See <a href="https://docs.junit.org/6.1.0-M1/release-notes/">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/vy"><code>@​vy</code></a> made their
first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5041">junit-team/junit-framework#5041</a></li>
<li><a href="https://github.com/Pankraz76"><code>@​Pankraz76</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5006">junit-team/junit-framework#5006</a></li>
<li><a href="https://github.com/arukiidou"><code>@​arukiidou</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5066">junit-team/junit-framework#5066</a></li>
<li><a href="https://github.com/laeubi"><code>@​laeubi</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5092">junit-team/junit-framework#5092</a></li>
<li><a href="https://github.com/jihun4452"><code>@​jihun4452</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5088">junit-team/junit-framework#5088</a></li>
<li><a
href="https://github.com/TWiStErRob"><code>@​TWiStErRob</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5133">junit-team/junit-framework#5133</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1">https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1</a></p>
<p>JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3</p>
<p>See <a href="https://docs.junit.org/6.0.3/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3">https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3</a></p>
<p>JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2</p>
<p>See <a href="https://docs.junit.org/6.0.2/release-notes.html">Release
Notes</a>.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0dc3af1cb1973d257b5bc75d81e02454d5e4e556"><code>0dc3af1</code></a>
Release 6.1.0</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/1d130020c85170edcb46ce7ed1f7f78824e37c04"><code>1d13002</code></a>
Prepare 6.1.0 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/072b2175bbd7b0b3b26f5d928550ec7a21e68268"><code>072b217</code></a>
Update plugin spotless to v8.5.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5668">#5668</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/3a53480218f4b752a9ca77506e10632cd483c0f8"><code>3a53480</code></a>
Update Gradle to v9.5.1 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5666">#5666</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0e18a20a9f98d063ae02b3ba19329143f5c7f034"><code>0e18a20</code></a>
Update zizmorcore/zizmor-action action to v0.5.4 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5669">#5669</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0a2634fb9cbbd057b02cf629d7d272c16d62be4b"><code>0a2634f</code></a>
Update github/codeql-action action to v4.35.5 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5671">#5671</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/4dbd5561b00ac761a62c516bfaec51c212a2d60c"><code>4dbd556</code></a>
Restructure workflows to have single &quot;status&quot; job (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5670">#5670</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/f2194cebe377512cb0ade388c62a881a0bcf5d3e"><code>f2194ce</code></a>
Increase timeout to reduce flakiness</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/5c8fdd2df65b763151cccbe669ea9e1c3155efcd"><code>5c8fdd2</code></a>
Update dependency org.apache.groovy:groovy to v5.0.6 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5659">#5659</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/43c6982324602582902c9bdb213fd5e007f9cf3d"><code>43c6982</code></a>
Update dependency org.slf4j:slf4j-jdk14 to v2.0.18 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5667">#5667</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r5.12.2...r6.1.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.junit.jupiter:junit-jupiter-params` from 5.12.2 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-params's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0</p>
<p>See <a href="https://docs.junit.org/6.1.0/release-notes.html">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/JarvisCraft"><code>@​JarvisCraft</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5633">junit-team/junit-framework#5633</a></li>
<li><a href="https://github.com/Maran23"><code>@​Maran23</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5644">junit-team/junit-framework#5644</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0">https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0</a></p>
<p>JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage
6.1.0-RC1</p>
<p>See <a href="https://docs.junit.org/6.1.0-RC1/release-notes/">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/mariokhoury4"><code>@​mariokhoury4</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/4574">junit-team/junit-framework#4574</a></li>
<li><a href="https://github.com/Ogu1208"><code>@​Ogu1208</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5145">junit-team/junit-framework#5145</a></li>
<li><a
href="https://github.com/HyungGeun94"><code>@​HyungGeun94</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5271">junit-team/junit-framework#5271</a></li>
<li><a
href="https://github.com/yalishevant"><code>@​yalishevant</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5316">junit-team/junit-framework#5316</a></li>
<li><a
href="https://github.com/JINU-CHANG"><code>@​JINU-CHANG</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5290">junit-team/junit-framework#5290</a></li>
<li><a href="https://github.com/jaschdoc"><code>@​jaschdoc</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5427">junit-team/junit-framework#5427</a></li>
<li><a
href="https://github.com/kawshikbuet17"><code>@​kawshikbuet17</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5561">junit-team/junit-framework#5561</a></li>
<li><a href="https://github.com/msridhar"><code>@​msridhar</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5602">junit-team/junit-framework#5602</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1">https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1</a></p>
<p>JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage
6.1.0-M1</p>
<p>See <a href="https://docs.junit.org/6.1.0-M1/release-notes/">Release
Notes</a>.</p>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/vy"><code>@​vy</code></a> made their
first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5041">junit-team/junit-framework#5041</a></li>
<li><a href="https://github.com/Pankraz76"><code>@​Pankraz76</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5006">junit-team/junit-framework#5006</a></li>
<li><a href="https://github.com/arukiidou"><code>@​arukiidou</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5066">junit-team/junit-framework#5066</a></li>
<li><a href="https://github.com/laeubi"><code>@​laeubi</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5092">junit-team/junit-framework#5092</a></li>
<li><a href="https://github.com/jihun4452"><code>@​jihun4452</code></a>
made their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5088">junit-team/junit-framework#5088</a></li>
<li><a
href="https://github.com/TWiStErRob"><code>@​TWiStErRob</code></a> made
their first contribution in <a
href="https://redirect.github.com/junit-team/junit-framework/pull/5133">junit-team/junit-framework#5133</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1">https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1</a></p>
<p>JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3</p>
<p>See <a href="https://docs.junit.org/6.0.3/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3">https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3</a></p>
<p>JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2</p>
<p>See <a href="https://docs.junit.org/6.0.2/release-notes.html">Release
Notes</a>.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0dc3af1cb1973d257b5bc75d81e02454d5e4e556"><code>0dc3af1</code></a>
Release 6.1.0</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/1d130020c85170edcb46ce7ed1f7f78824e37c04"><code>1d13002</code></a>
Prepare 6.1.0 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/072b2175bbd7b0b3b26f5d928550ec7a21e68268"><code>072b217</code></a>
Update plugin spotless to v8.5.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5668">#5668</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/3a53480218f4b752a9ca77506e10632cd483c0f8"><code>3a53480</code></a>
Update Gradle to v9.5.1 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5666">#5666</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0e18a20a9f98d063ae02b3ba19329143f5c7f034"><code>0e18a20</code></a>
Update zizmorcore/zizmor-action action to v0.5.4 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5669">#5669</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0a2634fb9cbbd057b02cf629d7d272c16d62be4b"><code>0a2634f</code></a>
Update github/codeql-action action to v4.35.5 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5671">#5671</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/4dbd5561b00ac761a62c516bfaec51c212a2d60c"><code>4dbd556</code></a>
Restructure workflows to have single &quot;status&quot; job (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5670">#5670</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/f2194cebe377512cb0ade388c62a881a0bcf5d3e"><code>f2194ce</code></a>
Increase timeout to reduce flakiness</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/5c8fdd2df65b763151cccbe669ea9e1c3155efcd"><code>5c8fdd2</code></a>
Update dependency org.apache.groovy:groovy to v5.0.6 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5659">#5659</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/43c6982324602582902c9bdb213fd5e007f9cf3d"><code>43c6982</code></a>
Update dependency org.slf4j:slf4j-jdk14 to v2.0.18 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5667">#5667</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r5.12.2...r6.1.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 81da2a2866..2e9b793562 100644
--- a/pom.xml
+++ b/pom.xml
@@ -95,7 +95,7 @@ under the License.
     <project.build.outputTimestamp>1773644827</project.build.outputTimestamp>
     <target.gen.source.path>${project.build.directory}/generated-sources</target.gen.source.path>
     <dep.junit.platform.version>1.9.0</dep.junit.platform.version>
-    <dep.junit.jupiter.version>5.12.2</dep.junit.jupiter.version>
+    <dep.junit.jupiter.version>6.1.0</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.14.Final</dep.netty-bom.version>

From a993bf1727098cd21cd4973d6bcff2b20e5ebfd0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 9 Jun 2026 09:19:57 +0200
Subject: [PATCH 44/76] MINOR: Bump
 com.google.api.grpc:proto-google-common-protos from 2.71.0 to 2.72.0 (#1178)

Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.71.0 to 2.72.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/6e1c1796ed06d7215bb11784ad4ab2a380690b37"><code>6e1c179</code></a>
chore(main): release 2.64.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3954">#3954</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/7a2f0b0d81d2b0b988e6e36d9d8b75f8f9a141ff"><code>7a2f0b0</code></a>
chore: update upper bound dependencies file (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3966">#3966</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/1e4a7e5088c88e5752cc24cbe44b14b3ce409778"><code>1e4a7e5</code></a>
chore: update googleapis commit at Fri Oct 17 02:31:11 UTC 2025 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3951">#3951</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/ffb557ce8f3460f722b27b30af5e470edd93431b"><code>ffb557c</code></a>
deps: Bump grpc-java to v1.76.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3942">#3942</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/9ad8a4dfb96a44c34acd10aacd2adc30ed240631"><code>9ad8a4d</code></a>
chore: remove internal/librariangen following migration to librarian
repo (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3">#3</a>...</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/0a1bbea44d6a1b024c569db89fef8d08ad7bd2d2"><code>0a1bbea</code></a>
chore(librariangen): Generate to use languagecontainer.Run (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3968">#3968</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/452d703b703ab3222fd1a7060ed5e1ac6363322b"><code>452d703</code></a>
feat(librariangen): generate grpc stubs and resource helpers (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3967">#3967</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/85057e8e2402fca7bcf4a153d4981fed2b6628de"><code>85057e8</code></a>
ci: remove librarian skipping on matrix builds (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3969">#3969</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/a26a6d937e0523b9a6c193504645f96649e48573"><code>a26a6d9</code></a>
chore(librariangen): languagecontainer package to parse release-init
request ...</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/c86b4eaabcd5ce6bf4939ada04b6f41a85b3385e"><code>c86b4ea</code></a>
ci: exclude internal/librariangen/** using dorny/paths-filter (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/3961">#3961</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/sdk-platform-java/compare/gax/v2.71.0...gax/v2.72.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.google.api.grpc:proto-google-common-protos&package-manager=maven&previous-version=2.71.0&new-version=2.72.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index 15b870905d..9ae402cdc4 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>proto-google-common-protos</artifactId>
-      <version>2.71.0</version>
+      <version>2.72.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 485f813d0cec4987f5b597f6cd448d40f074ccce Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 9 Jun 2026 13:14:21 +0200
Subject: [PATCH 45/76] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-8 to
 1.5.7-10 (#1177)

Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-8 to 1.5.7-10.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/luben/zstd-jni/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.github.luben:zstd-jni&package-manager=maven&previous-version=1.5.7-8&new-version=1.5.7-10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 compression/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compression/pom.xml b/compression/pom.xml
index f3de6fc248..41cdb03796 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
     <dependency>
       <groupId>com.github.luben</groupId>
       <artifactId>zstd-jni</artifactId>
-      <version>1.5.7-8</version>
+      <version>1.5.7-10</version>
     </dependency>
   </dependencies>
 </project>

From c836fad712c8a2ca14ac3a4b5f117a3e9fbefdc7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 09:43:35 +0200
Subject: [PATCH 46/76] MINOR: Bump com.fasterxml.jackson:jackson-bom from
 2.21.3 to 2.22.0 (#1173)

Bumps
[com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom)
from 2.21.3 to 2.22.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/112e8591b5e14dff30c278c142d8111231c3a48f"><code>112e859</code></a>
[maven-release-plugin] prepare release jackson-bom-2.22.0</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/2cae2ce236587ee18c58e40e01d432a077b3e7ae"><code>2cae2ce</code></a>
Prep for 2.22.0 release</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/7955d2113f21d1027f0b643e5fbca4a1feae5964"><code>7955d21</code></a>
Merge branch '2.21' into 2.x</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/8922a05c6e46f790b67e64e15585eb070b6ebc6d"><code>8922a05</code></a>
Post-release dep version bump</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/1fa994366741173fb38bc7c194666819ade60f6d"><code>1fa9943</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/d1abd31e4fec3035965d57a05a6256171ea8d980"><code>d1abd31</code></a>
[maven-release-plugin] prepare release jackson-bom-2.21.4</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/2aaea43db8480aa7d405ebc0de503cffc864f6f6"><code>2aaea43</code></a>
Prep for 2.21.4 release</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/902ec69efea40cdf1647c6fb49fb78734a88f3e6"><code>902ec69</code></a>
Update Woodstox/stax2-api (to 7.2.0/4.3.0)</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/257064709f8ea9ca84ea5d569080f9daacc0e017"><code>2570647</code></a>
Merge branch '2.21' into 2.x</li>
<li><a
href="https://github.com/FasterXML/jackson-bom/commit/9d3a9d54e40312ef0ac9192d599b59b541f65fb8"><code>9d3a9d5</code></a>
Post-release dep version bump</li>
<li>Additional commits viewable in <a
href="https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.3...jackson-bom-2.22.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2e9b793562..a5ed136e95 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,7 +101,7 @@ under the License.
     <dep.netty-bom.version>4.2.14.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
-    <dep.jackson-bom.version>2.21.3</dep.jackson-bom.version>
+    <dep.jackson-bom.version>2.22.0</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>
     <dep.fbs.version>25.2.10</dep.fbs.version>
     <dep.avro.version>1.12.1</dep.avro.version>

From e525fbfe7f94301ea6b9725472a91206be0c7bd2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 14:31:56 +0200
Subject: [PATCH 47/76] MINOR: Bump com.diffplug.spotless:spotless-maven-plugin
 from 3.4.0 to 3.6.0 (#1172)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 3.4.0 to 3.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/diffplug/spotless/releases">com.diffplug.spotless:spotless-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>Maven Plugin v3.6.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>&lt;cacheDirectory&gt;</code> to
<code>&lt;eclipse&gt;</code>, <code>&lt;greclipse&gt;</code>, and
<code>&lt;eclipseCdt&gt;</code> for the Equo/Solstice P2 cache. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2944">#2944</a>)</li>
<li><code>EclipseJdtFormtterStep</code> now can conditionally set
compiler source/compliance options. Allows for better parsing of AST
Node for newer language features and more correct sorting; e.g. records
or seal classes. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2942">#2942</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>&lt;versionCatalog&gt;</code> no longer splits long inline
tables across multiple lines — Gradle's TOML 1.0 parser cannot read
multi-line inline tables. The <code>maxLineLength</code> option has been
removed. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2948">#2948</a>)</li>
<li><code>spotless:apply</code> no longer aborts on the first file with
lints; it now formats all files and reports a single aggregated lint
failure across every file, matching the Gradle plugin's behavior. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2937">#2937</a>)</li>
<li><code>&lt;greclipse&gt;</code> and <code>&lt;eclipseCdt&gt;</code>
now default P2 data to the Maven local repository. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2944">#2944</a>)</li>
<li><code>forbidWildcardImports</code> and
<code>forbidModuleImports</code> now detect imports that have leading
whitespace (indentation/tabs). (<a
href="https://redirect.github.com/diffplug/spotless/pull/2939">#2939</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Improved formatting performance by eliminating redundant per-step
line-ending normalization in the core formatter loop. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2934">#2934</a>)</li>
</ul>
<h2>Maven Plugin v3.5.1</h2>
<h3>Fixed</h3>
<ul>
<li><code>&lt;licenseHeader&gt;</code> with
<code>&lt;yearMode&gt;SET_FROM_GIT&lt;/yearMode&gt;</code> no longer
runs <code>git log</code> through a shell, eliminating a shell-injection
vector when formatting files whose names contain shell
metacharacters.</li>
<li>Bump transitive <code>plexus-utils</code> <code>4.0.2</code> -&gt;
<code>4.0.3</code> to address <a
href="https://github.com/advisories/GHSA-6fmv-xxpf-w3cw">CVE-2025-67030</a>.
(<a
href="https://redirect.github.com/diffplug/spotless/issues/2919">#2919</a>)</li>
</ul>
<h2>Maven Plugin v3.5.0</h2>
<h3>Added</h3>
<ul>
<li><code>&lt;scalafmt&gt;</code> now reads the version from the
<code>version</code> field in the scalafmt config file when no
<code>&lt;version&gt;</code> is explicitly set, falling back to the
built-in default only if neither is available. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2922">#2922</a>)</li>
<li>Add <code>&lt;toml&gt;</code> format type with
<code>&lt;versionCatalog&gt;</code> step for formatting and sorting
Gradle version catalog files. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2916">#2916</a>)</li>
<li>Add <code>&lt;javaparserVersion&gt;</code> option to
<code>&lt;cleanthat&gt;</code>, allowing users to override the
JavaParser version pulled in transitively by Cleanthat. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2903">#2903</a>)</li>
<li>Add a <code>expandWildcardImports</code> API for java (<a
href="https://redirect.github.com/diffplug/spotless/pull/2930">#2829</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Preserve case of JDBI named bind params that collide with SQL
keywords (e.g. <code>:limit</code>, <code>:offset</code>) in the DBeaver
SQL formatter. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2899">#2899</a>)</li>
<li>The <code>-Dspotless.ratchetFrom=...</code> user property now takes
priority over <code>&lt;ratchetFrom&gt;</code> configured in the plugin
or in individual formatters, instead of being overridden by them. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2896">#2896</a>,
fixes <a
href="https://redirect.github.com/diffplug/spotless/issues/2842">#2842</a>)</li>
<li>Fix non-idempotent formatting when <code>importOrder()</code> is
combined with <code>greclipse()</code>: a single catch-all group no
longer strips blank lines that <code>greclipse()</code> independently
inserted between import groups. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2914">#2914</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Fix <code>expandWildcardImports</code> failing on JDK XML types such
as <code>org.xml.sax.InputSource</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2921">#2921</a>)</li>
<li>Use Eclipse JDT's collator-based comparison when sorting Java
members to better match Eclipse save actions. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2920">#2920</a>)</li>
<li>Bump default <code>cleanthat</code> version <code>2.24</code> -&gt;
<code>2.25</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2903">#2903</a>)</li>
<li>Bump default <code>eclipse-jdt</code> version from <code>4.35</code>
to <code>4.39</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2912">#2912</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/diffplug/spotless/commit/71a433c5cd5e8a4983c6600a10032ce3415700ba"><code>71a433c</code></a>
Published maven/3.6.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/3a0f1017dcdfd49042a638119c1b6d998b28c67f"><code>3a0f101</code></a>
Published gradle/8.6.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/007e9d858177c93a3c7b6f9d1eb068937022613f"><code>007e9d8</code></a>
Published lib/4.6.2</li>
<li><a
href="https://github.com/diffplug/spotless/commit/a074d53565e0f523c3bba7f5135ba0d8f959f98b"><code>a074d53</code></a>
Allow setting the local P2 cache dir in the Spotless Gradle plugin (<a
href="https://redirect.github.com/diffplug/spotless/issues/2944">#2944</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/a266fc2b97098aed703300ecfb00a7fc6ab57467"><code>a266fc2</code></a>
Merge branch 'main' into add-cache-directory-dsl</li>
<li><a
href="https://github.com/diffplug/spotless/commit/e0d466e5c157d41208ba84f3b0c767a4ad3d4330"><code>e0d466e</code></a>
Fix: sort members treats record declarations as types (<a
href="https://redirect.github.com/diffplug/spotless/issues/2942">#2942</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/3936b6f2f9290bfe946a890c1efc791eb969c7db"><code>3936b6f</code></a>
Merge branch 'main' into main</li>
<li><a
href="https://github.com/diffplug/spotless/commit/278765fcbbdc91d9bbcd3bff41005a350746792c"><code>278765f</code></a>
fix: expandWildcardImports support pom type dependency, fix <a
href="https://redirect.github.com/diffplug/spotless/issues/2839">#2839</a>
(<a
href="https://redirect.github.com/diffplug/spotless/issues/2935">#2935</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/a18ddec9bd578c77177c9478207892d63f942826"><code>a18ddec</code></a>
Remove maxLineLength from versionCatalog step (<a
href="https://redirect.github.com/diffplug/spotless/issues/2949">#2949</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/b91ad871a69bb7c3722120c81f9dae3e1ee11836"><code>b91ad87</code></a>
Add changelog entries for versionCatalog maxLineLength removal</li>
<li>Additional commits viewable in <a
href="https://github.com/diffplug/spotless/compare/maven/3.4.0...maven/3.6.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.diffplug.spotless:spotless-maven-plugin&package-manager=maven&previous-version=3.4.0&new-version=3.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 bom/pom.xml | 2 +-
 pom.xml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 083ee1e0de..3201761e81 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -208,7 +208,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>3.4.0</version>
+          <version>3.6.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
diff --git a/pom.xml b/pom.xml
index a5ed136e95..63128589a9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -492,7 +492,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>3.4.0</version>
+          <version>3.6.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>

From cb24576e895c0bf8e1d062e2fc82f2b53bfa2eb8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Jun 2026 10:07:43 +0200
Subject: [PATCH 48/76] MINOR: Bump io.netty:netty-bom from 4.2.14.Final to
 4.2.15.Final (#1175)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.14.Final to 4.2.15.Final.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netty/netty/releases">io.netty:netty-bom's
releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.15.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j">CVE-2026-48059</a>:
memory exhaustion in <code>io.netty:netty-codec-haproxy</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85">CVE-2026-47691</a>:
DNS cache poisoning in <code>io.netty:netty-resolver-dns</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm">CVE-2026-50560</a>:
DDoS in <code>io.netty:netty-codec-http2</code>.</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7">CVE-2026-50011</a>:
memory exhaustion in <code>io.netty:netty-codec-redis</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2">CVE-2026-44250</a>:
memory exhaustion in <code>io.netty:netty-codec-redis</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3">CVE-2026-44890</a>:
memory exhaustion in <code>io.netty:netty-codec-redis</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-cq4q-cv5g-r8q5">CVE-2026-50009</a>:
information disclosure and denial of service in
<code>io.netty:netty-codec-classes-quic</code>.</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86">CVE-2026-44249</a>:
IPv6 subnet filter bypass in <code>io.netty:netty-handler</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c">CVE-2026-50020</a>:
request smuggling in <code>io.netty:netty-codec-http</code>.</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-c2rx-5r8w-8xr2">CVE-2026-44892</a>:
memory exhaustion in <code>io.netty:netty-codec-http3</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv">CVE-2026-44893</a>:
memory leak in <code>io.netty:netty-codec-haproxy</code> (high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-cmm3-54f8-px4j">CVE-2026-44894</a>:
traffic amplification in <code>io.netty:netty-codec-classes-quic</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9">CVE-2026-50010</a>:
TLS hostname verification accidentally disabled in
<code>io.netty:netty-handler</code> (high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78">CVE-2026-45673</a>:
DNS cache poisoning in <code>io.netty:netty-resolver-dns</code>.</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh">CVE-2026-45416</a>:
excessive memory usage from SNIHandler in
<code>io.netty:netty-handler</code> (high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9">CVE-2026-45536</a>:
file descriptor leak in
<code>io.netty:netty-transport-native-epoll</code> and
<code>io.netty:netty-transport-native-kqueue</code>.</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc">CVE-2026-45674</a>:
DNS cache poisoning in <code>io.netty:netty-resolver-dns</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch">CVE-2026-46340</a>:
memory exhaustion in <code>io.netty:netty-transport-sctp</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q">CVE-2026-47244</a>:
denial of service in <code>io.netty:netty-codec-http2</code>.</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm">CVE-2026-48006</a>:
memory exhaustion in <code>io.netty:netty-codec-redis</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-4grm-h2qv-h6w6">CVE-2026-48748</a>:
memory exhaustion in <code>io.netty:netty-codec-http3</code>
(high).</li>
<li><a
href="https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j">CVE-2026-48043</a>:
memory exhaustion in <code>io.netty:netty-codec-http2</code>.</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16836">netty/netty#16836</a></li>
<li>HTTP/2: Parse request-target path like Vert.x by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16810">netty/netty#16810</a></li>
<li>Auto-port 4.2: ChannelInitializer: correct misleading comment on
exceptionCaught route by <a
href="https://github.com/netty-project-bot"><code>@​netty-project-bot</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16853">netty/netty#16853</a></li>
<li>FlowControlHandler: Suppress duplicate channelReadComplete after
draining queue (<a
href="https://redirect.github.com/netty/netty/issues/15053">#15053</a>)
by <a href="https://github.com/schiemon"><code>@​schiemon</code></a> in
<a
href="https://redirect.github.com/netty/netty/pull/16837">netty/netty#16837</a></li>
<li>Pass maxAllocation to Brotli and Zstd decoders by <a
href="https://github.com/fedinskiy"><code>@​fedinskiy</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16844">netty/netty#16844</a></li>
<li>Fix revapi warnings by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16885">netty/netty#16885</a></li>
<li>Fix SCTP and Redis tests by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16893">netty/netty#16893</a></li>
<li>Add maxWindowLog parameter to ZstdDecoder to bound memory allocation
by <a href="https://github.com/skyguard1"><code>@​skyguard1</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16850">netty/netty#16850</a></li>
<li>Auto-port 4.2: MQTT: Reject malformed no-payload packets with
non-zero Remaining Length by <a
href="https://github.com/netty-project-bot"><code>@​netty-project-bot</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16890">netty/netty#16890</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/schiemon"><code>@​schiemon</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/16837">netty/netty#16837</a></li>
<li><a href="https://github.com/fedinskiy"><code>@​fedinskiy</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/16844">netty/netty#16844</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final">https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netty/netty/commit/a41f7b289ce1d697c50846f3ade3983e22b2ed40"><code>a41f7b2</code></a>
[maven-release-plugin] prepare release netty-4.2.15.Final</li>
<li><a
href="https://github.com/netty/netty/commit/2394530bdb6837d928c2ec0b4d8f598487059ef9"><code>2394530</code></a>
Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero
Remain...</li>
<li><a
href="https://github.com/netty/netty/commit/0bd1657a601da85c324d28562dc7d1ae220ad3a7"><code>0bd1657</code></a>
Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (<a
href="https://redirect.github.com/netty/netty/issues/16850">#16850</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/76291f58a901e021289e5c30618b6e136d605163"><code>76291f5</code></a>
Fix SCTP and Redis tests (<a
href="https://redirect.github.com/netty/netty/issues/16893">#16893</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/e067b6e3376afee7629481d46333c3acf7f95943"><code>e067b6e</code></a>
Fix revapi warnings (<a
href="https://redirect.github.com/netty/netty/issues/16885">#16885</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/5a52600d96cc6f4d38098e0645be53ecbfc8a811"><code>5a52600</code></a>
Pass maxAllocation to Brotli and Zstd decoders (<a
href="https://redirect.github.com/netty/netty/issues/16844">#16844</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/541add0f7f5486ef15834da51d8dd983ec12e2b3"><code>541add0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/270800e5d336913606493a562c8200ecf321a0c1"><code>270800e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca"><code>3d45a1e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d"><code>75127ca</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 63128589a9..877a355860 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
     <dep.junit.jupiter.version>6.1.0</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
-    <dep.netty-bom.version>4.2.14.Final</dep.netty-bom.version>
+    <dep.netty-bom.version>4.2.15.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.22.0</dep.jackson-bom.version>

From 5540c4d6358cd653fcc7e463e60aa3f21f3288ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:01:08 +0200
Subject: [PATCH 49/76] MINOR: Bump com.squareup.okhttp3:mockwebserver3-junit5
 from 5.3.2 to 5.4.0 (#1185)

Bumps
[com.squareup.okhttp3:mockwebserver3-junit5](https://github.com/square/okhttp)
from 5.3.2 to 5.4.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:mockwebserver3-junit5's
changelog</a>.</em></p>
<blockquote>
<h2>Version 5.4.0</h2>
<p><em>2026-06-08</em></p>
<ul>
<li>New: Add superpowers to interceptors. Interceptors can now override
anything settable on
<code>OkHttpClient.Builder</code>, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom <code>Call.Factory</code> wrappers.</li>
<li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li>
<li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
<code>okhttp-coroutines</code> artifact.</li>
<li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li>
<li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a>
Prepare for release 5.4.0.</li>
<li><a
href="https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a>
Update eclipse.osgi to v3.24.200 (<a
href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a>
Update bnd to v7.3.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a>
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a>
Update dependency macos to v26 (<a
href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a>
Update shadow.plugin to v9.4.2 (<a
href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a>
Update spotless.plugin to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a>
Update plugin com.diffplug.spotless to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a>
Update spotless.plugin to v8.5.1 (<a
href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a>
Apply gradle lint correctly (<a
href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.squareup.okhttp3:mockwebserver3-junit5&package-manager=maven&previous-version=5.3.2&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 3741ee083c..9a8406cf31 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -129,7 +129,7 @@ under the License.
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>mockwebserver3-junit5</artifactId>
-      <version>5.3.2</version>
+      <version>5.4.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 6e0b5f7905c436ef847eaba4a703564ee6faae7e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:01:26 +0200
Subject: [PATCH 50/76] MINOR: Bump org.jacoco:jacoco-maven-plugin from 0.8.14
 to 0.8.15 (#1176)

Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco)
from 0.8.14 to 0.8.15.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jacoco/jacoco/releases">org.jacoco:jacoco-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>0.8.15</h2>
<h2>New Features</h2>
<ul>
<li>JaCoCo now officially supports Java 26 (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2076">#2076</a>).</li>
<li>Experimental support for Java 27 class files (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2004">#2004</a>).</li>
<li>Compatibility methods generated by Kotlin compiler for functions
defined in interfaces are filtered out during generation of report
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1905">#1905</a>).</li>
<li>Compatibility methods generated by Kotlin compiler for exposed boxed
inline value classes (JvmExposeBoxed annotation) are filtered out during
generation of report (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1944">#1944</a>).</li>
<li>Methods generated by the Kotlin compiler for functions with
JvmStatic annotation are filtered out during generation of report
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2097">#2097</a>).</li>
<li>Improved filtering of bytecode generated by Kotlin compiler for when
expressions and statements with kotlin.String subject where first branch
condition contains string with largest hash (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2098">#2098</a>).</li>
<li>Part of bytecode that javac versions from 24 to 26 generate for
switch statements and expressions with selector expression of type
java.lang.String inside lambdas is filtered out during generation of
report (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2023">#2023</a>).</li>
<li>Improved performance of Kotlin files analysis by parsing SMAPs only
once per class (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2114">#2114</a>).</li>
<li>For better performance agent output methods tcpclient and tcpserver
use BufferedOutputStream to write execution data to socket. Maven
plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use
BufferedInputStream to read execution data from socket. Third-party
integrations should do the same to benefit from this change in agent
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2089">#2089</a>).</li>
</ul>
<h2>Fixed bugs</h2>
<ul>
<li>Fixed processing of Kotlin SMAP in synthetic classes (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1985">#1985</a>).</li>
<li>Multiple JaCoCo runtimes within one JVM writing to the same output
file should not cause data corruption when running on JDK versions from
6 to 10 affected by <a
href="https://bugs.openjdk.org/browse/JDK-8166253">JDK-8166253</a>
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2065">#2065</a>,
<a
href="https://redirect.github.com/jacoco/jacoco/issues/2074">#2074</a>).</li>
<li>For better performance agent writes to output file via
BufferedOutputStream, this fixes regression introduced in version 0.6.2
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2073">#2073</a>).</li>
<li>Fixed NullPointerException when JaCoCo agent is loaded by non system
class loader, for example when loaded by JBoss Modules (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1651">#1651</a>).</li>
</ul>
<h2>Non-functional Changes</h2>
<ul>
<li>JaCoCo now depends on ASM 9.10.1 (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2134">#2134</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jacoco/jacoco/commit/6c5260a192eaa535e4a519771d530781cbac9136"><code>6c5260a</code></a>
Prepare release v0.8.15</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/5c05141431a7f064a804a923fbae11271241f116"><code>5c05141</code></a>
Transfer of execution data through socket should use buffered stream (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2089">#2089</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/ab5efa9d63c06899b2aec1d4a6099fc856132a22"><code>ab5efa9</code></a>
Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2148">#2148</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/5f6ea38f20ff4583deb4ab976571c853231f97c2"><code>5f6ea38</code></a>
Use Windows 2025 image in GitHub Actions (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2130">#2130</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/35a8af2cfc168ce51f2a3ea2d55d65f31e61c513"><code>35a8af2</code></a>
Use Renovate instead of Dependabot for updates of ASM (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2137">#2137</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/85b8ddf530821f75b3b26f5f96d03252286b3ad6"><code>85b8ddf</code></a>
Upgrade ASM to 9.10.1 (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2134">#2134</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/2988647ac37c3ad35a77b51d01b10a916b85627b"><code>2988647</code></a>
AgentModule should use ClassLoader of agent instead of SystemClassLoader
(<a
href="https://redirect.github.com/jacoco/jacoco/issues/1651">#1651</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/75a4e31fed32f180fbe4593ad91ec5c176c0535b"><code>75a4e31</code></a>
Add filter for Kotlin <code>@JvmExposeBoxed</code> (<a
href="https://redirect.github.com/jacoco/jacoco/issues/1944">#1944</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/691fa1d6a0dffa91f45daf0714f28bfdaa367fc0"><code>691fa1d</code></a>
Use Renovate instead of Dependabot for updates of GitHub Actions (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2132">#2132</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/3e18f17207bca0203b726ace460aa6be8d0f3dd4"><code>3e18f17</code></a>
Require at least JDK 21 for build (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2128">#2128</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jacoco/jacoco/compare/v0.8.14...v0.8.15">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 877a355860..326b26ee97 100644
--- a/pom.xml
+++ b/pom.xml
@@ -352,7 +352,7 @@ under the License.
         <plugin>
           <groupId>org.jacoco</groupId>
           <artifactId>jacoco-maven-plugin</artifactId>
-          <version>0.8.14</version>
+          <version>0.8.15</version>
         </plugin>
 
         <!--This plugin's configuration is used to store Eclipse m2e settings

From fb34d7a4848f5c5a93470b731e28490b1b64f166 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 09:53:53 +0200
Subject: [PATCH 51/76] MINOR: Bump io.grpc:grpc-bom from 1.81.0 to 1.82.1
 (#1199)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.81.0
to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-java/releases">io.grpc:grpc-bom's
releases</a>.</em></p>
<blockquote>
<h2>v1.82.1</h2>
<ul>
<li>protoc-gen-grpc-java: Fix missing osx-x86_64 binary (<a
href="https://redirect.github.com/grpc/grpc-java/pull/12878">grpc/grpc-java#12878</a>).
This fixes a regression in v1.82.0</li>
</ul>
<h2>v1.82.0</h2>
<p>This release drops support for Bazel 7. It may still run, but we are
no longer testing it. We are testing Bazel 8 and 9.</p>
<p>We are anticipating requiring Netty 4.2 in the next release. Please
file an issue if you still need Netty 4.1 support.</p>
<h3>Behavior Changes</h3>
<ul>
<li>xds: Disable Priority LB child policy retention cache (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12806">#12806</a>).
Previously, when a priority became inactive, its associated child load
balancer was kept in a deactivated state for potential reuse. Now,
inactive child balancers are immediately torn down and removed.</li>
<li>xds: skip DiscoveryRequest for unsubscribed types on stream ready
(<a
href="https://redirect.github.com/grpc/grpc-java/issues/12782">#12782</a>).
When the bootstrap declares more than one xDS server (e.g. a default
server for LDS/CDS plus an authority-specific EDS-only server),
grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server
too. That server replies <code>UNIMPLEMENTED</code>, which tears down
the stream and EDS data never arrives. This fix makes it skip
DiscoveryRequests for resource types we don't actually subscribe to on a
given server.</li>
</ul>
<h3>Improvements</h3>
<ul>
<li>Remove JSR-305 <code>@ThreadSafe</code> annotation and replace with
JavaDoc (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12762">#12762</a>).
Removes JSR-305 annotations but instead of replacing it with
ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is
done only in public non-final classes and interfaces. This allows Java
applications that have moved away from javax to compile and avoids a bug
in Immutables and Lombok (and possibly other annotation processors) from
failing when JSR-305 is not present.</li>
<li>core: Reduce per-stream idle memory on the server by 0.5 KB
(b38df6c94). The main improvement here is not retaining the request
Metadata for the life of the RPC. That means RPCs with larger request
Metadata would see a larger benefit.</li>
<li>core: Clarify missing content-type on HTTP error responses (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12720">#12720</a>).
Adjusts the diagnostic for the missing rather than invalid content-type,
in the Status description.</li>
<li>core: throw IOException when ProxySelector returns null or empty
list (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12793">#12793</a>).
ProxySelector.select(URI) is required to return a non-null, non-empty
list. Some implementations violate this, which previously caused an
opaque crash in ProxyDetectorImpl. Now it detects this case explicitly
and fails gracefully, naming the offending ProxySelector class to help
with debugging.</li>
<li>okhttp: enable TLS 1.3 by default for Android clients, retain TLS
1.2-only for desktop JVM (f43013161)</li>
<li>xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is
most noticeable when there are many endpoints returned by EDS, but the
LB policy only uses a few of them, like pick_first.</li>
<li>xds: pre-parse custom metric names in WRR load balancer (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12773">#12773</a>)
(324fce715). This reduces the per-RPC overhead of the gRFC A114 support
added in v1.81.0</li>
<li>xds: Propagate status cause through XdsDepManager (13b4b9727). This
preserves more information for failures communicating with the control
plane.</li>
<li>binder: Give clear error when message is larger than parcel
(d92ca44a1)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>xds: Trust Manager fix for certain scenarios where SAN validation
shouldn't use the SNI sent (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12775">#12775</a>)
(bb153a83f).</li>
<li>core: Cancel DelayedClientCall when application listener throws (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12761">#12761</a>).
Align DelayedClientCall.DelayedListener with ClientCallImpl's existing
behavior for listener exceptions. When the application listener throws
from onHeaders/onMessage/onReady, catch the Throwable, cancel the call
with CANCELLED (cause = the throwable), and swallow subsequent
callbacks. Previously, a throw from the application listener escaped to
the callExecutor's uncaught-exception handler. The real call was not
cancelled and the transport kept delivering callbacks to an already
broken listener</li>
<li>core,opentelemetry: Fix server metric labels on early close (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12774">#12774</a>).
Addresses the server-side OpenTelemetry metric labeling bug where a
generated method can be recorded as grpc.method=&quot;other&quot; if
<code>streamClosed()</code> happens before
<code>serverCallStarted()</code>.</li>
<li>core: Fix pick_first NPE with
<code>GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true</code> when accepting
resolved addresses and in CONNECTING state (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12814">#12814</a>).
It makes sure that whenever PickFirstLeafLoadBalancer transitions into
CONNECTING the current address in the addressIndex has a corresponding
subchannel. This prevents an NPE in acceptResolvedAddresses in some
situations.</li>
<li>okhttp: HPACK should fail on varint overflow (ec1099254). This
should have no visible impact in normal use. It mostly just makes it
easier to debug broken implementations</li>
<li>xds: When using the file watcher certificate provider, reload
cert/key even if only one of them changes (f4125c591)</li>
<li>compiler: Avoid compile error on weird proto file names
(f021befcd)</li>
</ul>
<h3>New Features</h3>
<ul>
<li>googleapis: support <code>?force-xds</code> query parameter in the
<code>google-c2p</code> resolver (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12760">#12760</a>)
(86fa86063). This disables environment checks and uses xDS
unconditionally. Please note that this feature has not yet seen
comprehensive testing.</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgrade Netty to 4.1.133 (ada087b9d)</li>
<li>bazel: Upgrade googleapis proto repo to commit 1dbb1a14 (ec0a9c976).
This fixed a rules_go incompatibility issue with Bazel 9.1. But it also
greatly reduced the overall transitive dependencies, as the C++ grpc
repo is no longer a dependency</li>
<li>bazel: Upgrade workflows to Bazel 8 (039ad7779) add Bazel 9.1.0 to
our CI matrix (17be0d3d1)</li>
<li>protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04
instead of 18.04 (8802dc35b5, da98b04b09)</li>
</ul>
<h3>Thanks to</h3>
<p><a
href="https://github.com/becomeStar"><code>@​becomeStar</code></a><br />
<a
href="https://github.com/bengtsson1-flir"><code>@​bengtsson1-flir</code></a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-java/commit/7b5e9ff531a8706a562d04ed9570a4790ce8ec64"><code>7b5e9ff</code></a>
Bump version to 1.82.1</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/20768f1630394b10d90c8737263cd198a43b7052"><code>20768f1</code></a>
Update README etc to reference 1.82.1</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/5ab5eba718f2e278e1015a0b7544e8dcf68afbc0"><code>5ab5eba</code></a>
kokoro: Remove extra / in architecture replacement</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/6726caf64c6e3d3db1ebfb5e9924fc75b706ae52"><code>6726caf</code></a>
buildscripts: add regional td config for psm-interop (v1.82.x backport)
(<a
href="https://redirect.github.com/grpc/grpc-java/issues/12864">#12864</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/022256f3f9f3816192dd11909b20902ebffcc37d"><code>022256f</code></a>
Bump version to 1.82.1-SNAPSHOT</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/78fb51905574241fbb5bc0259f908ead78dae609"><code>78fb519</code></a>
Bump version to 1.82.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/b62b0fc700b379cd080093d79330c181fce93de6"><code>b62b0fc</code></a>
Update README etc to reference 1.82.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/8802dc35b5c4d17cc8a53986db4f98bec9a2e04f"><code>8802dc3</code></a>
build: downgrade multiarch to Ubuntu 20.04 and consolidate images (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12830">#12830</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/be300bd11d15bfe6d19bd50c40dfec44e9b127e6"><code>be300bd</code></a>
kokoro: Avoid brew on Mac OS</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/4111f6f33ab3198833da99391875d378a25229f4"><code>4111f6f</code></a>
core: throw IOException when ProxySelector returns null or empty list
(<a
href="https://redirect.github.com/grpc/grpc-java/issues/12793">#12793</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-java/compare/v1.81.0...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.grpc:grpc-bom&package-manager=maven&previous-version=1.81.0&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 326b26ee97..3aa3867b90 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
     <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.15.Final</dep.netty-bom.version>
-    <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>
+    <dep.grpc-bom.version>1.82.1</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.22.0</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>

From 2812cfaa4d455f202c9e11a1facdd83acb82530b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 09:54:40 +0200
Subject: [PATCH 52/76] MINOR: Bump dep.junit.jupiter.version from 6.1.0 to
 6.1.1 (#1200)

Bumps `dep.junit.jupiter.version` from 6.1.0 to 6.1.1.
Updates `org.junit.jupiter:junit-jupiter-engine` from 6.1.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-engine's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1</p>
<p>See <a href="https://docs.junit.org/6.1.1/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0d85889d9846c14378b732a8da860bfef6ddf7ca"><code>0d85889</code></a>
Release 6.1.1</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0363eee5be323b0a0ef05a0578ed03815d1ca258"><code>0363eee</code></a>
Finalize 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a6d540a593550a4247dfc3818496bc2453969235"><code>a6d540a</code></a>
Move entry to 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/69339d59ecb51f7047228ac53d07578b5bb4f7fa"><code>69339d5</code></a>
Only pass timeout when publishing to avoid failure in nmcp plugin</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/dec2eb93eb70684df9de4f1249cd39dfa7b4b19b"><code>dec2eb9</code></a>
Allow excluding engines from memory cleanup mode (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5786">#5786</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a5f4270f6bf406fa2d468e65961ed66c69e1d035"><code>a5f4270</code></a>
Publish sha256/sha512 checksums again but filter out signature ones (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5796">#5796</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/82130129139837ce26bfb9cf38e26c7b5ec00860"><code>8213012</code></a>
Update plugin nmcp-settings to v1.6.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5787">#5787</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d1bf8471dd5fe594d687eaa961eeb42d642af3f0"><code>d1bf847</code></a>
Generate Javadoc for aggregator modules</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d721de51cb39e5a4ffe45331f611dfab897653f3"><code>d721de5</code></a>
Pass <code>--no-fonts</code> to <code>javadoc</code> convention</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d289ec653ee268892da8defcb6f2fdb666efc4ed"><code>d289ec6</code></a>
Restore original SetSystemProperty values in a ParameterizedTest (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5720">#5720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.junit.jupiter:junit-jupiter-api` from 6.1.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-api's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1</p>
<p>See <a href="https://docs.junit.org/6.1.1/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0d85889d9846c14378b732a8da860bfef6ddf7ca"><code>0d85889</code></a>
Release 6.1.1</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0363eee5be323b0a0ef05a0578ed03815d1ca258"><code>0363eee</code></a>
Finalize 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a6d540a593550a4247dfc3818496bc2453969235"><code>a6d540a</code></a>
Move entry to 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/69339d59ecb51f7047228ac53d07578b5bb4f7fa"><code>69339d5</code></a>
Only pass timeout when publishing to avoid failure in nmcp plugin</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/dec2eb93eb70684df9de4f1249cd39dfa7b4b19b"><code>dec2eb9</code></a>
Allow excluding engines from memory cleanup mode (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5786">#5786</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a5f4270f6bf406fa2d468e65961ed66c69e1d035"><code>a5f4270</code></a>
Publish sha256/sha512 checksums again but filter out signature ones (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5796">#5796</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/82130129139837ce26bfb9cf38e26c7b5ec00860"><code>8213012</code></a>
Update plugin nmcp-settings to v1.6.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5787">#5787</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d1bf8471dd5fe594d687eaa961eeb42d642af3f0"><code>d1bf847</code></a>
Generate Javadoc for aggregator modules</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d721de51cb39e5a4ffe45331f611dfab897653f3"><code>d721de5</code></a>
Pass <code>--no-fonts</code> to <code>javadoc</code> convention</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d289ec653ee268892da8defcb6f2fdb666efc4ed"><code>d289ec6</code></a>
Restore original SetSystemProperty values in a ParameterizedTest (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5720">#5720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.junit.jupiter:junit-jupiter-params` from 6.1.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-params's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1</p>
<p>See <a href="https://docs.junit.org/6.1.1/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0d85889d9846c14378b732a8da860bfef6ddf7ca"><code>0d85889</code></a>
Release 6.1.1</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0363eee5be323b0a0ef05a0578ed03815d1ca258"><code>0363eee</code></a>
Finalize 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a6d540a593550a4247dfc3818496bc2453969235"><code>a6d540a</code></a>
Move entry to 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/69339d59ecb51f7047228ac53d07578b5bb4f7fa"><code>69339d5</code></a>
Only pass timeout when publishing to avoid failure in nmcp plugin</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/dec2eb93eb70684df9de4f1249cd39dfa7b4b19b"><code>dec2eb9</code></a>
Allow excluding engines from memory cleanup mode (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5786">#5786</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a5f4270f6bf406fa2d468e65961ed66c69e1d035"><code>a5f4270</code></a>
Publish sha256/sha512 checksums again but filter out signature ones (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5796">#5796</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/82130129139837ce26bfb9cf38e26c7b5ec00860"><code>8213012</code></a>
Update plugin nmcp-settings to v1.6.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5787">#5787</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d1bf8471dd5fe594d687eaa961eeb42d642af3f0"><code>d1bf847</code></a>
Generate Javadoc for aggregator modules</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d721de51cb39e5a4ffe45331f611dfab897653f3"><code>d721de5</code></a>
Pass <code>--no-fonts</code> to <code>javadoc</code> convention</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d289ec653ee268892da8defcb6f2fdb666efc4ed"><code>d289ec6</code></a>
Restore original SetSystemProperty values in a ParameterizedTest (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5720">#5720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 3aa3867b90..fa493e066d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -95,7 +95,7 @@ under the License.
     <project.build.outputTimestamp>1773644827</project.build.outputTimestamp>
     <target.gen.source.path>${project.build.directory}/generated-sources</target.gen.source.path>
     <dep.junit.platform.version>1.9.0</dep.junit.platform.version>
-    <dep.junit.jupiter.version>6.1.0</dep.junit.jupiter.version>
+    <dep.junit.jupiter.version>6.1.1</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.15.Final</dep.netty-bom.version>

From bf0b3445c5cac4f964665a5f28b4a80c4ad8d640 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:57:05 +0900
Subject: [PATCH 53/76] MINOR: [CI] Bump actions/cache from 5 to 6 (#1197)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
<h2>v5.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Update ts-http-runtime dependency by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
<li>Update dependencies &amp; patch security vulnerabilities by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p>
<h2>v.5.0.2</h2>
<h1>v5.0.2</h1>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/v5...v6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml  | 2 +-
 .github/workflows/rc.yml   | 8 ++++----
 .github/workflows/test.yml | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 2111f47254..f23c4e5e2f 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -42,7 +42,7 @@ jobs:
         with:
           python-version: '3.x'
       - name: pre-commit (cache)
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index f0e99f1219..79c4476345 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -133,7 +133,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Cache
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .docker
           key: jni-linux-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -264,7 +264,7 @@ jobs:
         run: |
           echo "CCACHE_DIR=${PWD}/ccache" >> ${GITHUB_ENV}
       - name: Cache ccache
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ccache
           key: jni-macos-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -340,7 +340,7 @@ jobs:
         run: |
           echo "CCACHE_DIR=${PWD}/ccache" >> ${GITHUB_ENV}
       - name: Cache ccache
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ccache
           key: jni-windows-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -414,7 +414,7 @@ jobs:
           repository: apache/arrow-testing
           path: testing
       - name: Cache ~/.m2
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2
           key: binaries-build-${{ hashFiles('**/*.java', '**/pom.xml') }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8c437a056d..1e4664237b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,7 +63,7 @@ jobs:
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .docker
           key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml', '**/*.java') }}
@@ -190,7 +190,7 @@ jobs:
         run: |
           ci/scripts/util_free_space.sh
       - name: Cache Docker Volumes
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .docker
           key: integration-conda-${{ hashFiles('cpp/**') }}

From 365a5f46d1fe437d2337d705dd6a0043f2ac1703 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:45:32 +0200
Subject: [PATCH 54/76] MINOR: [CI] Bump actions/checkout from 6 to 7 (#1193)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to
7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p>
<h2>v6.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update all references from v5 and v4 to v6 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
<li>Clarify v6 README by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a>
update error wording (<a
href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a>
getting ready for checkout v7 release (<a
href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a>
Bump the minor-npm-dependencies group across 1 directory with 3 updates
(<a
href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a>
upgrade module to esm and update dependencies (<a
href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a>
Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code>
and Remove uuid (<a
href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a>
Bump js-yaml from 4.1.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a>
Bump flatted from 3.3.1 to 3.4.2 (<a
href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a>
Bump actions/publish-immutable-action (<a
href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a>
block checking out fork pr for pull_request_target and workflow_run (<a
href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/v6...v7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=6&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml     |  2 +-
 .github/workflows/dev_pr.yml  |  2 +-
 .github/workflows/rc.yml      | 20 ++++++++++----------
 .github/workflows/release.yml |  2 +-
 .github/workflows/test.yml    | 20 ++++++++++----------
 5 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index f23c4e5e2f..25b08700fd 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -33,7 +33,7 @@ jobs:
     name: "pre-commit"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/dev_pr.yml b/.github/workflows/dev_pr.yml
index 20946c8185..ad000df88e 100644
--- a/.github/workflows/dev_pr.yml
+++ b/.github/workflows/dev_pr.yml
@@ -43,7 +43,7 @@ jobs:
     name: "Ensure PR format"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 79c4476345..fdfcd1cce3 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
       - name: Prepare for tag
@@ -113,17 +113,17 @@ jobs:
           ci/scripts/download_cpp.sh
       - name: Checkout Apache Arrow C++
         if: github.event_name == 'schedule'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow
           path: arrow
       - name: Checkout apache/arrow-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-testing
           path: arrow/testing
       - name: Checkout apache/parquet-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
@@ -180,17 +180,17 @@ jobs:
           ci/scripts/download_cpp.sh
       - name: Checkout Apache Arrow C++
         if: github.event_name == 'schedule'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow
           path: arrow
       - name: Checkout apache/arrow-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-testing
           path: arrow/testing
       - name: Checkout apache/parquet-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
@@ -310,7 +310,7 @@ jobs:
           ci/scripts/download_cpp.sh
       - name: Checkout Apache Arrow C++
         if: github.event_name == 'schedule'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow
           path: arrow
@@ -409,7 +409,7 @@ jobs:
           test -f jni/arrow_dataset_jni/x86_64/arrow_dataset_jni.dll
           test -f jni/arrow_orc_jni/x86_64/arrow_orc_jni.dll
       - name: Checkout apache/arrow-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-testing
           path: testing
@@ -497,7 +497,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: site
       - name: Prepare branch
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a2c5a55544..7692eb6cbe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,7 +65,7 @@ jobs:
               $artifact
           done
       - name: Checkout for publishing docs
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: site
       - name: Publish docs
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1e4664237b..ac8080d075 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -58,7 +58,7 @@ jobs:
       MAVEN: ${{ matrix.maven }}
     steps:
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
@@ -100,7 +100,7 @@ jobs:
           distribution: 'temurin'
           java-version: ${{ matrix.jdk }}
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
@@ -131,7 +131,7 @@ jobs:
           java-version: ${{ matrix.jdk }}
           distribution: 'temurin'
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
@@ -152,37 +152,37 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           repository: apache/arrow
           submodules: recursive
       - name: Checkout Arrow Rust
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-rs
           path: rust
       - name: Checkout Arrow nanoarrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-nanoarrow
           path: nanoarrow
       - name: Checkout Arrow .NET
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-dotnet
           path: dotnet
       - name: Checkout Arrow Go
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-go
           path: go
       - name: Checkout Arrow Java
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: java
       - name: Checkout Arrow JavaScript
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-js
           path: js

From 9122af2ad87c6f51d8ed9082ba2f0a122980ea2a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:45:52 +0200
Subject: [PATCH 55/76] MINOR: Bump com.google.protobuf:protobuf-bom from
 4.35.0 to 4.35.1 (#1186)

Bumps
[com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf)
from 4.35.0 to 4.35.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/protocolbuffers/protobuf/commits">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index fa493e066d..c39eafc209 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,7 +100,7 @@ under the License.
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.15.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.82.1</dep.grpc-bom.version>
-    <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
+    <dep.protobuf-bom.version>4.35.1</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.22.0</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>
     <dep.fbs.version>25.2.10</dep.fbs.version>

From b0e51af855ef5befac903b1a6de3f535258ccd1b Mon Sep 17 00:00:00 2001
From: YangJie <yangjie01@baidu.com>
Date: Tue, 30 Jun 2026 12:40:01 +0800
Subject: [PATCH 56/76] GH-1116: [Java] Fix compressed buffer prefix write and
 ZSTD dstCapacity (#1119)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Two fixes in the compression codec:

1. **`AbstractCompressionCodec.compress()`: capture `writerIndex()`
once**

The previous code read `uncompressedBuffer.writerIndex()` at multiple
sites — for the size comparison and again after `doCompress()` to
populate the 8-byte uncompressed-length prefix. Capture the value once
at the top of `compress()` and reuse it for the empty-buffer check, the
size comparison, and the prefix, so all three consumers see the same
value.

2. **`ZstdCompressionCodec.doCompress()`: `dstCapacity` overstated by 8
bytes**

`Zstd.compressUnsafe(dst, dstSize, ...)` expects `dstSize` to be the
available space from `dst`. The code offsets `dst` by 8 bytes past the
prefix but passed `8 + maxSize` instead of `maxSize`. The
`compressBound()` headroom hides this in practice, but the parameter was
semantically wrong. Pass `maxSize`.

## Tests

Covered by the existing round-trip tests (`testEmptyBuffer`,
`testReadWriteStream`, `testReadWriteFile`, etc.). I was not able to
construct a minimal reproducer for the original `declaredUncompressed=0`
symptom on the unfixed code, so both fixes are conservative correctness
improvements derived from code inspection rather than failing-then-green
regression tests.
---
 .../org/apache/arrow/compression/ZstdCompressionCodec.java | 2 +-
 .../arrow/vector/compression/AbstractCompressionCodec.java | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java b/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
index 290723608d..ed46fe81b4 100644
--- a/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
+++ b/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
@@ -44,7 +44,7 @@ protected ArrowBuf doCompress(BufferAllocator allocator, ArrowBuf uncompressedBu
     long bytesWritten =
         Zstd.compressUnsafe(
             compressedBuffer.memoryAddress() + CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH,
-            dstSize,
+            maxSize,
             /*src*/ uncompressedBuffer.memoryAddress(),
             /* srcSize= */ uncompressedBuffer.writerIndex(),
             /* level= */ this.compressionLevel);
diff --git a/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java b/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
index 58d9e4db9b..b108173c82 100644
--- a/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
+++ b/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
@@ -29,7 +29,11 @@ public abstract class AbstractCompressionCodec implements CompressionCodec {
 
   @Override
   public ArrowBuf compress(BufferAllocator allocator, ArrowBuf uncompressedBuffer) {
-    if (uncompressedBuffer.writerIndex() == 0L) {
+    // GH-1116: capture writerIndex() once so the empty-buffer check, size
+    // comparison, and uncompressed-length prefix all see the same value.
+    long uncompressedLength = uncompressedBuffer.writerIndex();
+
+    if (uncompressedLength == 0L) {
       // shortcut for empty buffer
       ArrowBuf compressedBuffer = allocator.buffer(CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH);
       compressedBuffer.setLong(0, 0);
@@ -41,7 +45,6 @@ public ArrowBuf compress(BufferAllocator allocator, ArrowBuf uncompressedBuffer)
     ArrowBuf compressedBuffer = doCompress(allocator, uncompressedBuffer);
     long compressedLength =
         compressedBuffer.writerIndex() - CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH;
-    long uncompressedLength = uncompressedBuffer.writerIndex();
 
     if (compressedLength > uncompressedLength) {
       // compressed buffer is larger, send the raw buffer

From 301d3d8f889d3e4d1f45fc6e1707460ae5baaeb4 Mon Sep 17 00:00:00 2001
From: Pedro Matias <pedro.matias@dremio.com>
Date: Tue, 30 Jun 2026 05:41:30 +0100
Subject: [PATCH 57/76] GH-1063: Add is_update field to
 ActionCreatePreparedStatementResult (#1064)

## What's Changed

A new field, `optional bool is_update = 4;`, was added to `message
ActionCreatePreparedStatementResult`. When this field is sent by the
server, its value indicates whether the proper network flow to execute
the query that the driver should follow uses
`CommandPreparedStatementQuery` or `CommandPreparedStatementUpdate`.


For outdated servers that don't send the field, the driver maintains its
current behavior of using `CommandPreparedStatementQuery` when the
`dataset_schema` is not empty, thus ensuring the backward compatibility
of the new driver with old servers.

This change was created with AI assistance (Augment Code and Claude
code). All lines were manually reviewed by a human. The output is not
copyrightable subject matter.

- Closes #1063

---------

Co-authored-by: David Li <li.davidm96@gmail.com>
---
 arrow-format/FlightSql.proto                  |  5 ++
 .../ArrowFlightJdbcFlightStreamResultSet.java |  2 +-
 ...owFlightJdbcVectorSchemaRootResultSet.java |  2 +-
 .../driver/jdbc/ArrowFlightMetaImpl.java      | 23 +++++--
 .../client/ArrowFlightSqlClientHandler.java   | 19 ++++++
 .../ArrowFlightPreparedStatementTest.java     | 48 ++++++++++++++
 .../jdbc/ArrowFlightStatementExecuteTest.java | 66 +++++++++++++++++++
 .../jdbc/utils/MockFlightSqlProducer.java     | 42 ++++++++++++
 .../arrow/flight/sql/FlightSqlClient.java     | 13 ++++
 9 files changed, 212 insertions(+), 8 deletions(-)

diff --git a/arrow-format/FlightSql.proto b/arrow-format/FlightSql.proto
index 566230c2a6..b1dc57b33b 100644
--- a/arrow-format/FlightSql.proto
+++ b/arrow-format/FlightSql.proto
@@ -1550,6 +1550,11 @@ message ActionCreatePreparedStatementResult {
   // If the query provided contained parameters, parameter_schema contains the
   // schema of the expected parameters.  It should be an IPC-encapsulated Schema, as described in Schema.fbs.
   bytes parameter_schema = 3;
+
+  // When set to true, the query should be executed with CommandPreparedStatementUpdate,
+  // when set to false, the query should be executed with CommandPreparedStatementQuery.
+  // If not set, the client can choose how to execute the query.
+  optional bool is_update = 4;
 }
 
 /*
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
index 2885f7895b..376e5b11e7 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
@@ -106,7 +106,7 @@ static ArrowFlightJdbcFlightStreamResultSet fromFlightInfo(
     final TimeZone timeZone = TimeZone.getDefault();
     final QueryState state = new QueryState();
 
-    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null);
+    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null, null);
 
     final AvaticaResultSetMetaData resultSetMetaData =
         new AvaticaResultSetMetaData(null, null, signature);
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
index 5d02d6e843..ad6670a001 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
@@ -73,7 +73,7 @@ public static ArrowFlightJdbcVectorSchemaRootResultSet fromVectorSchemaRoot(
     final TimeZone timeZone = TimeZone.getDefault();
     final QueryState state = new QueryState();
 
-    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null);
+    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null, null);
 
     final AvaticaResultSetMetaData resultSetMetaData =
         new AvaticaResultSetMetaData(null, null, signature);
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
index 64529b50c8..0d85b5eddb 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
@@ -53,7 +53,8 @@ public ArrowFlightMetaImpl(final AvaticaConnection connection) {
   }
 
   /** Construct a signature. */
-  static Signature newSignature(final String sql, Schema resultSetSchema, Schema parameterSchema) {
+  static Signature newSignature(
+      final String sql, Schema resultSetSchema, Schema parameterSchema, Boolean isUpdate) {
     List<ColumnMetaData> columnMetaData =
         resultSetSchema == null
             ? new ArrayList<>()
@@ -62,10 +63,17 @@ static Signature newSignature(final String sql, Schema resultSetSchema, Schema p
         parameterSchema == null
             ? new ArrayList<>()
             : ConvertUtils.convertArrowFieldsToAvaticaParameters(parameterSchema.getFields());
-    StatementType statementType =
-        resultSetSchema == null || resultSetSchema.getFields().isEmpty()
-            ? StatementType.IS_DML
-            : StatementType.SELECT;
+    // If the server provided the is_update field, use it to determine the statement type
+    StatementType statementType;
+    if (isUpdate != null) {
+      statementType = isUpdate ? StatementType.IS_DML : StatementType.SELECT;
+    } else {
+      // Fall back to the legacy logic: check if the result set schema is empty
+      statementType =
+          resultSetSchema == null || resultSetSchema.getFields().isEmpty()
+              ? StatementType.IS_DML
+              : StatementType.SELECT;
+    }
     return new Signature(
         columnMetaData,
         sql,
@@ -178,7 +186,10 @@ private PreparedStatement prepareForHandle(final String query, StatementHandle h
         ((ArrowFlightConnection) connection).getClientHandler().prepare(query);
     handle.signature =
         newSignature(
-            query, preparedStatement.getDataSetSchema(), preparedStatement.getParameterSchema());
+            query,
+            preparedStatement.getDataSetSchema(),
+            preparedStatement.getParameterSchema(),
+            preparedStatement.isUpdate());
     statementHandlePreparedStatementMap.put(new StatementHandleKey(handle), preparedStatement);
     return preparedStatement;
   }
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
index f0ea284239..719cc38a2b 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
@@ -388,6 +388,14 @@ public interface PreparedStatement extends AutoCloseable {
      */
     Schema getParameterSchema();
 
+    /**
+     * Gets whether this {@link PreparedStatement} is an update statement.
+     *
+     * @return {@code true} if this is an update statement, {@code false} if it's a query, or {@code
+     *     null} if the server did not provide this information.
+     */
+    @Nullable Boolean isUpdate();
+
     void setParameters(VectorSchemaRoot parameters);
 
     @Override
@@ -456,6 +464,12 @@ public long executeUpdate() {
 
       @Override
       public StatementType getType() {
+        // If the server provided the is_update field, use it to determine the statement type
+        final Boolean isUpdate = preparedStatement.isUpdate();
+        if (isUpdate != null) {
+          return isUpdate ? StatementType.UPDATE : StatementType.SELECT;
+        }
+        // Fall back to the legacy logic: check if the result set schema is empty
         final Schema schema = preparedStatement.getResultSetSchema();
         return schema.getFields().isEmpty() ? StatementType.UPDATE : StatementType.SELECT;
       }
@@ -475,6 +489,11 @@ public void setParameters(VectorSchemaRoot parameters) {
         preparedStatement.setParameters(parameters);
       }
 
+      @Override
+      public Boolean isUpdate() {
+        return preparedStatement.isUpdate();
+      }
+
       @Override
       public void close() {
         try {
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
index 0369c3a162..078837adf3 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
@@ -98,6 +98,40 @@ public void testSimpleQueryNoParameterBindingWithExecute() throws SQLException {
     }
   }
 
+  @Test
+  public void testSimpleQueryNoParameterBindingWithExecuteV2() throws SQLException {
+    final String query = "SELECT * FROM TEST_V2";
+    final Schema schema =
+        new Schema(Collections.singletonList(Field.nullable("", Types.MinorType.INT.getType())));
+    PRODUCER.addSelectQuery(
+        query,
+        schema,
+        Collections.singletonList(
+            listener -> {
+              try (final BufferAllocator allocator = new RootAllocator(Long.MAX_VALUE);
+                  final VectorSchemaRoot root = VectorSchemaRoot.create(schema, allocator)) {
+                root.allocateNew();
+                ((IntVector) root.getVector(0)).setSafe(0, 123);
+                root.setRowCount(1);
+                listener.start(root);
+                listener.putNext();
+              } finally {
+                listener.completed();
+              }
+            }),
+        false);
+    try (final PreparedStatement preparedStatement = connection.prepareStatement(query)) {
+      boolean isResultSet = preparedStatement.execute();
+      assertTrue(isResultSet);
+      final ResultSet resultSet = preparedStatement.getResultSet();
+      assertTrue(resultSet.next());
+      assertEquals(123, resultSet.getInt(1));
+      assertFalse(resultSet.next());
+      assertFalse(preparedStatement.getMoreResults());
+      assertEquals(-1, preparedStatement.getUpdateCount());
+    }
+  }
+
   @Test
   public void testQueryWithParameterBinding() throws SQLException {
     final String query = "Fake query with parameters";
@@ -203,6 +237,20 @@ public void testUpdateQueryWithExecute() throws SQLException {
     }
   }
 
+  @Test
+  public void testUpdateQueryWithExecuteV2() throws SQLException {
+    String query = "Fake update with execute V2";
+    PRODUCER.addUpdateQuery(query, /*updatedRows*/ 99, true);
+    try (final PreparedStatement stmt = connection.prepareStatement(query)) {
+      boolean isResultSet = stmt.execute();
+      assertFalse(isResultSet);
+      int updated = stmt.getUpdateCount();
+      assertEquals(99, updated);
+      assertFalse(stmt.getMoreResults());
+      assertEquals(-1, stmt.getUpdateCount());
+    }
+  }
+
   @Test
   public void testUpdateQueryWithParameters() throws SQLException {
     String query = "Fake update with parameters";
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
index 632cb0ba56..6acce9c2a6 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
@@ -62,6 +62,9 @@ public class ArrowFlightStatementExecuteTest {
   private static final String SAMPLE_LARGE_UPDATE_QUERY =
       "UPDATE this_large_table SET this_large_field = that_large_field FROM this_large_test WHERE this_large_condition";
   private static final long SAMPLE_LARGE_UPDATE_COUNT = Long.MAX_VALUE;
+  private static final String SAMPLE_QUERY_CMD_V2 = "SELECT * FROM this_test_v2";
+  private static final String SAMPLE_LARGE_UPDATE_QUERY_V2 =
+      "UPDATE this_large_table_v2 SET this_large_field = that_large_field FROM this_large_test WHERE this_large_condition";
   private static final MockFlightSqlProducer PRODUCER = new MockFlightSqlProducer();
 
   @RegisterExtension
@@ -96,6 +99,31 @@ public static void setUpBeforeClass() {
             }));
     PRODUCER.addUpdateQuery(SAMPLE_UPDATE_QUERY, SAMPLE_UPDATE_COUNT);
     PRODUCER.addUpdateQuery(SAMPLE_LARGE_UPDATE_QUERY, SAMPLE_LARGE_UPDATE_COUNT);
+
+    // V2 queries with is_update field set
+    PRODUCER.addSelectQuery(
+        SAMPLE_QUERY_CMD_V2,
+        SAMPLE_QUERY_SCHEMA,
+        Collections.singletonList(
+            listener -> {
+              try (final BufferAllocator allocator = new RootAllocator(Long.MAX_VALUE);
+                  final VectorSchemaRoot root =
+                      VectorSchemaRoot.create(SAMPLE_QUERY_SCHEMA, allocator)) {
+                final UInt1Vector vector = (UInt1Vector) root.getVector(VECTOR_NAME);
+                IntStream.range(0, SAMPLE_QUERY_ROWS)
+                    .forEach(index -> vector.setSafe(index, index));
+                vector.setValueCount(SAMPLE_QUERY_ROWS);
+                root.setRowCount(SAMPLE_QUERY_ROWS);
+                listener.start(root);
+                listener.putNext();
+              } catch (final Throwable throwable) {
+                listener.error(throwable);
+              } finally {
+                listener.completed();
+              }
+            }),
+        false);
+    PRODUCER.addUpdateQuery(SAMPLE_LARGE_UPDATE_QUERY_V2, SAMPLE_LARGE_UPDATE_COUNT, true);
   }
 
   @BeforeEach
@@ -168,4 +196,42 @@ public void testUpdateCountShouldStartOnZero() throws SQLException {
         is(allOf(equalTo(statement.getLargeUpdateCount()), equalTo(0L))));
     assertThat(statement.getResultSet(), is(nullValue()));
   }
+
+  @Test
+  public void testExecuteShouldRunSelectQueryV2() throws SQLException {
+    assertThat(statement.execute(SAMPLE_QUERY_CMD_V2), is(true));
+    final Set<Byte> numbers =
+        IntStream.range(0, SAMPLE_QUERY_ROWS)
+            .boxed()
+            .map(Integer::byteValue)
+            .collect(Collectors.toCollection(HashSet::new));
+    try (final ResultSet resultSet = statement.getResultSet()) {
+      final int columnCount = resultSet.getMetaData().getColumnCount();
+      assertThat(columnCount, is(1));
+      int rowCount = 0;
+      for (; resultSet.next(); rowCount++) {
+        assertThat(numbers.remove(resultSet.getByte(1)), is(true));
+      }
+      assertThat(rowCount, is(equalTo(SAMPLE_QUERY_ROWS)));
+    }
+    assertThat(numbers, is(Collections.emptySet()));
+    assertThat(
+        (long) statement.getUpdateCount(),
+        is(allOf(equalTo(statement.getLargeUpdateCount()), equalTo(-1L))));
+  }
+
+  @Test
+  public void testExecuteShouldRunUpdateQueryForLargeUpdateV2() throws SQLException {
+    assertThat(statement.execute(SAMPLE_LARGE_UPDATE_QUERY_V2), is(false)); // UPDATE query.
+    final long updateCountSmall = statement.getUpdateCount();
+    final long updateCountLarge = statement.getLargeUpdateCount();
+    assertThat(updateCountLarge, is(equalTo(SAMPLE_LARGE_UPDATE_COUNT)));
+    assertThat(
+        updateCountSmall,
+        is(
+            allOf(
+                equalTo((long) AvaticaUtils.toSaturatedInt(updateCountLarge)),
+                not(equalTo(updateCountLarge)))));
+    assertThat(statement.getResultSet(), is(nullValue()));
+  }
 }
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
index 45c2a96404..6627d91ab6 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
@@ -87,6 +87,7 @@
 import org.apache.arrow.vector.types.pojo.Schema;
 import org.apache.arrow.vector.util.JsonStringArrayList;
 import org.apache.calcite.avatica.Meta.StatementType;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /** An ad-hoc {@link FlightSqlProducer} for tests. */
 public final class MockFlightSqlProducer implements FlightSqlProducer {
@@ -101,6 +102,7 @@ public final class MockFlightSqlProducer implements FlightSqlProducer {
   private final SqlInfoBuilder sqlInfoBuilder = new SqlInfoBuilder();
   private final Map<String, Schema> parameterSchemas = new HashMap<>();
   private final Map<String, List<List<Object>>> expectedParameterValues = new HashMap<>();
+  private final Map<String, Boolean> isUpdateMap = new HashMap<>();
 
   private final Map<String, Integer> actionTypeCounter = new HashMap<>();
 
@@ -176,6 +178,40 @@ public void addUpdateQuery(final String sqlCommand, final long updatedRows) {
         });
   }
 
+  /**
+   * Registers a new {@link StatementType#SELECT} SQL query, optionally setting the is_update field.
+   *
+   * @param sqlCommand the SQL command under which to register the new query.
+   * @param schema the schema to use for the query result.
+   * @param resultProviders the result provider for this query.
+   * @param isUpdate value to report for the is_update field, or {@code null} to leave it unset.
+   */
+  public void addSelectQuery(
+      final String sqlCommand,
+      final Schema schema,
+      final List<Consumer<ServerStreamListener>> resultProviders,
+      final @Nullable Boolean isUpdate) {
+    addSelectQuery(sqlCommand, schema, resultProviders);
+    if (isUpdate != null) {
+      isUpdateMap.put(sqlCommand, isUpdate);
+    }
+  }
+
+  /**
+   * Registers a new {@link StatementType#UPDATE} SQL query, optionally setting the is_update field.
+   *
+   * @param sqlCommand the SQL command.
+   * @param updatedRows the number of rows affected.
+   * @param isUpdate value to report for the is_update field, or {@code null} to leave it unset.
+   */
+  public void addUpdateQuery(
+      final String sqlCommand, final long updatedRows, final @Nullable Boolean isUpdate) {
+    addUpdateQuery(sqlCommand, updatedRows);
+    if (isUpdate != null) {
+      isUpdateMap.put(sqlCommand, isUpdate);
+    }
+  }
+
   /**
    * Adds a catalog query to the results.
    *
@@ -247,6 +283,12 @@ public void createPreparedStatement(
         resultBuilder.setParameterSchema(ByteString.copyFrom(outputStream.toByteArray()));
       }
 
+      // Set is_update field if present
+      final Boolean isUpdate = isUpdateMap.get(query);
+      if (isUpdate != null) {
+        resultBuilder.setIsUpdate(isUpdate);
+      }
+
       listener.onNext(new Result(pack(resultBuilder.build()).toByteArray()));
     } catch (final Throwable t) {
       listener.onError(t);
diff --git a/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java b/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
index 623f9311e8..0af09faee1 100644
--- a/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
+++ b/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
@@ -1284,6 +1284,19 @@ public Schema getParameterSchema() {
       return parameterSchema;
     }
 
+    /**
+     * Returns whether the server indicated this prepared statement is an update query.
+     *
+     * @return true if the server indicated this is an update query, false if the server indicated
+     *     this is a select query, or null if the server did not provide this information.
+     */
+    public Boolean isUpdate() {
+      if (preparedStatementResult.hasIsUpdate()) {
+        return preparedStatementResult.getIsUpdate();
+      }
+      return null;
+    }
+
     /** Get the schema of the result set (should be identical to {@link #getResultSetSchema()}). */
     public SchemaResult fetchSchema(CallOption... options) {
       checkOpen();

From fcba1b0345faed30621863af85a102c6d2fc1362 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 07:51:48 +0200
Subject: [PATCH 58/76] MINOR: Bump org.cyclonedx:cyclonedx-maven-plugin from
 2.9.1 to 2.9.2 (#1198)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin)
from 2.9.1 to 2.9.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/releases">org.cyclonedx:cyclonedx-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>2.9.2</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li>chore: upgrade maven-dependency-analyzer/asm, support Java 25 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/630">#630</a>)
<a href="https://github.com/shihyuho"><code>@​shihyuho</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>Bump commons-codec:commons-codec from 1.17.1 to 1.22.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/650">#650</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/622">#622</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore: upgrade maven-dependency-analyzer/asm, support Java 25 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/630">#630</a>)
<a href="https://github.com/shihyuho"><code>@​shihyuho</code></a></li>
</ul>
<h2>🔧 Build</h2>
<ul>
<li>update scm urls (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/662">#662</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>switch to Central Publishing Portal (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/659">#659</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>Bump org.apache.maven.plugins:maven-project-info-reports-plugin from
3.8.0 to 3.9.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/655">#655</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump plugin-tools.version from 3.15.0 to 3.15.2 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/654">#654</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump io.takari.maven.plugins:takari-plugin-integration-testing from
3.0.1 to 3.1.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/616">#616</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-invoker-plugin from 3.7.0 to
3.9.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/617">#617</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump io.takari.maven.plugins:takari-plugin-testing from 3.0.0 to
3.1.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/618">#618</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.13.0 to
3.14.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/621">#621</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump actions/checkout from 6.0.1 to 6.0.2 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/639">#639</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump actions/setup-java from 4 to 5 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/620">#620</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>use shields.io badge (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/648">#648</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>Bump actions/checkout from 6.0.0 to 6.0.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/635">#635</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump actions/checkout from 4.2.2 to 6.0.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/633">#633</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore: GH workflow permissions (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/606">#606</a>)
<a
href="https://github.com/jkowalleck"><code>@​jkowalleck</code></a></li>
<li>simplify compiler release configuration (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/518">#518</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>Bump JamesIves/github-pages-deploy-action from 4.7.1 to 4.7.3 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/590">#590</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>upgrade to Doxia 2: m-site-p and skin (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/593">#593</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>add Reproducible Central report (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/592">#592</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/0fe189d0cd2c80acb1f518e53fbb703456e6534a"><code>0fe189d</code></a>
[maven-release-plugin] prepare release cyclonedx-maven-plugin-2.9.2</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/96c218c71646aa987d5778b9f0f035f40ff45239"><code>96c218c</code></a>
update scm urls</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/0fe08b4215263965690c0a0a022c1fdbc396cad8"><code>0fe08b4</code></a>
Revert &quot;Bump JamesIves/github-pages-deploy-action from 4.7.3 to
4.8.0&quot;</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/6779e48e4108e5c1881109f39ebda293311ec591"><code>6779e48</code></a>
Revert &quot;Bump release-drafter/release-drafter from 6 to 7&quot;</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/955fead7657740f51b738de11961d4c1eb233bb3"><code>955fead</code></a>
switch to Central Publishing Portal</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/50dbac7e4cd969764e2bfb8e971b0fcf5fcbebba"><code>50dbac7</code></a>
Bump release-drafter/release-drafter from 6 to 7</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/d50bc582155e15a6a1560edab0f1e94d019601e1"><code>d50bc58</code></a>
Bump org.apache.maven.plugins:maven-project-info-reports-plugin</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/1034644886969032df5552fd4132102baeca40c8"><code>1034644</code></a>
Bump plugin-tools.version from 3.15.0 to 3.15.2</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/018ab8e4fdf3b73049497a76bea952983b88389f"><code>018ab8e</code></a>
Bump commons-codec:commons-codec from 1.17.1 to 1.22.0</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/e3597051e8c6eb694e9ccd044b9b5a0829166add"><code>e359705</code></a>
Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0</li>
<li>Additional commits viewable in <a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/compare/cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.cyclonedx:cyclonedx-maven-plugin&package-manager=maven&previous-version=2.9.1&new-version=2.9.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index c39eafc209..6a97ac4620 100644
--- a/pom.xml
+++ b/pom.xml
@@ -522,7 +522,7 @@ under the License.
         <plugin>
           <groupId>org.cyclonedx</groupId>
           <artifactId>cyclonedx-maven-plugin</artifactId>
-          <version>2.9.1</version>
+          <version>2.9.2</version>
         </plugin>
         <plugin>
           <groupId>org.apache.drill.tools</groupId>

From bd8cd52fc8426b485a8b3e64997fb178c84c9de2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 07:54:25 +0200
Subject: [PATCH 59/76] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-10 to
 1.5.7-11 (#1184)

Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-10 to 1.5.7-11.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/luben/zstd-jni/commits/v1.5.7-11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.github.luben:zstd-jni&package-manager=maven&previous-version=1.5.7-10&new-version=1.5.7-11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 compression/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compression/pom.xml b/compression/pom.xml
index 41cdb03796..aa7dee6f89 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
     <dependency>
       <groupId>com.github.luben</groupId>
       <artifactId>zstd-jni</artifactId>
-      <version>1.5.7-10</version>
+      <version>1.5.7-11</version>
     </dependency>
   </dependencies>
 </project>

From 04471f4f8900e0a91efe0d6ae717c3211aa5efbd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 2 Jul 2026 08:11:17 +0200
Subject: [PATCH 60/76] MINOR: Bump logback.version from 1.5.32 to 1.5.34
 (#1171)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps `logback.version` from 1.5.32 to 1.5.34.
Updates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java &quot;21&quot; 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan=&quot;true&quot; attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code>&lt;conversionRule&gt;</code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the &quot;java.lang&quot; and
&quot;java.util&quot; packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
&quot;TLSv1.2&quot;. This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as &quot;&amp;&quot; as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />

Updates `ch.qos.logback:logback-core` from 1.5.32 to 1.5.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-core's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java &quot;21&quot; 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan=&quot;true&quot; attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code>&lt;conversionRule&gt;</code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the &quot;java.lang&quot; and
&quot;java.util&quot; packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
&quot;TLSv1.2&quot;. This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as &quot;&amp;&quot; as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 6a97ac4620..231720eb44 100644
--- a/pom.xml
+++ b/pom.xml
@@ -113,7 +113,7 @@ under the License.
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
     <checker.framework.version>4.2.0</checker.framework.version>
-    <logback.version>1.5.32</logback.version>
+    <logback.version>1.5.34</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>
     <!-- List of add-opens arg line arguments for tests -->

From 8ce39730fe969b41c8620b02f3fa77c974d90784 Mon Sep 17 00:00:00 2001
From: Jordan Epstein <32082339+jordepic@users.noreply.github.com>
Date: Thu, 2 Jul 2026 18:16:18 -0500
Subject: [PATCH 61/76] GH-1179: Correct the size of var-width vector with >0
 start offset during vector append (#1180)

## What's Changed

Fix VectorAppender data size computation for variable-width vectors with
non-zero start offsets

When appending a variable width offset vector in DataFusion comet I was
receiving exceptions
due to allocating too much memory. This is because Comet passes variable
width arrays back
to Java where the initial offset vector entry is greater than 0. Prior
to this change, arrow-java
determines how many bytes to copy by just looking at the last offset
entry in the buffer,
completely disregarding the value of the first. If first = 100 and last
= 200, Java will still
copy 200 bytes instead of 100. In this change we fix that.

Closes #1179

---------

Co-authored-by: Jordan Epstein <jordan.epstein@imc.com>
---
 .../arrow/vector/util/VectorAppender.java     |  92 ++++++---
 .../arrow/vector/util/TestVectorAppender.java | 189 ++++++++++++++++++
 2 files changed, 257 insertions(+), 24 deletions(-)

diff --git a/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java b/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
index e7c0d11cb9..2cfeb0a04d 100644
--- a/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
+++ b/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
@@ -125,10 +125,15 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
         targetVector
             .getOffsetBuffer()
             .getInt((long) targetVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
+    // The delta vector's offset buffer need not start at zero (e.g. a vector imported through
+    // the C data interface from a sliced array), so the amount of data to append is the
+    // distance between its first and last offsets, not the last offset itself.
+    int deltaDataStart = deltaVector.getOffsetBuffer().getInt(0);
     int deltaDataSize =
         deltaVector
-            .getOffsetBuffer()
-            .getInt((long) deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
+                .getOffsetBuffer()
+                .getInt((long) deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH)
+            - deltaDataStart;
     int newValueCapacity = targetDataSize + deltaDataSize;
 
     // make sure there is enough capacity
@@ -149,7 +154,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
 
     // append data buffer
     MemoryUtil.copyMemory(
-        deltaVector.getDataBuffer().memoryAddress(),
+        deltaVector.getDataBuffer().memoryAddress() + deltaDataStart,
         targetVector.getDataBuffer().memoryAddress() + targetDataSize,
         deltaDataSize);
 
@@ -160,7 +165,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
             + (targetVector.getValueCount() + 1) * BaseVariableWidthVector.OFFSET_WIDTH,
         deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
 
-    // increase each offset from the second buffer
+    // rebase each appended offset to the target's data, accounting for the delta's start offset
     for (int i = 0; i < deltaVector.getValueCount(); i++) {
       int oldOffset =
           targetVector
@@ -172,7 +177,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
           .getOffsetBuffer()
           .setInt(
               (long) (targetVector.getValueCount() + 1 + i) * BaseVariableWidthVector.OFFSET_WIDTH,
-              oldOffset + targetDataSize);
+              oldOffset - deltaDataStart + targetDataSize);
     }
     ((BaseVariableWidthVector) targetVector).setLastSet(newValueCount - 1);
     targetVector.setValueCount(newValueCount);
@@ -196,11 +201,15 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
             .getOffsetBuffer()
             .getLong(
                 (long) targetVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
+    // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+    // offset buffer need not start at zero
+    long deltaDataStart = deltaVector.getOffsetBuffer().getLong(0);
     long deltaDataSize =
         deltaVector
-            .getOffsetBuffer()
-            .getLong(
-                (long) deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
+                .getOffsetBuffer()
+                .getLong(
+                    (long) deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH)
+            - deltaDataStart;
     long newValueCapacity = targetDataSize + deltaDataSize;
 
     // make sure there is enough capacity
@@ -221,7 +230,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
 
     // append data buffer
     MemoryUtil.copyMemory(
-        deltaVector.getDataBuffer().memoryAddress(),
+        deltaVector.getDataBuffer().memoryAddress() + deltaDataStart,
         targetVector.getDataBuffer().memoryAddress() + targetDataSize,
         deltaDataSize);
 
@@ -232,7 +241,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
             + (targetVector.getValueCount() + 1) * BaseLargeVariableWidthVector.OFFSET_WIDTH,
         deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
 
-    // increase each offset from the second buffer
+    // rebase each appended offset to the target's data, accounting for the delta's start offset
     for (int i = 0; i < deltaVector.getValueCount(); i++) {
       long oldOffset =
           targetVector
@@ -245,7 +254,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
           .setLong(
               (long) (targetVector.getValueCount() + 1 + i)
                   * BaseLargeVariableWidthVector.OFFSET_WIDTH,
-              oldOffset + targetDataSize);
+              oldOffset - deltaDataStart + targetDataSize);
     }
     ((BaseLargeVariableWidthVector) targetVector).setLastSet(newValueCount - 1);
     targetVector.setValueCount(newValueCount);
@@ -331,16 +340,20 @@ public ValueVector visit(ListVector deltaVector, Void value) {
         targetVector
             .getOffsetBuffer()
             .getInt((long) targetVector.getValueCount() * ListVector.OFFSET_WIDTH);
-    int deltaListSize =
+    // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+    // offset buffer need not start at zero
+    int deltaListStart = deltaVector.getOffsetBuffer().getInt(0);
+    int deltaListEnd =
         deltaVector
             .getOffsetBuffer()
             .getInt((long) deltaVector.getValueCount() * ListVector.OFFSET_WIDTH);
+    int deltaListSize = deltaListEnd - deltaListStart;
 
     ListVector targetListVector = (ListVector) targetVector;
 
     // make sure the underlying vector has value count set
     targetListVector.getDataVector().setValueCount(targetListSize);
-    deltaVector.getDataVector().setValueCount(deltaListSize);
+    deltaVector.getDataVector().setValueCount(deltaListEnd);
 
     // make sure there is enough capacity
     while (targetVector.getValueCapacity() < newValueCount) {
@@ -372,13 +385,16 @@ public ValueVector visit(ListVector deltaVector, Void value) {
           .getOffsetBuffer()
           .setInt(
               (long) (targetVector.getValueCount() + 1 + i) * ListVector.OFFSET_WIDTH,
-              oldOffset + targetListSize);
+              oldOffset - deltaListStart + targetListSize);
     }
     targetListVector.setLastSet(newValueCount - 1);
 
     // append underlying vectors
-    VectorAppender innerAppender = new VectorAppender(targetListVector.getDataVector());
-    deltaVector.getDataVector().accept(innerAppender, null);
+    appendDataVector(
+        targetListVector.getDataVector(),
+        deltaVector.getDataVector(),
+        deltaListStart,
+        deltaListSize);
 
     targetVector.setValueCount(newValueCount);
     return targetVector;
@@ -400,17 +416,21 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
         targetVector
             .getOffsetBuffer()
             .getLong((long) targetVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
-    long deltaListSize =
+    // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+    // offset buffer need not start at zero
+    long deltaListStart = deltaVector.getOffsetBuffer().getLong(0);
+    long deltaListEnd =
         deltaVector
             .getOffsetBuffer()
             .getLong((long) deltaVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
+    long deltaListSize = deltaListEnd - deltaListStart;
 
-    ListVector targetListVector = (ListVector) targetVector;
+    LargeListVector targetListVector = (LargeListVector) targetVector;
 
     // make sure the underlying vector has value count set
     // todo recheck these casts when int64 vectors are supported
     targetListVector.getDataVector().setValueCount(checkedCastToInt(targetListSize));
-    deltaVector.getDataVector().setValueCount(checkedCastToInt(deltaListSize));
+    deltaVector.getDataVector().setValueCount(checkedCastToInt(deltaListEnd));
 
     // make sure there is enough capacity
     while (targetVector.getValueCapacity() < newValueCount) {
@@ -427,10 +447,10 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
 
     // append offset buffer
     MemoryUtil.copyMemory(
-        deltaVector.getOffsetBuffer().memoryAddress() + ListVector.OFFSET_WIDTH,
+        deltaVector.getOffsetBuffer().memoryAddress() + LargeListVector.OFFSET_WIDTH,
         targetVector.getOffsetBuffer().memoryAddress()
             + (targetVector.getValueCount() + 1) * LargeListVector.OFFSET_WIDTH,
-        (long) deltaVector.getValueCount() * ListVector.OFFSET_WIDTH);
+        (long) deltaVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
 
     // increase each offset from the second buffer
     for (int i = 0; i < deltaVector.getValueCount(); i++) {
@@ -443,18 +463,42 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
           .getOffsetBuffer()
           .setLong(
               (long) (targetVector.getValueCount() + 1 + i) * LargeListVector.OFFSET_WIDTH,
-              oldOffset + targetListSize);
+              oldOffset - deltaListStart + targetListSize);
     }
     targetListVector.setLastSet(newValueCount - 1);
 
     // append underlying vectors
-    VectorAppender innerAppender = new VectorAppender(targetListVector.getDataVector());
-    deltaVector.getDataVector().accept(innerAppender, null);
+    appendDataVector(
+        targetListVector.getDataVector(),
+        deltaVector.getDataVector(),
+        checkedCastToInt(deltaListStart),
+        checkedCastToInt(deltaListSize));
 
     targetVector.setValueCount(newValueCount);
     return targetVector;
   }
 
+  /**
+   * Appends the range [start, start + length) of the delta vector's data vector to the target
+   * vector's data vector. The range may not cover the whole delta data vector when the delta's
+   * offset buffer does not start at zero.
+   */
+  private static void appendDataVector(
+      ValueVector targetDataVector, ValueVector deltaDataVector, int start, int length) {
+    if (start == 0 && length == deltaDataVector.getValueCount()) {
+      VectorAppender innerAppender = new VectorAppender(targetDataVector);
+      deltaDataVector.accept(innerAppender, null);
+      return;
+    }
+    TransferPair transferPair =
+        deltaDataVector.getTransferPair(deltaDataVector.getField(), deltaDataVector.getAllocator());
+    transferPair.splitAndTransfer(start, length);
+    try (ValueVector slicedDeltaDataVector = transferPair.getTo()) {
+      VectorAppender innerAppender = new VectorAppender(targetDataVector);
+      slicedDeltaDataVector.accept(innerAppender, null);
+    }
+  }
+
   @Override
   public ValueVector visit(FixedSizeListVector deltaVector, Void value) {
     Preconditions.checkArgument(
diff --git a/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java b/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
index df5521a1ad..9a8143f51b 100644
--- a/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
+++ b/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
@@ -26,10 +26,13 @@
 import java.util.List;
 import java.util.stream.IntStream;
 import java.util.stream.Stream;
+import org.apache.arrow.memory.ArrowBuf;
 import org.apache.arrow.memory.BufferAllocator;
 import org.apache.arrow.memory.RootAllocator;
 import org.apache.arrow.memory.util.CommonUtil;
+import org.apache.arrow.vector.BaseLargeVariableWidthVector;
 import org.apache.arrow.vector.BaseValueVector;
+import org.apache.arrow.vector.BaseVariableWidthVector;
 import org.apache.arrow.vector.BaseVariableWidthViewVector;
 import org.apache.arrow.vector.BigIntVector;
 import org.apache.arrow.vector.BitVector;
@@ -53,6 +56,7 @@
 import org.apache.arrow.vector.holders.NullableBigIntHolder;
 import org.apache.arrow.vector.holders.NullableFloat4Holder;
 import org.apache.arrow.vector.holders.NullableIntHolder;
+import org.apache.arrow.vector.ipc.message.ArrowFieldNode;
 import org.apache.arrow.vector.testing.ValueVectorDataPopulator;
 import org.apache.arrow.vector.types.Types;
 import org.apache.arrow.vector.types.pojo.ArrowType;
@@ -178,6 +182,82 @@ public void testAppendVariableWidthVector() {
     }
   }
 
+  @Test
+  public void testAppendVariableWidthVectorWithNonZeroStartOffset() {
+    try (VarCharVector target = new VarCharVector("", allocator);
+        VarCharVector delta = new VarCharVector("", allocator)) {
+
+      target.allocateNew(64, 4);
+      ValueVectorDataPopulator.setVector(target, "a0", "a1");
+
+      // Build a delta vector whose offset buffer does not start at zero, as produced e.g. by
+      // importing a sliced array through the C data interface. The values are "BBBB" and
+      // "CCCC"; the data buffer additionally holds 4 bytes of unreferenced prefix ("AAAA").
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(12);
+          ArrowBuf data = allocator.buffer(12)) {
+        validity.setByte(0, 0b11);
+        offsets.setInt(0, 4);
+        offsets.setInt(4, 8);
+        offsets.setInt(8, 12);
+        data.setBytes(0, "AAAABBBBCCCC".getBytes(StandardCharsets.UTF_8));
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets, data));
+      }
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      // the unreferenced prefix must not be appended
+      assertEquals(
+          4 + 8,
+          target
+              .getOffsetBuffer()
+              .getInt((long) target.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH));
+
+      try (VarCharVector expected = new VarCharVector("expected", allocator)) {
+        expected.allocateNew();
+        ValueVectorDataPopulator.setVector(expected, "a0", "a1", "BBBB", "CCCC");
+        assertVectorsEqual(expected, target);
+      }
+    }
+  }
+
+  @Test
+  public void testAppendLargeVariableWidthVectorWithNonZeroStartOffset() {
+    try (LargeVarCharVector target = new LargeVarCharVector("", allocator);
+        LargeVarCharVector delta = new LargeVarCharVector("", allocator)) {
+
+      target.allocateNew(64, 4);
+      ValueVectorDataPopulator.setVector(target, "a0", "a1");
+
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(24);
+          ArrowBuf data = allocator.buffer(12)) {
+        validity.setByte(0, 0b11);
+        offsets.setLong(0, 4);
+        offsets.setLong(8, 8);
+        offsets.setLong(16, 12);
+        data.setBytes(0, "AAAABBBBCCCC".getBytes(StandardCharsets.UTF_8));
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets, data));
+      }
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(
+          4 + 8,
+          target
+              .getOffsetBuffer()
+              .getLong((long) target.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH));
+
+      try (LargeVarCharVector expected = new LargeVarCharVector("expected", allocator)) {
+        expected.allocateNew();
+        ValueVectorDataPopulator.setVector(expected, "a0", "a1", "BBBB", "CCCC");
+        assertVectorsEqual(expected, target);
+      }
+    }
+  }
+
   @Test
   public void testAppendVariableWidthViewVector() {
     final int length1 = 10;
@@ -431,6 +511,115 @@ public void testAppendListVector() {
     }
   }
 
+  @Test
+  public void testAppendListVectorWithNonZeroStartOffset() {
+    try (ListVector target = ListVector.empty("target", allocator);
+        ListVector delta = ListVector.empty("delta", allocator)) {
+
+      target.allocateNew();
+      ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), Arrays.asList(2, 3));
+
+      // Build a delta vector whose offset buffer does not start at zero, as produced e.g. by
+      // importing a sliced array through the C data interface: lists [10, 11] and [12, 13],
+      // with one unreferenced prefix element (9) in the data vector.
+      delta.addOrGetVector(FieldType.nullable(Types.MinorType.INT.getType()));
+      IntVector deltaDataVector = (IntVector) delta.getDataVector();
+      deltaDataVector.allocateNew(5);
+      for (int i = 0; i < 5; i++) {
+        deltaDataVector.set(i, 9 + i);
+      }
+      deltaDataVector.setValueCount(5);
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(12)) {
+        validity.setByte(0, 0b11);
+        offsets.setInt(0, 1);
+        offsets.setInt(4, 3);
+        offsets.setInt(8, 5);
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets));
+      }
+      assertEquals(Arrays.asList(10, 11), delta.getObject(0));
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(4, target.getValueCount());
+      // the unreferenced prefix element must not be appended
+      assertEquals(
+          4 + 4,
+          target.getOffsetBuffer().getInt((long) target.getValueCount() * ListVector.OFFSET_WIDTH));
+      assertEquals(Arrays.asList(0, 1), target.getObject(0));
+      assertEquals(Arrays.asList(2, 3), target.getObject(1));
+      assertEquals(Arrays.asList(10, 11), target.getObject(2));
+      assertEquals(Arrays.asList(12, 13), target.getObject(3));
+    }
+  }
+
+  @Test
+  public void testAppendLargeListVector() {
+    try (LargeListVector target = LargeListVector.empty("target", allocator);
+        LargeListVector delta = LargeListVector.empty("delta", allocator)) {
+
+      target.allocateNew();
+      ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), null, Arrays.asList(4, 5));
+
+      delta.allocateNew();
+      ValueVectorDataPopulator.setVector(delta, Arrays.asList(10, 11, 12), Arrays.asList(13, 14));
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(5, target.getValueCount());
+      assertEquals(Arrays.asList(0, 1), target.getObject(0));
+      assertTrue(target.isNull(1));
+      assertEquals(Arrays.asList(4, 5), target.getObject(2));
+      assertEquals(Arrays.asList(10, 11, 12), target.getObject(3));
+      assertEquals(Arrays.asList(13, 14), target.getObject(4));
+    }
+  }
+
+  @Test
+  public void testAppendLargeListVectorWithNonZeroStartOffset() {
+    try (LargeListVector target = LargeListVector.empty("target", allocator);
+        LargeListVector delta = LargeListVector.empty("delta", allocator)) {
+
+      target.allocateNew();
+      ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), Arrays.asList(2, 3));
+
+      // same as testAppendListVectorWithNonZeroStartOffset, with 8-byte offsets
+      delta.addOrGetVector(FieldType.nullable(Types.MinorType.INT.getType()));
+      IntVector deltaDataVector = (IntVector) delta.getDataVector();
+      deltaDataVector.allocateNew(5);
+      for (int i = 0; i < 5; i++) {
+        deltaDataVector.set(i, 9 + i);
+      }
+      deltaDataVector.setValueCount(5);
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(24)) {
+        validity.setByte(0, 0b11);
+        offsets.setLong(0, 1);
+        offsets.setLong(8, 3);
+        offsets.setLong(16, 5);
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets));
+      }
+      assertEquals(Arrays.asList(10, 11), delta.getObject(0));
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(4, target.getValueCount());
+      // the unreferenced prefix element must not be appended
+      assertEquals(
+          4 + 4,
+          target
+              .getOffsetBuffer()
+              .getLong((long) target.getValueCount() * LargeListVector.OFFSET_WIDTH));
+      assertEquals(Arrays.asList(0, 1), target.getObject(0));
+      assertEquals(Arrays.asList(2, 3), target.getObject(1));
+      assertEquals(Arrays.asList(10, 11), target.getObject(2));
+      assertEquals(Arrays.asList(12, 13), target.getObject(3));
+    }
+  }
+
   @Test
   public void testAppendEmptyListVector() {
     try (ListVector target = ListVector.empty("target", allocator);

From 9e863319b1e3bedda45dbb12d5989f6b1330f664 Mon Sep 17 00:00:00 2001
From: Abdul Rawoof Khan <abdulr@bugqore.com>
Date: Mon, 6 Jul 2026 06:39:33 +0530
Subject: [PATCH 62/76] GH-1206: validate decompressed length in
 Lz4CompressionCodec (#1207)

## What's Changed

`Lz4CompressionCodec.doDecompress` sizes the output buffer to the bytes
it actually decompressed, but sets `writerIndex` to the length taken
from the untrusted 8-byte prefix. A buffer whose prefix claims more than
the real output leaves the returned `ArrowBuf` with a `writerIndex` past
its capacity, and consumers then read off-heap memory beyond the
allocation. This adds the actual-vs-claimed length check the ZSTD codec
already does, so a mismatch throws instead of producing an over-long
buffer.

Closes #1206.
---
 .../compression/Lz4CompressionCodec.java      |  7 ++++++
 .../compression/TestCompressionCodec.java     | 22 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java b/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
index 91cefc2a9e..f268e815fe 100644
--- a/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
+++ b/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
@@ -80,6 +80,13 @@ protected ArrowBuf doDecompress(BufferAllocator allocator, ArrowBuf compressedBu
     }
 
     byte[] outBytes = out.toByteArray();
+    if (outBytes.length != decompressedLength) {
+      throw new RuntimeException(
+          "Expected != actual decompressed length: "
+              + decompressedLength
+              + " != "
+              + outBytes.length);
+    }
     ArrowBuf decompressedBuffer = allocator.buffer(outBytes.length);
     decompressedBuffer.setBytes(/* index= */ 0, outBytes);
     decompressedBuffer.writerIndex(decompressedLength);
diff --git a/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java b/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
index b8fb4e28b9..d2d2921649 100644
--- a/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
+++ b/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
@@ -20,6 +20,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.ByteArrayOutputStream;
@@ -59,6 +60,7 @@
 import org.apache.arrow.vector.util.ByteArrayReadableSeekableByteChannel;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
@@ -231,6 +233,26 @@ void testEmptyBuffer(int vectorLength, CompressionCodec codec) throws Exception
     AutoCloseables.close(decompressedBuffers);
   }
 
+  @Test
+  void testLz4DecompressRejectsWrongLength() {
+    byte[] data = new byte[512]; // all zeros, highly compressible
+    ArrowBuf orig = allocator.buffer(data.length);
+    orig.setBytes(0, data);
+    orig.writerIndex(data.length);
+
+    CompressionCodec codec = new Lz4CompressionCodec();
+    ArrowBuf compressed = codec.compress(allocator, orig);
+
+    // tamper with the 8-byte uncompressed-length prefix so it no longer matches
+    // the real decompressed size
+    compressed.setLong(0, 1_000_000L);
+
+    RuntimeException e =
+        assertThrows(RuntimeException.class, () -> codec.decompress(allocator, compressed));
+    assertTrue(e.getMessage().contains("decompressed length"));
+    compressed.close();
+  }
+
   private static Stream<CompressionUtil.CodecType> codecTypes() {
     return Arrays.stream(CompressionUtil.CodecType.values());
   }

From c7e8e75c9978c60234dbcbd31311ac3ee2975fa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Pupier?= <apupier@ibm.com>
Date: Mon, 6 Jul 2026 08:50:26 +0200
Subject: [PATCH 63/76] MINOR: Restrict trigger push branch for GitHub Workflow
 (#1204)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Feature branches rarely need their own CI runs: the code is already
tested when a pull request is opened against a release branch. If the
push trigger has no branch restriction and pull_request is also
configured, every push to a branch with an open PR runs the workflow
twice: once for the push and once for the PR synchronisation.

Always give the push trigger an explicit list of branches: this stops
branches created from a release branch from inheriting its workflow
runs.

see
https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=430408443#GitHubActionsRecommendedPractices-Restrictthepushtriggertospecificbranches

## What's Changed

Please fill in a description of the changes here.

**This contains breaking changes.** <!-- Remove this line if there are
no breaking changes. -->

Closes #NNN.

Note that I needed to recreate a PR as the previous one was closed
https://github.com/apache/arrow-java/pull/1202#issuecomment-4864548916

Signed-off-by: Aurélien Pupier <apupier@ibm.com>
---
 .github/workflows/dev.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 25b08700fd..7c590c749a 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -19,7 +19,9 @@ name: Dev
 
 on:
   pull_request: {}
-  push: {}
+  push:
+    branches-ignore:
+      - dependabot/**
 
 concurrency:
   group: ${{ github.repository }}-${{ github.ref }}-${{ github.workflow }}

From 9e100a3b7f681a64f11eb4405e9e43431caf3647 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:21:40 +0200
Subject: [PATCH 64/76] MINOR: Bump com.squareup.okhttp3:mockwebserver3 from
 5.3.2 to 5.4.0 (#1215)

Bumps
[com.squareup.okhttp3:mockwebserver3](https://github.com/square/okhttp)
from 5.3.2 to 5.4.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:mockwebserver3's
changelog</a>.</em></p>
<blockquote>
<h2>Version 5.4.0</h2>
<p><em>2026-06-08</em></p>
<ul>
<li>New: Add superpowers to interceptors. Interceptors can now override
anything settable on
<code>OkHttpClient.Builder</code>, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom <code>Call.Factory</code> wrappers.</li>
<li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li>
<li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
<code>okhttp-coroutines</code> artifact.</li>
<li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li>
<li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a>
Prepare for release 5.4.0.</li>
<li><a
href="https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a>
Update eclipse.osgi to v3.24.200 (<a
href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a>
Update bnd to v7.3.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a>
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a>
Update dependency macos to v26 (<a
href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a>
Update shadow.plugin to v9.4.2 (<a
href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a>
Update spotless.plugin to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a>
Update plugin com.diffplug.spotless to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a>
Update spotless.plugin to v8.5.1 (<a
href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a>
Apply gradle lint correctly (<a
href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.squareup.okhttp3:mockwebserver3&package-manager=maven&previous-version=5.3.2&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 9a8406cf31..e25d8438af 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -123,7 +123,7 @@ under the License.
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>mockwebserver3</artifactId>
-      <version>5.3.2</version>
+      <version>5.4.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From e087824935d283d3636d8edb908a79df2de217c4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:25:41 +0200
Subject: [PATCH 65/76] MINOR: Bump com.diffplug.spotless:spotless-maven-plugin
 from 3.6.0 to 3.8.0 (#1214)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 3.6.0 to 3.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/diffplug/spotless/releases">com.diffplug.spotless:spotless-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>Maven Plugin v3.8.0</h2>
<h3>Added</h3>
<ul>
<li>Add support for custom string format for license header copyright
year via <code>yearStringFormat()</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2965">#2965</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>&lt;expandWildcardImports&gt;</code> no longer triggers a full
transitive dependency resolution on every build. Dependency resolution
is now deferred until the step actually runs, so projects that do not
use <code>&lt;expandWildcardImports&gt;</code> (or that use version
ranges) are no longer penalized. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2983">#2983</a>)</li>
</ul>
<h2>Maven Plugin v3.7.0</h2>
<h3>Fixed</h3>
<ul>
<li>Parse standard git year output in LicenseHeaderStep. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2940">#2940</a>)</li>
<li><code>&lt;toggleOffOn&gt;</code> no longer disables lint-only steps
such as <code>&lt;forbidWildcardImports&gt;</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2962">#2962</a>)</li>
<li>Fix <code>StringIndexOutOfBoundsException</code> in scenarios where
copyright year is surrounded by whitespace. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2973">#2973</a>)</li>
</ul>
<h3>Added</h3>
<ul>
<li>Add support for AsciiDoc formatting via <code>adocfmt</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2960">#2960</a>)</li>
<li><code>&lt;flexmark&gt;</code> step now supports arbitrary formatter
options via <code>&lt;formatterOptions&gt;</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2968">#2968</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/diffplug/spotless/blob/main/CHANGES.md">com.diffplug.spotless:spotless-maven-plugin's
changelog</a>.</em></p>
<blockquote>
<h1>spotless-lib and spotless-lib-extra releases</h1>
<p>If you are a Spotless user (as opposed to developer), then you are
probably looking for:</p>
<ul>
<li><a
href="https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md">https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md</a></li>
<li><a
href="https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md">https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md</a></li>
</ul>
<p>This document is intended for Spotless developers.</p>
<p>We adhere to the <a
href="https://keepachangelog.com/en/1.0.0/">keepachangelog</a> format
(starting after version <code>1.27.0</code>).</p>
<h2>[Unreleased]</h2>
<h2>[4.8.0] - 2026-06-29</h2>
<h3>Added</h3>
<ul>
<li>Add support for custom string format for license header copyright
year via <code>yearStringFormat()</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2965">#2965</a>)</li>
</ul>
<h2>[4.7.0] - 2026-06-16</h2>
<h3>Added</h3>
<ul>
<li>Add support for AsciiDoc formatting via <code>adocfmt</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2960">#2960</a>)</li>
<li><code>flexmark</code> step now supports arbitrary formatter options
via a <code>formatterOptions</code> map. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2968">#2968</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>FenceStep.preserveWithin</code> now forwards lints from nested
steps while still suppressing lints inside preserved blocks. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2962">#2962</a>)</li>
<li>Support <code>ktfmt</code> 0.63 and use its new builder API for
formatting options to better avoid future breaking changes.</li>
<li>Parse standard git year output in LicenseHeaderStep. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2940">#2940</a>)</li>
<li>Fix <code>StringIndexOutOfBoundsException</code> in scenarios where
copyright year is surrounded by whitespace. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2973">#2973</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Bump default <code>greclipse</code> version to latest
<code>4.35</code> -&gt; <code>4.39</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2924">#2924</a>)</li>
</ul>
<h2>[4.6.2] - 2026-05-27</h2>
<h3>Fixed</h3>
<ul>
<li><code>P2Provisioner</code> now passes cache directory overrides
directly to Solstice. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2944">#2944</a>)</li>
<li><code>forbidWildcardImports</code> and
<code>forbidModuleImports</code> now detect imports that have leading
whitespace (indentation/tabs). (<a
href="https://redirect.github.com/diffplug/spotless/pull/2939">#2939</a>)</li>
<li><code>versionCatalog</code> step no longer splits long inline tables
across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line
inline tables. The <code>maxLineLength</code> option has been removed.
(<a
href="https://redirect.github.com/diffplug/spotless/issues/2948">#2948</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li><code>EclipseJdtFormtterStep</code> now can conditionally set
compiler source/compliance options. Allows for better parsing of AST
Node for newer language features and more correct sorting; e.g. records
or seal classes. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2942">#2942</a>)</li>
<li><code>Formatter</code> no longer recomputes line-ending
normalization (<code>LineEnding.toUnix</code>) a second time for every
formatter step that changes content, removing redundant O(n) work from
the core formatting loop. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2934">#2934</a>)</li>
<li>expandWildcardImports support pom type dependency. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2839">#2839</a>)</li>
</ul>
<h2>[4.6.1] - 2026-05-15</h2>
<h3>Fixed</h3>
<ul>
<li><code>LicenseHeaderStep</code> in <code>SET_FROM_GIT</code> year
mode no longer invokes <code>git log</code> through <code>bash -c</code>
/ <code>cmd /c</code>, eliminating a shell-injection vector when
processing repositories that contain files whose names include shell
metacharacters.</li>
</ul>
<h2>[4.6.0] - 2026-05-14</h2>
<h3>Added</h3>
<ul>
<li><code>scalafmt()</code> now reads the version from the
<code>version</code> field in the scalafmt config file when no version
is explicitly set in the plugin config, falling back to the built-in
default only if neither is available. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2922">#2922</a>)</li>
<li>Add <code>versionCatalog</code> step for formatting and sorting
Gradle version catalog (<code>.toml</code>) files. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2916">#2916</a>)</li>
<li>Add <code>javaparserVersion</code> option to the Cleanthat step,
allowing callers to override the JavaParser version pulled in
transitively by Cleanthat. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2903">#2903</a>)</li>
</ul>
<h3>Fixed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/diffplug/spotless/commit/03d43ba2cdc81050e07b62646c08b22e39505368"><code>03d43ba</code></a>
Published maven/3.8.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/8b80c1388017f9b390fd9681007ba58a8c5d77f7"><code>8b80c13</code></a>
Published gradle/8.8.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/8ee6cf904ae77a4baec287132c69a63d4b5f4052"><code>8ee6cf9</code></a>
Published lib/4.8.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/6c02c0bf3fa0914206b28b2e9abec5e2061273e4"><code>6c02c0b</code></a>
Add missing changelog entry.</li>
<li><a
href="https://github.com/diffplug/spotless/commit/264f4cc904ad85149a90822c0835c17a615cee8e"><code>264f4cc</code></a>
Add regression test for forbidWildcardImports inside toggleOffOn (<a
href="https://redirect.github.com/diffplug/spotless/issues/2982">#2982</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/6abb06449354899642d716dfb3daf67a888bac9b"><code>6abb064</code></a>
fix <a
href="https://redirect.github.com/diffplug/spotless/issues/2983">#2983</a>,
expandWildcardImports triggers a full transitive reso… (<a
href="https://redirect.github.com/diffplug/spotless/issues/2984">#2984</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/f4536d41caebdda8201cdb126832ea96a75e5afe"><code>f4536d4</code></a>
Update plugin spotbugs to v6.5.8 (<a
href="https://redirect.github.com/diffplug/spotless/issues/2987">#2987</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/873454acbc24dd66a0d334f29b30d5dcb645cd0a"><code>873454a</code></a>
Update plugin spotbugs to v6.5.8</li>
<li><a
href="https://github.com/diffplug/spotless/commit/000b8a8f9f0398f60aeafee4d2fbd90a6a61b7f1"><code>000b8a8</code></a>
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (<a
href="https://redirect.github.com/diffplug/spotless/issues/2985">#2985</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/84ebcab6a588c0ae7ddb8d883f5f60947e488e0a"><code>84ebcab</code></a>
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1</li>
<li>Additional commits viewable in <a
href="https://github.com/diffplug/spotless/compare/maven/3.6.0...maven/3.8.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.diffplug.spotless:spotless-maven-plugin&package-manager=maven&previous-version=3.6.0&new-version=3.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 bom/pom.xml | 2 +-
 pom.xml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 3201761e81..2d1085b160 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -208,7 +208,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>3.6.0</version>
+          <version>3.8.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
diff --git a/pom.xml b/pom.xml
index 231720eb44..017e3acb81 100644
--- a/pom.xml
+++ b/pom.xml
@@ -492,7 +492,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>3.6.0</version>
+          <version>3.8.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>

From 1801a8a0937fb4aaac3654c66ec9109a6892666c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:28:19 +0200
Subject: [PATCH 66/76] MINOR: Bump
 com.gradle:common-custom-user-data-maven-extension from 2.2.0 to 2.3.0
 (#1213)

Bumps
[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)
from 2.2.0 to 2.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/common-custom-user-data-maven-extension/releases">com.gradle:common-custom-user-data-maven-extension's
releases</a>.</em></p>
<blockquote>
<h2>2.3.0</h2>
<ul>
<li>[NEW] Capture Cursor as an AI agent via the
<code>CURSOR_AGENT</code> environment variable</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/61a5a45a57981e2dd66b67b9fbc4fde626a02e02"><code>61a5a45</code></a>
[maven-release-plugin] prepare release v2.3.0</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/398a231a48153a893b36e282ab72a8fa8c979161"><code>398a231</code></a>
[Renovate Bot] Update actions/setup-java digest to 1bcf9fb (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/389">#389</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/f66a5c678feaf0292a70b96466abc5d437a3993a"><code>f66a5c6</code></a>
Merge pull request <a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/391">#391</a>
from gradle/erichaagdev/capture-cursor-ai-agent</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/8311f5845f801278c52094b38ecb2e3e97052420"><code>8311f58</code></a>
Capture Cursor as an AI agent</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/0236fc861cfb0391b8bb6b5abfc4c7c5ca834cc0"><code>0236fc8</code></a>
[Renovate Bot] Update dependency
org.eclipse.sisu:org.eclipse.sisu.inject to ...</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/0d8c2c5201316f4747ff8eaa038d47ac465a54d9"><code>0d8c2c5</code></a>
[Renovate Bot] Update GitHub Actions to v7 (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/386">#386</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/21ef159386fce25b750914e21c879496f7c01e7a"><code>21ef159</code></a>
[Renovate Bot] Update Maven dependencies (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/387">#387</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/d9240f0c0626d1bb0b0ef5341186fb342e48f7db"><code>d9240f0</code></a>
[Renovate Bot] Update Maven dependencies to v0.11.0 (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/384">#384</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/83935cce4e8aaab79a246cb1e27a14cc974ad64f"><code>83935cc</code></a>
Auto-merge GitHub Actions digest re-pins (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/385">#385</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/9d03ae646b229aaaf652be3e52eccdc579ef8a06"><code>9d03ae6</code></a>
[Renovate Bot] Update GitHub Actions to ad2b381 (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/383">#383</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/common-custom-user-data-maven-extension/compare/v2.2.0...v2.3.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:common-custom-user-data-maven-extension&package-manager=maven&previous-version=2.2.0&new-version=2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .mvn/extensions.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index 38b3c807b7..eb06ecc9fb 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -28,6 +28,6 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>common-custom-user-data-maven-extension</artifactId>
-        <version>2.2.0</version>
+        <version>2.3.0</version>
     </extension>
 </extensions>

From afd688e024753c75854e707748fe5ad4411d3361 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:29:40 +0200
Subject: [PATCH 67/76] MINOR: Bump com.gradle:develocity-maven-extension from
 2.4.1 to 2.5.0 (#1212)

Bumps com.gradle:develocity-maven-extension from 2.4.1 to 2.5.0.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:develocity-maven-extension&package-manager=maven&previous-version=2.4.1&new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .mvn/extensions.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index eb06ecc9fb..74482cb2c4 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -23,7 +23,7 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>develocity-maven-extension</artifactId>
-        <version>2.4.1</version>
+        <version>2.5.0</version>
     </extension>
     <extension>
         <groupId>com.gradle</groupId>

From 59010e63bb58c702ccdbcf6f7e0fb047bf8c8f73 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:31:03 +0200
Subject: [PATCH 68/76] MINOR: Bump checker.framework.version from 4.2.0 to
 4.2.1 (#1211)

Bumps `checker.framework.version` from 4.2.0 to 4.2.1.
Updates `org.checkerframework:checker-qual` from 4.2.0 to 4.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker-qual's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.2.1</h2>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker-qual's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/ef8cecd00663136e5bb4d6d3d32f936d500f519c"><code>ef8cecd</code></a>
new release 4.2.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/5d046116bece9b5ebb359fab260c2d17988a5e41"><code>5d04611</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/0907ddc90cd25f32e5bf8922d8277d0b41de7fc2"><code>0907ddc</code></a>
Use <code>@MonotonicNonNull</code></li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6a7d71c8cbba0c3c14547d4c06ddb500d15c71d2"><code>6a7d71c</code></a>
Gradle formatting</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/c10d86a0c787c2e5ca95a2c5bb9f4c598b23504e"><code>c10d86a</code></a>
Update plugin com-gradleup-shadow to v9.4.3 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7778">#7778</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/ec79d1f81a434153c13e0fb83692119304cf2908"><code>ec79d1f</code></a>
Update Gradle to v9.6.1 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7779">#7779</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/f95a2e030e54bae2e26a5e7fa47177acceb4ef6b"><code>f95a2e0</code></a>
More examples for <code>-AresourceLeakIgnoredExceptions</code> (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7774">#7774</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/79948a2df22a82425a3a17b70b6d784c812d7d5d"><code>79948a2</code></a>
Update Gradle to v9.6.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7775">#7775</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e013552e6274b87c9f5dd1c768b4dd12a828707f"><code>e013552</code></a>
Update actions/checkout action to v7 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7776">#7776</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4ba90c265ca8ee0ad4da7ce67af275ee6c7c40e1"><code>4ba90c2</code></a>
Update plugin com-diffplug-spotless to v8.7.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7773">#7773</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.2.0...checker-framework-4.2.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.checkerframework:checker` from 4.2.0 to 4.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.2.1</h2>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/ef8cecd00663136e5bb4d6d3d32f936d500f519c"><code>ef8cecd</code></a>
new release 4.2.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/5d046116bece9b5ebb359fab260c2d17988a5e41"><code>5d04611</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/0907ddc90cd25f32e5bf8922d8277d0b41de7fc2"><code>0907ddc</code></a>
Use <code>@MonotonicNonNull</code></li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6a7d71c8cbba0c3c14547d4c06ddb500d15c71d2"><code>6a7d71c</code></a>
Gradle formatting</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/c10d86a0c787c2e5ca95a2c5bb9f4c598b23504e"><code>c10d86a</code></a>
Update plugin com-gradleup-shadow to v9.4.3 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7778">#7778</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/ec79d1f81a434153c13e0fb83692119304cf2908"><code>ec79d1f</code></a>
Update Gradle to v9.6.1 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7779">#7779</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/f95a2e030e54bae2e26a5e7fa47177acceb4ef6b"><code>f95a2e0</code></a>
More examples for <code>-AresourceLeakIgnoredExceptions</code> (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7774">#7774</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/79948a2df22a82425a3a17b70b6d784c812d7d5d"><code>79948a2</code></a>
Update Gradle to v9.6.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7775">#7775</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e013552e6274b87c9f5dd1c768b4dd12a828707f"><code>e013552</code></a>
Update actions/checkout action to v7 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7776">#7776</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4ba90c265ca8ee0ad4da7ce67af275ee6c7c40e1"><code>4ba90c2</code></a>
Update plugin com-diffplug-spotless to v8.7.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7773">#7773</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.2.0...checker-framework-4.2.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 017e3acb81..d9f9d59c43 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
     <checkstyle.version>10.23.0</checkstyle.version>
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
-    <checker.framework.version>4.2.0</checker.framework.version>
+    <checker.framework.version>4.2.1</checker.framework.version>
     <logback.version>1.5.34</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>

From f2594c99cc98923ad5949713d4519c5d4f24f4f6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:32:02 +0200
Subject: [PATCH 69/76] MINOR: [CI] Bump docker/login-action from 4.2.0 to
 4.4.0 (#1210)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [docker/login-action](https://github.com/docker/login-action) from
4.2.0 to 4.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.0</h2>
<ul>
<li>Skip empty <code>registry-auth</code> secret mask by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1077.0 <a
href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p>
<h2>v4.3.0</h2>
<ul>
<li>Preserve names in esbuild bundle by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1076.0 <a
href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li>
<li>Bump <code>@​sigstore/core</code> from 3.1.0 to 3.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li>
<li>Bump <code>@​sigstore/verify</code> from 3.1.0 to 3.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li>
<li>Bump js-yaml from 4.1.1 to 5.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li>
<li>Bump sigstore from 4.1.0 to 4.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li>
<li>Bump tmp from 0.2.5 to 0.2.7 in <a
href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li>
<li>Bump undici from 6.24.1 to 6.27.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li>
<li>Bump vite from 7.3.3 to 7.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a>
from crazy-max/fix-registry-auth-empty-mask</li>
<li><a
href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a>
skip empty registry-auth secret mask</li>
<li><a
href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/b249b43765525dd7951068267a34cf63f22ab4f0"><code>b249b43</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1032">#1032</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/1b67977736863551a88ff218642a2d7628b10520"><code>1b67977</code></a>
build(deps): bump docker/bake-action from 7.2.0 to 7.3.0</li>
<li><a
href="https://github.com/docker/login-action/commit/9d49d6a3234c78daa10c3c12183ef7b6caa8e69e"><code>9d49d6a</code></a>
build(deps): bump docker/bake-action/subaction/matrix</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.2.0&new-version=4.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/rc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index fdfcd1cce3..5d2fb6683a 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

From 915428751b8871406268aeb27bd2f055dcfba6bf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:00:46 +0200
Subject: [PATCH 70/76] MINOR: Bump logback.version from 1.5.34 to 1.5.37
 (#1209)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps `logback.version` from 1.5.34 to 1.5.37.
Updates `ch.qos.logback:logback-classic` from 1.5.34 to 1.5.37
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.37</h2>
<p><strong>2026-06-26 Release of logback version 1.5.37</strong></p>
<ol>
<li>• Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java expressions
using the Janino library, support for such expressions has been removed.
Users are offered the an <a
href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html">online
migration service</a> or the <code>&lt;condition&gt;</code> element
introduced in version 1.5.20. See the <a
href="https://logback.qos.ch/manual/configuration.html#conditional">relevant
documentation</a> for more details.</li>
</ol>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag
v_1.5.37. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.36</h2>
<p><strong>2026-06-25 Release of logback version 1.5.36</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
reject certain references that are associated with ACE attacks. This
issue was reported by &quot;yulate&quot; (<a
href="mailto:yulate531@gmail.com.com">yulate531@gmail.com.com</a>) and
registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag
v_1.5.36. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.35</h2>
<p><strong>026-06-23 Release of logback version 1.5.35</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (<a
href="mailto:icysun@qq.com">icysun@qq.com</a>) and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
<code>ContextInitializer</code> now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.</p>
<p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
<code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code>
will need an alternative approach for console charset detection.</p>
<p>• The logback-examples module is now included in artifacts published
to Maven Central.</p>
<p>• <code>JoranConfigurator.makeAnotherInstance()</code> and
<code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code>
are now protected, allowing derived configurators to override these
methods.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048"><code>c1df7f5</code></a>
prepare release 1.5.37</li>
<li><a
href="https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5"><code>a189967</code></a>
remove conditional based on janino</li>
<li><a
href="https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446"><code>aaa9052</code></a>
start work on 1.5.37-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888"><code>9b94c37</code></a>
prepare release 1.5.36</li>
<li><a
href="https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb"><code>e6a8280</code></a>
prevent attacks using disallowed references</li>
<li><a
href="https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f"><code>24c4b63</code></a>
start work on 1.5.36-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7"><code>08bd159</code></a>
preapre release 1.5.35</li>
<li><a
href="https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0"><code>37d256b</code></a>
indentation changes only</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3"><code>d3d7307</code></a>
minor comment</li>
<li><a
href="https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0"><code>fa0411a</code></a>
radomize file location</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37">compare
view</a></li>
</ul>
</details>
<br />

Updates `ch.qos.logback:logback-core` from 1.5.34 to 1.5.37
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-core's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.37</h2>
<p><strong>2026-06-26 Release of logback version 1.5.37</strong></p>
<ol>
<li>• Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java expressions
using the Janino library, support for such expressions has been removed.
Users are offered the an <a
href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html">online
migration service</a> or the <code>&lt;condition&gt;</code> element
introduced in version 1.5.20. See the <a
href="https://logback.qos.ch/manual/configuration.html#conditional">relevant
documentation</a> for more details.</li>
</ol>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag
v_1.5.37. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.36</h2>
<p><strong>2026-06-25 Release of logback version 1.5.36</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
reject certain references that are associated with ACE attacks. This
issue was reported by &quot;yulate&quot; (<a
href="mailto:yulate531@gmail.com.com">yulate531@gmail.com.com</a>) and
registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag
v_1.5.36. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.35</h2>
<p><strong>026-06-23 Release of logback version 1.5.35</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (<a
href="mailto:icysun@qq.com">icysun@qq.com</a>) and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
<code>ContextInitializer</code> now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.</p>
<p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
<code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code>
will need an alternative approach for console charset detection.</p>
<p>• The logback-examples module is now included in artifacts published
to Maven Central.</p>
<p>• <code>JoranConfigurator.makeAnotherInstance()</code> and
<code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code>
are now protected, allowing derived configurators to override these
methods.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048"><code>c1df7f5</code></a>
prepare release 1.5.37</li>
<li><a
href="https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5"><code>a189967</code></a>
remove conditional based on janino</li>
<li><a
href="https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446"><code>aaa9052</code></a>
start work on 1.5.37-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888"><code>9b94c37</code></a>
prepare release 1.5.36</li>
<li><a
href="https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb"><code>e6a8280</code></a>
prevent attacks using disallowed references</li>
<li><a
href="https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f"><code>24c4b63</code></a>
start work on 1.5.36-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7"><code>08bd159</code></a>
preapre release 1.5.35</li>
<li><a
href="https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0"><code>37d256b</code></a>
indentation changes only</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3"><code>d3d7307</code></a>
minor comment</li>
<li><a
href="https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0"><code>fa0411a</code></a>
radomize file location</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré <jbonofre@apache.org>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index d9f9d59c43..78137eb4e9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -113,7 +113,7 @@ under the License.
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
     <checker.framework.version>4.2.1</checker.framework.version>
-    <logback.version>1.5.34</logback.version>
+    <logback.version>1.5.37</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>
     <!-- List of add-opens arg line arguments for tests -->

From a9f0086090e649b83c89ea864c82ed7fcc84ab2f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 22:19:02 +0200
Subject: [PATCH 71/76] MINOR: Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2
 to 5.4.0 (#1208)

Bumps
[com.squareup.okhttp3:okhttp-jvm](https://github.com/square/okhttp) from
5.3.2 to 5.4.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:okhttp-jvm's
changelog</a>.</em></p>
<blockquote>
<h2>Version 5.4.0</h2>
<p><em>2026-06-08</em></p>
<ul>
<li>New: Add superpowers to interceptors. Interceptors can now override
anything settable on
<code>OkHttpClient.Builder</code>, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom <code>Call.Factory</code> wrappers.</li>
<li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li>
<li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
<code>okhttp-coroutines</code> artifact.</li>
<li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li>
<li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a>
Prepare for release 5.4.0.</li>
<li><a
href="https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a>
Update eclipse.osgi to v3.24.200 (<a
href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a>
Update bnd to v7.3.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a>
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a>
Update dependency macos to v26 (<a
href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a>
Update shadow.plugin to v9.4.2 (<a
href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a>
Update spotless.plugin to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a>
Update plugin com.diffplug.spotless to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a>
Update spotless.plugin to v8.5.1 (<a
href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a>
Apply gradle lint correctly (<a
href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index e25d8438af..be2ee32868 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -135,7 +135,7 @@ under the License.
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>okhttp-jvm</artifactId>
-      <version>5.3.2</version>
+      <version>5.4.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 7f1f9f588af610b842ee1c3bccf6afbd528ae4db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9lder=20Greg=C3=B3rio?= <helder.gregorio@dremio.com>
Date: Thu, 9 Jul 2026 14:42:25 +0100
Subject: [PATCH 72/76] GH-1188: Reduce test workflow waste (#1189)

## Summary

This PR reduces wasted GitHub Actions time in the `Test` workflow by
removing redundant rebuilds, improving caching, and skipping integration
work when it is not relevant.

## What changed

- Removed `clean` from `ci/scripts/test.sh` so the test phase reuses the
classes compiled earlier in the job instead of deleting and recompiling
them.
- Narrowed the Maven/Docker cache key to POM changes, so source-only
edits do not invalidate the dependency cache.
- Enabled Maven dependency caching on the macOS and Windows test jobs.
- Added `pull-requests: read` so the integration job can inspect changed
files.

Closes #1188

Note: The changes on this PR were highlighted and addressed with AI
assistance
---
 .github/workflows/test.yml | 24 +++++++++++++-----------
 ci/scripts/test.sh         |  7 ++++---
 2 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ac8080d075..41a42c05ed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -66,7 +66,7 @@ jobs:
         uses: actions/cache@v6
         with:
           path: .docker
-          key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml', '**/*.java') }}
+          key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml') }}
           restore-keys: maven-${{ matrix.jdk }}-${{ matrix.maven }}-
       - name: Execute Docker Build
         env:
@@ -94,16 +94,17 @@ jobs:
             jdk: 17
             macos: latest
     steps:
-      - name: Set up Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: ${{ matrix.jdk }}
       - name: Checkout Arrow
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: ${{ matrix.jdk }}
+          cache: 'maven'
       - name: Build
         shell: bash
         env:
@@ -125,16 +126,17 @@ jobs:
       matrix:
         jdk: [17]
     steps:
-      - name: Set up Java
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ matrix.jdk }}
-          distribution: 'temurin'
       - name: Checkout Arrow
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ matrix.jdk }}
+          distribution: 'temurin'
+          cache: 'maven'
       - name: Build
         shell: bash
         env:
diff --git a/ci/scripts/test.sh b/ci/scripts/test.sh
index cacc20034e..8061ee455d 100755
--- a/ci/scripts/test.sh
+++ b/ci/scripts/test.sh
@@ -34,10 +34,11 @@ fi
 mvn="mvn -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
 # Use `2 * ncores` threads
 mvn="${mvn} -T 2C"
+mvn="${mvn} -Denforcer.skip=true"
 
 pushd "${build_dir}"
 
-${mvn} -Darrow.test.dataRoot="${source_dir}/testing/data" clean test
+${mvn} -Darrow.test.dataRoot="${source_dir}/testing/data" test
 
 projects=()
 if [ "${ARROW_JAVA_JNI}" = "ON" ]; then
@@ -46,7 +47,7 @@ if [ "${ARROW_JAVA_JNI}" = "ON" ]; then
   projects+=(gandiva)
 fi
 if [ "${#projects[@]}" -gt 0 ]; then
-  ${mvn} clean test \
+  ${mvn} test \
     -Parrow-jni \
     -pl "$(
       IFS=,
@@ -56,7 +57,7 @@ if [ "${#projects[@]}" -gt 0 ]; then
 fi
 
 if [ "${ARROW_JAVA_CDATA}" = "ON" ]; then
-  ${mvn} clean test -Parrow-c-data -pl c -Darrow.c.jni.dist.dir="${java_jni_dist_dir}"
+  ${mvn} test -Parrow-c-data -pl c -Darrow.c.jni.dist.dir="${java_jni_dist_dir}"
 fi
 
 popd

From 21b6a05154b7713b12ace4c0ba3572ba5cc8fe66 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:19:32 +0900
Subject: [PATCH 73/76] MINOR: [CI] Bump actions/setup-python from 6 to 7
 (#1235)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/setup-python](https://github.com/actions/setup-python)
from 6 to 7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li>
<li>Pin SHA commits and update docs with latest versions by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li>
<li>Remove the pip-install input by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li>
</ul>
<h3>Bug Fix</h3>
<ul>
<li>Fix to Classify stderr warning messages as warnings instead of
errors in annotations by <a
href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li>Validate and retry manifest fetch to prevent silent failures by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Bump certifi from 2020.6.20 to 2024.7.4 in
/<strong>tests</strong>/data by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li>
<li>Remove EOL Python versions and Bumps numpy text fixture by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add RHEL support and include Linux distro in cache keys by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li>
<li>Fix pip cache error handling on Windows by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li>
<li>Upgrade actions dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li>Upgrade dependency versions and test workflow configuration by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Update advanced-usage.md by <a
href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li><a href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Dependency Upgrades</h3>
<ul>
<li>Upgrade dependencies to Node 24 compatible versions by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a>
Pin SHA commits and update docs with latest versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a>
from actions/philip-gai/bump-actions-cache-6-2-0</li>
<li><a
href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a>
Remove the pip-install input (<a
href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a>
Validate and retry manifest fetch to prevent silent failures (<a
href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a>
Annotation code fix (<a
href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a>
remove EOL Python versions and Bumps numpy text fixture (<a
href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a>
Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data
(<a
href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-python/compare/v6...v7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-python&package-manager=github_actions&previous-version=6&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml  | 2 +-
 .github/workflows/rc.yml   | 4 ++--
 .github/workflows/test.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 7c590c749a..f4dc9ad6f1 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -40,7 +40,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.x'
       - name: pre-commit (cache)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 5d2fb6683a..18a721ac02 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -195,7 +195,7 @@ jobs:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           cache: 'pip'
           python-version: 3.12
@@ -446,7 +446,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           cache: 'pip'
       - name: Download source archive
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 41a42c05ed..853b7cec09 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -198,7 +198,7 @@ jobs:
           key: integration-conda-${{ hashFiles('cpp/**') }}
           restore-keys: integration-conda-
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: 3.12
       - name: Setup Archery

From 06170242bde2f492e068235efdd2183a3cbd87d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9lder=20Greg=C3=B3rio?= <helder.gregorio@dremio.com>
Date: Sat, 25 Jul 2026 14:35:09 +0100
Subject: [PATCH 74/76] GH-1244: Move integration tests to separate workflow
 (#1245)

## What's Changed

Move the `integration` job from `test.yml` into its own
`integration.yml` workflow.

The new workflow uses top-level `paths` filters, so integration tests
run only when changes affect relevant code or build inputs.
This should also help to reduce the amount of runner time. Topic
initially triggered in the [mailing
list](https://lists.apache.org/thread/drf0o5kzg1zfmok7gc09k8qz8hh9ymvh)

Closes #1244
---
 .github/workflows/integration.yml | 127 ++++++++++++++++++++++++++++++
 .github/workflows/test.yml        |  69 ----------------
 2 files changed, 127 insertions(+), 69 deletions(-)
 create mode 100644 .github/workflows/integration.yml

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
new file mode 100644
index 0000000000..3872d03d2f
--- /dev/null
+++ b/.github/workflows/integration.yml
@@ -0,0 +1,127 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Integration
+
+on:
+  push:
+    branches:
+      - '**'
+      - '!dependabot/**'
+    tags:
+      - '**'
+    paths:
+      - '.github/workflows/integration.yml'
+      - '**/pom.xml'
+      - 'c/**'
+      - 'ci/scripts/**'
+      - 'compose.yaml'
+      - 'flight/**'
+      - 'format/**'
+      - 'testing/data/**'
+      - 'vector/**'
+  pull_request:
+    paths:
+      - '.github/workflows/integration.yml'
+      - '**/pom.xml'
+      - 'c/**'
+      - 'ci/scripts/**'
+      - 'compose.yaml'
+      - 'flight/**'
+      - 'format/**'
+      - 'testing/data/**'
+      - 'vector/**'
+
+concurrency:
+  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DOCKER_VOLUME_PREFIX: ".docker/"
+
+jobs:
+  integration:
+    name: AMD64 integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout Arrow
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          repository: apache/arrow
+          submodules: recursive
+      - name: Checkout Arrow Rust
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-rs
+          path: rust
+      - name: Checkout Arrow nanoarrow
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-nanoarrow
+          path: nanoarrow
+      - name: Checkout Arrow .NET
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-dotnet
+          path: dotnet
+      - name: Checkout Arrow Go
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-go
+          path: go
+      - name: Checkout Arrow Java
+        uses: actions/checkout@v7
+        with:
+          path: java
+      - name: Checkout Arrow JavaScript
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-js
+          path: js
+      - name: Free up disk space
+        run: |
+          ci/scripts/util_free_space.sh
+      - name: Cache Docker Volumes
+        uses: actions/cache@v6
+        with:
+          path: .docker
+          key: integration-conda-${{ hashFiles('cpp/**') }}
+          restore-keys: integration-conda-
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: 3.12
+      - name: Setup Archery
+        run: pip install -e dev/archery[docker]
+      - name: Execute Docker Build
+        run: |
+          source ci/scripts/util_enable_core_dumps.sh
+          archery docker run \
+            -e ARCHERY_DEFAULT_BRANCH=main \
+            -e ARCHERY_INTEGRATION_TARGET_IMPLEMENTATIONS=java \
+            -e ARCHERY_INTEGRATION_WITH_DOTNET=1 \
+            -e ARCHERY_INTEGRATION_WITH_GO=1 \
+            -e ARCHERY_INTEGRATION_WITH_JAVA=1 \
+            -e ARCHERY_INTEGRATION_WITH_JS=1 \
+            -e ARCHERY_INTEGRATION_WITH_NANOARROW=1 \
+            -e ARCHERY_INTEGRATION_WITH_RUST=1 \
+            conda-integration
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 853b7cec09..653b16fa32 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -147,72 +147,3 @@ jobs:
         env:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: ci/scripts/test.sh . build jni
-
-  integration:
-    name: AMD64 integration
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - name: Checkout Arrow
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          repository: apache/arrow
-          submodules: recursive
-      - name: Checkout Arrow Rust
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-rs
-          path: rust
-      - name: Checkout Arrow nanoarrow
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-nanoarrow
-          path: nanoarrow
-      - name: Checkout Arrow .NET
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-dotnet
-          path: dotnet
-      - name: Checkout Arrow Go
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-go
-          path: go
-      - name: Checkout Arrow Java
-        uses: actions/checkout@v7
-        with:
-          path: java
-      - name: Checkout Arrow JavaScript
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-js
-          path: js
-      - name: Free up disk space
-        run: |
-          ci/scripts/util_free_space.sh
-      - name: Cache Docker Volumes
-        uses: actions/cache@v6
-        with:
-          path: .docker
-          key: integration-conda-${{ hashFiles('cpp/**') }}
-          restore-keys: integration-conda-
-      - name: Setup Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: 3.12
-      - name: Setup Archery
-        run: pip install -e dev/archery[docker]
-      - name: Execute Docker Build
-        run: |
-          source ci/scripts/util_enable_core_dumps.sh
-          archery docker run \
-            -e ARCHERY_DEFAULT_BRANCH=main \
-            -e ARCHERY_INTEGRATION_TARGET_IMPLEMENTATIONS=java \
-            -e ARCHERY_INTEGRATION_WITH_DOTNET=1 \
-            -e ARCHERY_INTEGRATION_WITH_GO=1 \
-            -e ARCHERY_INTEGRATION_WITH_JAVA=1 \
-            -e ARCHERY_INTEGRATION_WITH_JS=1 \
-            -e ARCHERY_INTEGRATION_WITH_NANOARROW=1 \
-            -e ARCHERY_INTEGRATION_WITH_RUST=1 \
-            conda-integration

From 85d7ef30ee5f623cf3442dd989df09c3c5754ad2 Mon Sep 17 00:00:00 2001
From: Sandesh Kumar <sandeshkr419@gmail.com>
Date: Thu, 6 Aug 2026 17:29:51 -0700
Subject: [PATCH 75/76] GH-1239: Fix memory leak when C Data import hits
 allocator limit mid-array (#1240)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`ReferenceCountedArrowArray.unsafeAssociateAllocation` calls `retain()`
before `wrapForeignAllocation`. If `wrapForeignAllocation` throws
(allocator over its limit), the retain is never balanced, the reference
count stays elevated, and the C Data release callback never fires —
leaking the producer's native memory.

**Fix:** call `retain()` after `wrapForeignAllocation` returns. Same
behavior on the success path; on failure the existing `finally` in
`ArrayImporter.importArray` drives the count to zero and fires the
release callback.

**Test:** `ImportOutOfMemoryTest` — exports a batch from a "producer"
allocator, tries to import it into a too-small consumer, and asserts the
producer drains to zero after the OOM. Fails on the original code,
passes with the fix.

Fixes: https://github.com/apache/arrow-java/issues/1239

---------

Signed-off-by: Sandesh Kumar <kusandes@amazon.com>
Co-authored-by: Sandesh Kumar <kusandes@amazon.com>
---
 .../arrow/c/ReferenceCountedArrowArray.java   |  19 ++-
 .../apache/arrow/c/ImportOutOfMemoryTest.java | 139 ++++++++++++++++++
 2 files changed, 151 insertions(+), 7 deletions(-)
 create mode 100644 c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java

diff --git a/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java b/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
index cf50f9417b..f51fb25105 100644
--- a/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
+++ b/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
@@ -64,13 +64,18 @@ void release() {
    */
   ArrowBuf unsafeAssociateAllocation(
       BufferAllocator trackingAllocator, long capacity, long memoryAddress) {
+    // Retain only after wrapForeignAllocation succeeds. On the allocator-limit OOM path,
+    // wrapForeignAllocation throws before the ForeignAllocation is associated, so release0()
+    // is not called; retaining first would leave the count elevated with no matching release0().
+    ArrowBuf buf =
+        trackingAllocator.wrapForeignAllocation(
+            new ForeignAllocation(capacity, memoryAddress) {
+              @Override
+              protected void release0() {
+                ReferenceCountedArrowArray.this.release();
+              }
+            });
     retain();
-    return trackingAllocator.wrapForeignAllocation(
-        new ForeignAllocation(capacity, memoryAddress) {
-          @Override
-          protected void release0() {
-            ReferenceCountedArrowArray.this.release();
-          }
-        });
+    return buf;
   }
 }
diff --git a/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java b/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java
new file mode 100644
index 0000000000..7c099f2ef0
--- /dev/null
+++ b/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java
@@ -0,0 +1,139 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.arrow.c;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.arrow.memory.BufferAllocator;
+import org.apache.arrow.memory.OutOfMemoryException;
+import org.apache.arrow.memory.RootAllocator;
+import org.apache.arrow.vector.FieldVector;
+import org.apache.arrow.vector.VarCharVector;
+import org.apache.arrow.vector.VectorSchemaRoot;
+import org.apache.arrow.vector.types.pojo.Schema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Regression test: a mid-import {@link OutOfMemoryException} must not leak the imported array.
+ *
+ * <p>A "producer" allocator owns the exported batch; if the C Data release callback fires, the
+ * producer drains to zero. A too-small consumer allocator forces an OOM part-way through the
+ * import. The test asserts the producer drains, confirming the release callback fired despite the
+ * failure.
+ */
+final class ImportOutOfMemoryTest {
+  private static final int ROWS = 1024;
+  private static final int VALUE_BYTES = 256;
+  private static final int COLUMNS = 4;
+  // Far smaller than the exported batch, so the import OOMs part-way through the buffers.
+  private static final long TINY_LIMIT = 16 * 1024;
+
+  private RootAllocator root;
+
+  @BeforeEach
+  public void setUp() {
+    root = new RootAllocator(Long.MAX_VALUE);
+  }
+
+  @AfterEach
+  public void tearDown() {
+    root.close();
+  }
+
+  @Test
+  public void importOomDoesNotLeakExportedArray() {
+    // "producer" owns only the exported batch buffers; the C Data struct containers live on a
+    // separate allocator (they are consumed/closed by import, which would otherwise muddy the
+    // producer's balance). So producer draining to zero is an exact signal that the array's release
+    // callback fired.
+    try (BufferAllocator producer = root.newChildAllocator("producer", 0, Long.MAX_VALUE);
+        BufferAllocator structs = root.newChildAllocator("structs", 0, Long.MAX_VALUE)) {
+      try (ArrowArray array = ArrowArray.allocateNew(structs);
+          ArrowSchema schema = ArrowSchema.allocateNew(structs)) {
+        exportBatch(producer, array, schema);
+        assertTrue(
+            producer.getAllocatedMemory() > 0, "producer holds the exported batch before import");
+
+        // A consumer allocator far too small to hold the batch: the import throws part-way through.
+        try (BufferAllocator consumer = root.newChildAllocator("consumer", 0, TINY_LIMIT);
+            CDataDictionaryProvider provider = new CDataDictionaryProvider()) {
+          Schema importSchema = Data.importSchema(consumer, schema, provider);
+          try (VectorSchemaRoot importRoot = VectorSchemaRoot.create(importSchema, consumer)) {
+            Exception thrown =
+                assertThrows(
+                    Exception.class,
+                    () -> Data.importIntoVectorSchemaRoot(consumer, array, importRoot, provider));
+            assertTrue(
+                hasOutOfMemoryCause(thrown),
+                "mid-import failure must be an allocator OOM: " + thrown);
+          }
+        }
+
+        // The array's release callback must have fired despite the mid-import OOM, freeing the
+        // whole exported batch. On the unfixed retain-before-wrap code the batch is stranded.
+        assertEquals(
+            0L,
+            producer.getAllocatedMemory(),
+            "import OOM leaked the exported batch (producer not drained)");
+      }
+    }
+  }
+
+  /** True if {@code t} is, or is caused by, an Arrow {@link OutOfMemoryException}. */
+  private static boolean hasOutOfMemoryCause(Throwable t) {
+    for (Throwable cause = t; cause != null; cause = cause.getCause()) {
+      if (cause instanceof OutOfMemoryException) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Builds a wide multi-column VarChar batch on {@code alloc} and exports it into the C structs.
+   */
+  private void exportBatch(BufferAllocator alloc, ArrowArray array, ArrowSchema schema) {
+    byte[] value = new byte[VALUE_BYTES];
+    for (int i = 0; i < value.length; i++) {
+      value[i] = (byte) 'x';
+    }
+    List<FieldVector> vectors = new ArrayList<>(COLUMNS);
+    for (int c = 0; c < COLUMNS; c++) {
+      VarCharVector vector = new VarCharVector("col" + c, alloc);
+      vector.allocateNew((long) ROWS * VALUE_BYTES, ROWS);
+      for (int r = 0; r < ROWS; r++) {
+        vector.setSafe(r, value);
+      }
+      vector.setValueCount(ROWS);
+      vectors.add(vector);
+    }
+    try (VectorSchemaRoot source = new VectorSchemaRoot(vectors)) {
+      long total = 0;
+      for (FieldVector vector : source.getFieldVectors()) {
+        total += vector.getBufferSize();
+      }
+      assertTrue(total > TINY_LIMIT, "test setup: batch must exceed the consumer limit");
+      Data.exportVectorSchemaRoot(alloc, source, null, array, schema);
+    }
+  }
+}

From fa20039f39a7deacf5624ba8a6ee10e9d31e98ce Mon Sep 17 00:00:00 2001
From: David Li <li.davidm96@gmail.com>
Date: Fri, 14 Aug 2026 10:57:43 +0900
Subject: [PATCH 76/76] GH-1241: Bump vcpkg version to stay in sync with
 apache/arrow (#1260)

This fixes the CI for Linux.

Closes #1241.
---
 .env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.env b/.env
index 51daa0406c..ef0c5fb101 100644
--- a/.env
+++ b/.env
@@ -53,4 +53,4 @@ MAVEN=3.9.9
 # Versions for various dependencies used to build artifacts
 # Keep in sync with apache/arrow
 ARROW_REPO_ROOT=./arrow
-VCPKG="66c0373dc7fca549e5803087b9487edfe3aca0a1"    # 2026.01.16 Release
+VCPKG="9b965a116838c6cdcd36bca60d1b81b030c8ab8d"    # 2026.05.27 (not release, upstream commit)