From 5540c4d6358cd653fcc7e463e60aa3f21f3288ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:01:08 +0200
Subject: [PATCH 01/28] MINOR: Bump com.squareup.okhttp3:mockwebserver3-junit5
 from 5.3.2 to 5.4.0 (#1185)

Bumps
[com.squareup.okhttp3:mockwebserver3-junit5](https://github.com/square/okhttp)
from 5.3.2 to 5.4.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:mockwebserver3-junit5's
changelog</a>.</em></p>
<blockquote>
<h2>Version 5.4.0</h2>
<p><em>2026-06-08</em></p>
<ul>
<li>New: Add superpowers to interceptors. Interceptors can now override
anything settable on
<code>OkHttpClient.Builder</code>, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom <code>Call.Factory</code> wrappers.</li>
<li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li>
<li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
<code>okhttp-coroutines</code> artifact.</li>
<li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li>
<li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a>
Prepare for release 5.4.0.</li>
<li><a
href="https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a>
Update eclipse.osgi to v3.24.200 (<a
href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a>
Update bnd to v7.3.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a>
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a>
Update dependency macos to v26 (<a
href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a>
Update shadow.plugin to v9.4.2 (<a
href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a>
Update spotless.plugin to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a>
Update plugin com.diffplug.spotless to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a>
Update spotless.plugin to v8.5.1 (<a
href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a>
Apply gradle lint correctly (<a
href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.squareup.okhttp3:mockwebserver3-junit5&package-manager=maven&previous-version=5.3.2&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 3741ee083c..9a8406cf31 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -129,7 +129,7 @@ under the License.
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>mockwebserver3-junit5</artifactId>
-      <version>5.3.2</version>
+      <version>5.4.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 6e0b5f7905c436ef847eaba4a703564ee6faae7e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:01:26 +0200
Subject: [PATCH 02/28] MINOR: Bump org.jacoco:jacoco-maven-plugin from 0.8.14
 to 0.8.15 (#1176)

Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco)
from 0.8.14 to 0.8.15.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jacoco/jacoco/releases">org.jacoco:jacoco-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>0.8.15</h2>
<h2>New Features</h2>
<ul>
<li>JaCoCo now officially supports Java 26 (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2076">#2076</a>).</li>
<li>Experimental support for Java 27 class files (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2004">#2004</a>).</li>
<li>Compatibility methods generated by Kotlin compiler for functions
defined in interfaces are filtered out during generation of report
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1905">#1905</a>).</li>
<li>Compatibility methods generated by Kotlin compiler for exposed boxed
inline value classes (JvmExposeBoxed annotation) are filtered out during
generation of report (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1944">#1944</a>).</li>
<li>Methods generated by the Kotlin compiler for functions with
JvmStatic annotation are filtered out during generation of report
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2097">#2097</a>).</li>
<li>Improved filtering of bytecode generated by Kotlin compiler for when
expressions and statements with kotlin.String subject where first branch
condition contains string with largest hash (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2098">#2098</a>).</li>
<li>Part of bytecode that javac versions from 24 to 26 generate for
switch statements and expressions with selector expression of type
java.lang.String inside lambdas is filtered out during generation of
report (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2023">#2023</a>).</li>
<li>Improved performance of Kotlin files analysis by parsing SMAPs only
once per class (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2114">#2114</a>).</li>
<li>For better performance agent output methods tcpclient and tcpserver
use BufferedOutputStream to write execution data to socket. Maven
plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use
BufferedInputStream to read execution data from socket. Third-party
integrations should do the same to benefit from this change in agent
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2089">#2089</a>).</li>
</ul>
<h2>Fixed bugs</h2>
<ul>
<li>Fixed processing of Kotlin SMAP in synthetic classes (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1985">#1985</a>).</li>
<li>Multiple JaCoCo runtimes within one JVM writing to the same output
file should not cause data corruption when running on JDK versions from
6 to 10 affected by <a
href="https://bugs.openjdk.org/browse/JDK-8166253">JDK-8166253</a>
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2065">#2065</a>,
<a
href="https://redirect.github.com/jacoco/jacoco/issues/2074">#2074</a>).</li>
<li>For better performance agent writes to output file via
BufferedOutputStream, this fixes regression introduced in version 0.6.2
(GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2073">#2073</a>).</li>
<li>Fixed NullPointerException when JaCoCo agent is loaded by non system
class loader, for example when loaded by JBoss Modules (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/1651">#1651</a>).</li>
</ul>
<h2>Non-functional Changes</h2>
<ul>
<li>JaCoCo now depends on ASM 9.10.1 (GitHub <a
href="https://redirect.github.com/jacoco/jacoco/issues/2134">#2134</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jacoco/jacoco/commit/6c5260a192eaa535e4a519771d530781cbac9136"><code>6c5260a</code></a>
Prepare release v0.8.15</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/5c05141431a7f064a804a923fbae11271241f116"><code>5c05141</code></a>
Transfer of execution data through socket should use buffered stream (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2089">#2089</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/ab5efa9d63c06899b2aec1d4a6099fc856132a22"><code>ab5efa9</code></a>
Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2148">#2148</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/5f6ea38f20ff4583deb4ab976571c853231f97c2"><code>5f6ea38</code></a>
Use Windows 2025 image in GitHub Actions (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2130">#2130</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/35a8af2cfc168ce51f2a3ea2d55d65f31e61c513"><code>35a8af2</code></a>
Use Renovate instead of Dependabot for updates of ASM (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2137">#2137</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/85b8ddf530821f75b3b26f5f96d03252286b3ad6"><code>85b8ddf</code></a>
Upgrade ASM to 9.10.1 (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2134">#2134</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/2988647ac37c3ad35a77b51d01b10a916b85627b"><code>2988647</code></a>
AgentModule should use ClassLoader of agent instead of SystemClassLoader
(<a
href="https://redirect.github.com/jacoco/jacoco/issues/1651">#1651</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/75a4e31fed32f180fbe4593ad91ec5c176c0535b"><code>75a4e31</code></a>
Add filter for Kotlin <code>@JvmExposeBoxed</code> (<a
href="https://redirect.github.com/jacoco/jacoco/issues/1944">#1944</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/691fa1d6a0dffa91f45daf0714f28bfdaa367fc0"><code>691fa1d</code></a>
Use Renovate instead of Dependabot for updates of GitHub Actions (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2132">#2132</a>)</li>
<li><a
href="https://github.com/jacoco/jacoco/commit/3e18f17207bca0203b726ace460aa6be8d0f3dd4"><code>3e18f17</code></a>
Require at least JDK 21 for build (<a
href="https://redirect.github.com/jacoco/jacoco/issues/2128">#2128</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jacoco/jacoco/compare/v0.8.14...v0.8.15">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 877a355860..326b26ee97 100644
--- a/pom.xml
+++ b/pom.xml
@@ -352,7 +352,7 @@ under the License.
         <plugin>
           <groupId>org.jacoco</groupId>
           <artifactId>jacoco-maven-plugin</artifactId>
-          <version>0.8.14</version>
+          <version>0.8.15</version>
         </plugin>
 
         <!--This plugin's configuration is used to store Eclipse m2e settings

From fb34d7a4848f5c5a93470b731e28490b1b64f166 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 09:53:53 +0200
Subject: [PATCH 03/28] MINOR: Bump io.grpc:grpc-bom from 1.81.0 to 1.82.1
 (#1199)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.81.0
to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-java/releases">io.grpc:grpc-bom's
releases</a>.</em></p>
<blockquote>
<h2>v1.82.1</h2>
<ul>
<li>protoc-gen-grpc-java: Fix missing osx-x86_64 binary (<a
href="https://redirect.github.com/grpc/grpc-java/pull/12878">grpc/grpc-java#12878</a>).
This fixes a regression in v1.82.0</li>
</ul>
<h2>v1.82.0</h2>
<p>This release drops support for Bazel 7. It may still run, but we are
no longer testing it. We are testing Bazel 8 and 9.</p>
<p>We are anticipating requiring Netty 4.2 in the next release. Please
file an issue if you still need Netty 4.1 support.</p>
<h3>Behavior Changes</h3>
<ul>
<li>xds: Disable Priority LB child policy retention cache (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12806">#12806</a>).
Previously, when a priority became inactive, its associated child load
balancer was kept in a deactivated state for potential reuse. Now,
inactive child balancers are immediately torn down and removed.</li>
<li>xds: skip DiscoveryRequest for unsubscribed types on stream ready
(<a
href="https://redirect.github.com/grpc/grpc-java/issues/12782">#12782</a>).
When the bootstrap declares more than one xDS server (e.g. a default
server for LDS/CDS plus an authority-specific EDS-only server),
grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server
too. That server replies <code>UNIMPLEMENTED</code>, which tears down
the stream and EDS data never arrives. This fix makes it skip
DiscoveryRequests for resource types we don't actually subscribe to on a
given server.</li>
</ul>
<h3>Improvements</h3>
<ul>
<li>Remove JSR-305 <code>@ThreadSafe</code> annotation and replace with
JavaDoc (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12762">#12762</a>).
Removes JSR-305 annotations but instead of replacing it with
ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is
done only in public non-final classes and interfaces. This allows Java
applications that have moved away from javax to compile and avoids a bug
in Immutables and Lombok (and possibly other annotation processors) from
failing when JSR-305 is not present.</li>
<li>core: Reduce per-stream idle memory on the server by 0.5 KB
(b38df6c94). The main improvement here is not retaining the request
Metadata for the life of the RPC. That means RPCs with larger request
Metadata would see a larger benefit.</li>
<li>core: Clarify missing content-type on HTTP error responses (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12720">#12720</a>).
Adjusts the diagnostic for the missing rather than invalid content-type,
in the Status description.</li>
<li>core: throw IOException when ProxySelector returns null or empty
list (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12793">#12793</a>).
ProxySelector.select(URI) is required to return a non-null, non-empty
list. Some implementations violate this, which previously caused an
opaque crash in ProxyDetectorImpl. Now it detects this case explicitly
and fails gracefully, naming the offending ProxySelector class to help
with debugging.</li>
<li>okhttp: enable TLS 1.3 by default for Android clients, retain TLS
1.2-only for desktop JVM (f43013161)</li>
<li>xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is
most noticeable when there are many endpoints returned by EDS, but the
LB policy only uses a few of them, like pick_first.</li>
<li>xds: pre-parse custom metric names in WRR load balancer (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12773">#12773</a>)
(324fce715). This reduces the per-RPC overhead of the gRFC A114 support
added in v1.81.0</li>
<li>xds: Propagate status cause through XdsDepManager (13b4b9727). This
preserves more information for failures communicating with the control
plane.</li>
<li>binder: Give clear error when message is larger than parcel
(d92ca44a1)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>xds: Trust Manager fix for certain scenarios where SAN validation
shouldn't use the SNI sent (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12775">#12775</a>)
(bb153a83f).</li>
<li>core: Cancel DelayedClientCall when application listener throws (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12761">#12761</a>).
Align DelayedClientCall.DelayedListener with ClientCallImpl's existing
behavior for listener exceptions. When the application listener throws
from onHeaders/onMessage/onReady, catch the Throwable, cancel the call
with CANCELLED (cause = the throwable), and swallow subsequent
callbacks. Previously, a throw from the application listener escaped to
the callExecutor's uncaught-exception handler. The real call was not
cancelled and the transport kept delivering callbacks to an already
broken listener</li>
<li>core,opentelemetry: Fix server metric labels on early close (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12774">#12774</a>).
Addresses the server-side OpenTelemetry metric labeling bug where a
generated method can be recorded as grpc.method=&quot;other&quot; if
<code>streamClosed()</code> happens before
<code>serverCallStarted()</code>.</li>
<li>core: Fix pick_first NPE with
<code>GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true</code> when accepting
resolved addresses and in CONNECTING state (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12814">#12814</a>).
It makes sure that whenever PickFirstLeafLoadBalancer transitions into
CONNECTING the current address in the addressIndex has a corresponding
subchannel. This prevents an NPE in acceptResolvedAddresses in some
situations.</li>
<li>okhttp: HPACK should fail on varint overflow (ec1099254). This
should have no visible impact in normal use. It mostly just makes it
easier to debug broken implementations</li>
<li>xds: When using the file watcher certificate provider, reload
cert/key even if only one of them changes (f4125c591)</li>
<li>compiler: Avoid compile error on weird proto file names
(f021befcd)</li>
</ul>
<h3>New Features</h3>
<ul>
<li>googleapis: support <code>?force-xds</code> query parameter in the
<code>google-c2p</code> resolver (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12760">#12760</a>)
(86fa86063). This disables environment checks and uses xDS
unconditionally. Please note that this feature has not yet seen
comprehensive testing.</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgrade Netty to 4.1.133 (ada087b9d)</li>
<li>bazel: Upgrade googleapis proto repo to commit 1dbb1a14 (ec0a9c976).
This fixed a rules_go incompatibility issue with Bazel 9.1. But it also
greatly reduced the overall transitive dependencies, as the C++ grpc
repo is no longer a dependency</li>
<li>bazel: Upgrade workflows to Bazel 8 (039ad7779) add Bazel 9.1.0 to
our CI matrix (17be0d3d1)</li>
<li>protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04
instead of 18.04 (8802dc35b5, da98b04b09)</li>
</ul>
<h3>Thanks to</h3>
<p><a
href="https://github.com/becomeStar"><code>@​becomeStar</code></a><br />
<a
href="https://github.com/bengtsson1-flir"><code>@​bengtsson1-flir</code></a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-java/commit/7b5e9ff531a8706a562d04ed9570a4790ce8ec64"><code>7b5e9ff</code></a>
Bump version to 1.82.1</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/20768f1630394b10d90c8737263cd198a43b7052"><code>20768f1</code></a>
Update README etc to reference 1.82.1</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/5ab5eba718f2e278e1015a0b7544e8dcf68afbc0"><code>5ab5eba</code></a>
kokoro: Remove extra / in architecture replacement</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/6726caf64c6e3d3db1ebfb5e9924fc75b706ae52"><code>6726caf</code></a>
buildscripts: add regional td config for psm-interop (v1.82.x backport)
(<a
href="https://redirect.github.com/grpc/grpc-java/issues/12864">#12864</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/022256f3f9f3816192dd11909b20902ebffcc37d"><code>022256f</code></a>
Bump version to 1.82.1-SNAPSHOT</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/78fb51905574241fbb5bc0259f908ead78dae609"><code>78fb519</code></a>
Bump version to 1.82.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/b62b0fc700b379cd080093d79330c181fce93de6"><code>b62b0fc</code></a>
Update README etc to reference 1.82.0</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/8802dc35b5c4d17cc8a53986db4f98bec9a2e04f"><code>8802dc3</code></a>
build: downgrade multiarch to Ubuntu 20.04 and consolidate images (<a
href="https://redirect.github.com/grpc/grpc-java/issues/12830">#12830</a>)</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/be300bd11d15bfe6d19bd50c40dfec44e9b127e6"><code>be300bd</code></a>
kokoro: Avoid brew on Mac OS</li>
<li><a
href="https://github.com/grpc/grpc-java/commit/4111f6f33ab3198833da99391875d378a25229f4"><code>4111f6f</code></a>
core: throw IOException when ProxySelector returns null or empty list
(<a
href="https://redirect.github.com/grpc/grpc-java/issues/12793">#12793</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-java/compare/v1.81.0...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.grpc:grpc-bom&package-manager=maven&previous-version=1.81.0&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 326b26ee97..3aa3867b90 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
     <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.15.Final</dep.netty-bom.version>
-    <dep.grpc-bom.version>1.81.0</dep.grpc-bom.version>
+    <dep.grpc-bom.version>1.82.1</dep.grpc-bom.version>
     <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.22.0</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>

From 2812cfaa4d455f202c9e11a1facdd83acb82530b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 09:54:40 +0200
Subject: [PATCH 04/28] MINOR: Bump dep.junit.jupiter.version from 6.1.0 to
 6.1.1 (#1200)

Bumps `dep.junit.jupiter.version` from 6.1.0 to 6.1.1.
Updates `org.junit.jupiter:junit-jupiter-engine` from 6.1.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-engine's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1</p>
<p>See <a href="https://docs.junit.org/6.1.1/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0d85889d9846c14378b732a8da860bfef6ddf7ca"><code>0d85889</code></a>
Release 6.1.1</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0363eee5be323b0a0ef05a0578ed03815d1ca258"><code>0363eee</code></a>
Finalize 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a6d540a593550a4247dfc3818496bc2453969235"><code>a6d540a</code></a>
Move entry to 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/69339d59ecb51f7047228ac53d07578b5bb4f7fa"><code>69339d5</code></a>
Only pass timeout when publishing to avoid failure in nmcp plugin</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/dec2eb93eb70684df9de4f1249cd39dfa7b4b19b"><code>dec2eb9</code></a>
Allow excluding engines from memory cleanup mode (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5786">#5786</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a5f4270f6bf406fa2d468e65961ed66c69e1d035"><code>a5f4270</code></a>
Publish sha256/sha512 checksums again but filter out signature ones (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5796">#5796</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/82130129139837ce26bfb9cf38e26c7b5ec00860"><code>8213012</code></a>
Update plugin nmcp-settings to v1.6.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5787">#5787</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d1bf8471dd5fe594d687eaa961eeb42d642af3f0"><code>d1bf847</code></a>
Generate Javadoc for aggregator modules</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d721de51cb39e5a4ffe45331f611dfab897653f3"><code>d721de5</code></a>
Pass <code>--no-fonts</code> to <code>javadoc</code> convention</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d289ec653ee268892da8defcb6f2fdb666efc4ed"><code>d289ec6</code></a>
Restore original SetSystemProperty values in a ParameterizedTest (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5720">#5720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.junit.jupiter:junit-jupiter-api` from 6.1.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-api's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1</p>
<p>See <a href="https://docs.junit.org/6.1.1/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0d85889d9846c14378b732a8da860bfef6ddf7ca"><code>0d85889</code></a>
Release 6.1.1</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0363eee5be323b0a0ef05a0578ed03815d1ca258"><code>0363eee</code></a>
Finalize 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a6d540a593550a4247dfc3818496bc2453969235"><code>a6d540a</code></a>
Move entry to 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/69339d59ecb51f7047228ac53d07578b5bb4f7fa"><code>69339d5</code></a>
Only pass timeout when publishing to avoid failure in nmcp plugin</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/dec2eb93eb70684df9de4f1249cd39dfa7b4b19b"><code>dec2eb9</code></a>
Allow excluding engines from memory cleanup mode (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5786">#5786</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a5f4270f6bf406fa2d468e65961ed66c69e1d035"><code>a5f4270</code></a>
Publish sha256/sha512 checksums again but filter out signature ones (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5796">#5796</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/82130129139837ce26bfb9cf38e26c7b5ec00860"><code>8213012</code></a>
Update plugin nmcp-settings to v1.6.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5787">#5787</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d1bf8471dd5fe594d687eaa961eeb42d642af3f0"><code>d1bf847</code></a>
Generate Javadoc for aggregator modules</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d721de51cb39e5a4ffe45331f611dfab897653f3"><code>d721de5</code></a>
Pass <code>--no-fonts</code> to <code>javadoc</code> convention</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d289ec653ee268892da8defcb6f2fdb666efc4ed"><code>d289ec6</code></a>
Restore original SetSystemProperty values in a ParameterizedTest (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5720">#5720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.junit.jupiter:junit-jupiter-params` from 6.1.0 to 6.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junit-team/junit-framework/releases">org.junit.jupiter:junit-jupiter-params's
releases</a>.</em></p>
<blockquote>
<p>JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1</p>
<p>See <a href="https://docs.junit.org/6.1.1/release-notes.html">Release
Notes</a>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0d85889d9846c14378b732a8da860bfef6ddf7ca"><code>0d85889</code></a>
Release 6.1.1</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/0363eee5be323b0a0ef05a0578ed03815d1ca258"><code>0363eee</code></a>
Finalize 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a6d540a593550a4247dfc3818496bc2453969235"><code>a6d540a</code></a>
Move entry to 6.1.1 release notes</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/69339d59ecb51f7047228ac53d07578b5bb4f7fa"><code>69339d5</code></a>
Only pass timeout when publishing to avoid failure in nmcp plugin</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/dec2eb93eb70684df9de4f1249cd39dfa7b4b19b"><code>dec2eb9</code></a>
Allow excluding engines from memory cleanup mode (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5786">#5786</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/a5f4270f6bf406fa2d468e65961ed66c69e1d035"><code>a5f4270</code></a>
Publish sha256/sha512 checksums again but filter out signature ones (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5796">#5796</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/82130129139837ce26bfb9cf38e26c7b5ec00860"><code>8213012</code></a>
Update plugin nmcp-settings to v1.6.0 (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5787">#5787</a>)</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d1bf8471dd5fe594d687eaa961eeb42d642af3f0"><code>d1bf847</code></a>
Generate Javadoc for aggregator modules</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d721de51cb39e5a4ffe45331f611dfab897653f3"><code>d721de5</code></a>
Pass <code>--no-fonts</code> to <code>javadoc</code> convention</li>
<li><a
href="https://github.com/junit-team/junit-framework/commit/d289ec653ee268892da8defcb6f2fdb666efc4ed"><code>d289ec6</code></a>
Restore original SetSystemProperty values in a ParameterizedTest (<a
href="https://redirect.github.com/junit-team/junit-framework/issues/5720">#5720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 3aa3867b90..fa493e066d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -95,7 +95,7 @@ under the License.
     <project.build.outputTimestamp>1773644827</project.build.outputTimestamp>
     <target.gen.source.path>${project.build.directory}/generated-sources</target.gen.source.path>
     <dep.junit.platform.version>1.9.0</dep.junit.platform.version>
-    <dep.junit.jupiter.version>6.1.0</dep.junit.jupiter.version>
+    <dep.junit.jupiter.version>6.1.1</dep.junit.jupiter.version>
     <dep.slf4j.version>2.0.18</dep.slf4j.version>
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.15.Final</dep.netty-bom.version>

From bf0b3445c5cac4f964665a5f28b4a80c4ad8d640 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:57:05 +0900
Subject: [PATCH 05/28] MINOR: [CI] Bump actions/cache from 5 to 6 (#1197)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
<h2>v5.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Update ts-http-runtime dependency by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
<li>Update dependencies &amp; patch security vulnerabilities by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p>
<h2>v.5.0.2</h2>
<h1>v5.0.2</h1>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/v5...v6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml  | 2 +-
 .github/workflows/rc.yml   | 8 ++++----
 .github/workflows/test.yml | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 2111f47254..f23c4e5e2f 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -42,7 +42,7 @@ jobs:
         with:
           python-version: '3.x'
       - name: pre-commit (cache)
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index f0e99f1219..79c4476345 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -133,7 +133,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Cache
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .docker
           key: jni-linux-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -264,7 +264,7 @@ jobs:
         run: |
           echo "CCACHE_DIR=${PWD}/ccache" >> ${GITHUB_ENV}
       - name: Cache ccache
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ccache
           key: jni-macos-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -340,7 +340,7 @@ jobs:
         run: |
           echo "CCACHE_DIR=${PWD}/ccache" >> ${GITHUB_ENV}
       - name: Cache ccache
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ccache
           key: jni-windows-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -414,7 +414,7 @@ jobs:
           repository: apache/arrow-testing
           path: testing
       - name: Cache ~/.m2
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2
           key: binaries-build-${{ hashFiles('**/*.java', '**/pom.xml') }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8c437a056d..1e4664237b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,7 +63,7 @@ jobs:
           fetch-depth: 0
           submodules: recursive
       - name: Cache Docker Volumes
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .docker
           key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml', '**/*.java') }}
@@ -190,7 +190,7 @@ jobs:
         run: |
           ci/scripts/util_free_space.sh
       - name: Cache Docker Volumes
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .docker
           key: integration-conda-${{ hashFiles('cpp/**') }}

From 365a5f46d1fe437d2337d705dd6a0043f2ac1703 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:45:32 +0200
Subject: [PATCH 06/28] MINOR: [CI] Bump actions/checkout from 6 to 7 (#1193)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to
7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p>
<h2>v6.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update all references from v5 and v4 to v6 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
<li>Clarify v6 README by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a>
update error wording (<a
href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a>
getting ready for checkout v7 release (<a
href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a>
Bump the minor-npm-dependencies group across 1 directory with 3 updates
(<a
href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a>
upgrade module to esm and update dependencies (<a
href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a>
Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code>
and Remove uuid (<a
href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a>
Bump js-yaml from 4.1.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a>
Bump flatted from 3.3.1 to 3.4.2 (<a
href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a>
Bump actions/publish-immutable-action (<a
href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a>
block checking out fork pr for pull_request_target and workflow_run (<a
href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/v6...v7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=6&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml     |  2 +-
 .github/workflows/dev_pr.yml  |  2 +-
 .github/workflows/rc.yml      | 20 ++++++++++----------
 .github/workflows/release.yml |  2 +-
 .github/workflows/test.yml    | 20 ++++++++++----------
 5 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index f23c4e5e2f..25b08700fd 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -33,7 +33,7 @@ jobs:
     name: "pre-commit"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/dev_pr.yml b/.github/workflows/dev_pr.yml
index 20946c8185..ad000df88e 100644
--- a/.github/workflows/dev_pr.yml
+++ b/.github/workflows/dev_pr.yml
@@ -43,7 +43,7 @@ jobs:
     name: "Ensure PR format"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 79c4476345..fdfcd1cce3 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
       - name: Prepare for tag
@@ -113,17 +113,17 @@ jobs:
           ci/scripts/download_cpp.sh
       - name: Checkout Apache Arrow C++
         if: github.event_name == 'schedule'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow
           path: arrow
       - name: Checkout apache/arrow-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-testing
           path: arrow/testing
       - name: Checkout apache/parquet-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
@@ -180,17 +180,17 @@ jobs:
           ci/scripts/download_cpp.sh
       - name: Checkout Apache Arrow C++
         if: github.event_name == 'schedule'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow
           path: arrow
       - name: Checkout apache/arrow-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-testing
           path: arrow/testing
       - name: Checkout apache/parquet-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
@@ -310,7 +310,7 @@ jobs:
           ci/scripts/download_cpp.sh
       - name: Checkout Apache Arrow C++
         if: github.event_name == 'schedule'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow
           path: arrow
@@ -409,7 +409,7 @@ jobs:
           test -f jni/arrow_dataset_jni/x86_64/arrow_dataset_jni.dll
           test -f jni/arrow_orc_jni/x86_64/arrow_orc_jni.dll
       - name: Checkout apache/arrow-testing
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-testing
           path: testing
@@ -497,7 +497,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: site
       - name: Prepare branch
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a2c5a55544..7692eb6cbe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,7 +65,7 @@ jobs:
               $artifact
           done
       - name: Checkout for publishing docs
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: site
       - name: Publish docs
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1e4664237b..ac8080d075 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -58,7 +58,7 @@ jobs:
       MAVEN: ${{ matrix.maven }}
     steps:
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
@@ -100,7 +100,7 @@ jobs:
           distribution: 'temurin'
           java-version: ${{ matrix.jdk }}
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
@@ -131,7 +131,7 @@ jobs:
           java-version: ${{ matrix.jdk }}
           distribution: 'temurin'
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
@@ -152,37 +152,37 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout Arrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           repository: apache/arrow
           submodules: recursive
       - name: Checkout Arrow Rust
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-rs
           path: rust
       - name: Checkout Arrow nanoarrow
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-nanoarrow
           path: nanoarrow
       - name: Checkout Arrow .NET
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-dotnet
           path: dotnet
       - name: Checkout Arrow Go
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-go
           path: go
       - name: Checkout Arrow Java
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: java
       - name: Checkout Arrow JavaScript
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: apache/arrow-js
           path: js

From 9122af2ad87c6f51d8ed9082ba2f0a122980ea2a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:45:52 +0200
Subject: [PATCH 07/28] MINOR: Bump com.google.protobuf:protobuf-bom from
 4.35.0 to 4.35.1 (#1186)

Bumps
[com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf)
from 4.35.0 to 4.35.1.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/protocolbuffers/protobuf/commits">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index fa493e066d..c39eafc209 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,7 +100,7 @@ under the License.
     <dep.guava-bom.version>33.6.0-jre</dep.guava-bom.version>
     <dep.netty-bom.version>4.2.15.Final</dep.netty-bom.version>
     <dep.grpc-bom.version>1.82.1</dep.grpc-bom.version>
-    <dep.protobuf-bom.version>4.35.0</dep.protobuf-bom.version>
+    <dep.protobuf-bom.version>4.35.1</dep.protobuf-bom.version>
     <dep.jackson-bom.version>2.22.0</dep.jackson-bom.version>
     <dep.hadoop.version>3.5.0</dep.hadoop.version>
     <dep.fbs.version>25.2.10</dep.fbs.version>

From b0e51af855ef5befac903b1a6de3f535258ccd1b Mon Sep 17 00:00:00 2001
From: YangJie <yangjie01@baidu.com>
Date: Tue, 30 Jun 2026 12:40:01 +0800
Subject: [PATCH 08/28] GH-1116: [Java] Fix compressed buffer prefix write and
 ZSTD dstCapacity (#1119)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Two fixes in the compression codec:

1. **`AbstractCompressionCodec.compress()`: capture `writerIndex()`
once**

The previous code read `uncompressedBuffer.writerIndex()` at multiple
sites — for the size comparison and again after `doCompress()` to
populate the 8-byte uncompressed-length prefix. Capture the value once
at the top of `compress()` and reuse it for the empty-buffer check, the
size comparison, and the prefix, so all three consumers see the same
value.

2. **`ZstdCompressionCodec.doCompress()`: `dstCapacity` overstated by 8
bytes**

`Zstd.compressUnsafe(dst, dstSize, ...)` expects `dstSize` to be the
available space from `dst`. The code offsets `dst` by 8 bytes past the
prefix but passed `8 + maxSize` instead of `maxSize`. The
`compressBound()` headroom hides this in practice, but the parameter was
semantically wrong. Pass `maxSize`.

## Tests

Covered by the existing round-trip tests (`testEmptyBuffer`,
`testReadWriteStream`, `testReadWriteFile`, etc.). I was not able to
construct a minimal reproducer for the original `declaredUncompressed=0`
symptom on the unfixed code, so both fixes are conservative correctness
improvements derived from code inspection rather than failing-then-green
regression tests.
---
 .../org/apache/arrow/compression/ZstdCompressionCodec.java | 2 +-
 .../arrow/vector/compression/AbstractCompressionCodec.java | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java b/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
index 290723608d..ed46fe81b4 100644
--- a/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
+++ b/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
@@ -44,7 +44,7 @@ protected ArrowBuf doCompress(BufferAllocator allocator, ArrowBuf uncompressedBu
     long bytesWritten =
         Zstd.compressUnsafe(
             compressedBuffer.memoryAddress() + CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH,
-            dstSize,
+            maxSize,
             /*src*/ uncompressedBuffer.memoryAddress(),
             /* srcSize= */ uncompressedBuffer.writerIndex(),
             /* level= */ this.compressionLevel);
diff --git a/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java b/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
index 58d9e4db9b..b108173c82 100644
--- a/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
+++ b/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
@@ -29,7 +29,11 @@ public abstract class AbstractCompressionCodec implements CompressionCodec {
 
   @Override
   public ArrowBuf compress(BufferAllocator allocator, ArrowBuf uncompressedBuffer) {
-    if (uncompressedBuffer.writerIndex() == 0L) {
+    // GH-1116: capture writerIndex() once so the empty-buffer check, size
+    // comparison, and uncompressed-length prefix all see the same value.
+    long uncompressedLength = uncompressedBuffer.writerIndex();
+
+    if (uncompressedLength == 0L) {
       // shortcut for empty buffer
       ArrowBuf compressedBuffer = allocator.buffer(CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH);
       compressedBuffer.setLong(0, 0);
@@ -41,7 +45,6 @@ public ArrowBuf compress(BufferAllocator allocator, ArrowBuf uncompressedBuffer)
     ArrowBuf compressedBuffer = doCompress(allocator, uncompressedBuffer);
     long compressedLength =
         compressedBuffer.writerIndex() - CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH;
-    long uncompressedLength = uncompressedBuffer.writerIndex();
 
     if (compressedLength > uncompressedLength) {
       // compressed buffer is larger, send the raw buffer

From 301d3d8f889d3e4d1f45fc6e1707460ae5baaeb4 Mon Sep 17 00:00:00 2001
From: Pedro Matias <pedro.matias@dremio.com>
Date: Tue, 30 Jun 2026 05:41:30 +0100
Subject: [PATCH 09/28] GH-1063: Add is_update field to
 ActionCreatePreparedStatementResult (#1064)

## What's Changed

A new field, `optional bool is_update = 4;`, was added to `message
ActionCreatePreparedStatementResult`. When this field is sent by the
server, its value indicates whether the proper network flow to execute
the query that the driver should follow uses
`CommandPreparedStatementQuery` or `CommandPreparedStatementUpdate`.


For outdated servers that don't send the field, the driver maintains its
current behavior of using `CommandPreparedStatementQuery` when the
`dataset_schema` is not empty, thus ensuring the backward compatibility
of the new driver with old servers.

This change was created with AI assistance (Augment Code and Claude
code). All lines were manually reviewed by a human. The output is not
copyrightable subject matter.

- Closes #1063

---------

Co-authored-by: David Li <li.davidm96@gmail.com>
---
 arrow-format/FlightSql.proto                  |  5 ++
 .../ArrowFlightJdbcFlightStreamResultSet.java |  2 +-
 ...owFlightJdbcVectorSchemaRootResultSet.java |  2 +-
 .../driver/jdbc/ArrowFlightMetaImpl.java      | 23 +++++--
 .../client/ArrowFlightSqlClientHandler.java   | 19 ++++++
 .../ArrowFlightPreparedStatementTest.java     | 48 ++++++++++++++
 .../jdbc/ArrowFlightStatementExecuteTest.java | 66 +++++++++++++++++++
 .../jdbc/utils/MockFlightSqlProducer.java     | 42 ++++++++++++
 .../arrow/flight/sql/FlightSqlClient.java     | 13 ++++
 9 files changed, 212 insertions(+), 8 deletions(-)

diff --git a/arrow-format/FlightSql.proto b/arrow-format/FlightSql.proto
index 566230c2a6..b1dc57b33b 100644
--- a/arrow-format/FlightSql.proto
+++ b/arrow-format/FlightSql.proto
@@ -1550,6 +1550,11 @@ message ActionCreatePreparedStatementResult {
   // If the query provided contained parameters, parameter_schema contains the
   // schema of the expected parameters.  It should be an IPC-encapsulated Schema, as described in Schema.fbs.
   bytes parameter_schema = 3;
+
+  // When set to true, the query should be executed with CommandPreparedStatementUpdate,
+  // when set to false, the query should be executed with CommandPreparedStatementQuery.
+  // If not set, the client can choose how to execute the query.
+  optional bool is_update = 4;
 }
 
 /*
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
index 2885f7895b..376e5b11e7 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
@@ -106,7 +106,7 @@ static ArrowFlightJdbcFlightStreamResultSet fromFlightInfo(
     final TimeZone timeZone = TimeZone.getDefault();
     final QueryState state = new QueryState();
 
-    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null);
+    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null, null);
 
     final AvaticaResultSetMetaData resultSetMetaData =
         new AvaticaResultSetMetaData(null, null, signature);
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
index 5d02d6e843..ad6670a001 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
@@ -73,7 +73,7 @@ public static ArrowFlightJdbcVectorSchemaRootResultSet fromVectorSchemaRoot(
     final TimeZone timeZone = TimeZone.getDefault();
     final QueryState state = new QueryState();
 
-    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null);
+    final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null, null);
 
     final AvaticaResultSetMetaData resultSetMetaData =
         new AvaticaResultSetMetaData(null, null, signature);
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
index 64529b50c8..0d85b5eddb 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
@@ -53,7 +53,8 @@ public ArrowFlightMetaImpl(final AvaticaConnection connection) {
   }
 
   /** Construct a signature. */
-  static Signature newSignature(final String sql, Schema resultSetSchema, Schema parameterSchema) {
+  static Signature newSignature(
+      final String sql, Schema resultSetSchema, Schema parameterSchema, Boolean isUpdate) {
     List<ColumnMetaData> columnMetaData =
         resultSetSchema == null
             ? new ArrayList<>()
@@ -62,10 +63,17 @@ static Signature newSignature(final String sql, Schema resultSetSchema, Schema p
         parameterSchema == null
             ? new ArrayList<>()
             : ConvertUtils.convertArrowFieldsToAvaticaParameters(parameterSchema.getFields());
-    StatementType statementType =
-        resultSetSchema == null || resultSetSchema.getFields().isEmpty()
-            ? StatementType.IS_DML
-            : StatementType.SELECT;
+    // If the server provided the is_update field, use it to determine the statement type
+    StatementType statementType;
+    if (isUpdate != null) {
+      statementType = isUpdate ? StatementType.IS_DML : StatementType.SELECT;
+    } else {
+      // Fall back to the legacy logic: check if the result set schema is empty
+      statementType =
+          resultSetSchema == null || resultSetSchema.getFields().isEmpty()
+              ? StatementType.IS_DML
+              : StatementType.SELECT;
+    }
     return new Signature(
         columnMetaData,
         sql,
@@ -178,7 +186,10 @@ private PreparedStatement prepareForHandle(final String query, StatementHandle h
         ((ArrowFlightConnection) connection).getClientHandler().prepare(query);
     handle.signature =
         newSignature(
-            query, preparedStatement.getDataSetSchema(), preparedStatement.getParameterSchema());
+            query,
+            preparedStatement.getDataSetSchema(),
+            preparedStatement.getParameterSchema(),
+            preparedStatement.isUpdate());
     statementHandlePreparedStatementMap.put(new StatementHandleKey(handle), preparedStatement);
     return preparedStatement;
   }
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
index f0ea284239..719cc38a2b 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
@@ -388,6 +388,14 @@ public interface PreparedStatement extends AutoCloseable {
      */
     Schema getParameterSchema();
 
+    /**
+     * Gets whether this {@link PreparedStatement} is an update statement.
+     *
+     * @return {@code true} if this is an update statement, {@code false} if it's a query, or {@code
+     *     null} if the server did not provide this information.
+     */
+    @Nullable Boolean isUpdate();
+
     void setParameters(VectorSchemaRoot parameters);
 
     @Override
@@ -456,6 +464,12 @@ public long executeUpdate() {
 
       @Override
       public StatementType getType() {
+        // If the server provided the is_update field, use it to determine the statement type
+        final Boolean isUpdate = preparedStatement.isUpdate();
+        if (isUpdate != null) {
+          return isUpdate ? StatementType.UPDATE : StatementType.SELECT;
+        }
+        // Fall back to the legacy logic: check if the result set schema is empty
         final Schema schema = preparedStatement.getResultSetSchema();
         return schema.getFields().isEmpty() ? StatementType.UPDATE : StatementType.SELECT;
       }
@@ -475,6 +489,11 @@ public void setParameters(VectorSchemaRoot parameters) {
         preparedStatement.setParameters(parameters);
       }
 
+      @Override
+      public Boolean isUpdate() {
+        return preparedStatement.isUpdate();
+      }
+
       @Override
       public void close() {
         try {
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
index 0369c3a162..078837adf3 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
@@ -98,6 +98,40 @@ public void testSimpleQueryNoParameterBindingWithExecute() throws SQLException {
     }
   }
 
+  @Test
+  public void testSimpleQueryNoParameterBindingWithExecuteV2() throws SQLException {
+    final String query = "SELECT * FROM TEST_V2";
+    final Schema schema =
+        new Schema(Collections.singletonList(Field.nullable("", Types.MinorType.INT.getType())));
+    PRODUCER.addSelectQuery(
+        query,
+        schema,
+        Collections.singletonList(
+            listener -> {
+              try (final BufferAllocator allocator = new RootAllocator(Long.MAX_VALUE);
+                  final VectorSchemaRoot root = VectorSchemaRoot.create(schema, allocator)) {
+                root.allocateNew();
+                ((IntVector) root.getVector(0)).setSafe(0, 123);
+                root.setRowCount(1);
+                listener.start(root);
+                listener.putNext();
+              } finally {
+                listener.completed();
+              }
+            }),
+        false);
+    try (final PreparedStatement preparedStatement = connection.prepareStatement(query)) {
+      boolean isResultSet = preparedStatement.execute();
+      assertTrue(isResultSet);
+      final ResultSet resultSet = preparedStatement.getResultSet();
+      assertTrue(resultSet.next());
+      assertEquals(123, resultSet.getInt(1));
+      assertFalse(resultSet.next());
+      assertFalse(preparedStatement.getMoreResults());
+      assertEquals(-1, preparedStatement.getUpdateCount());
+    }
+  }
+
   @Test
   public void testQueryWithParameterBinding() throws SQLException {
     final String query = "Fake query with parameters";
@@ -203,6 +237,20 @@ public void testUpdateQueryWithExecute() throws SQLException {
     }
   }
 
+  @Test
+  public void testUpdateQueryWithExecuteV2() throws SQLException {
+    String query = "Fake update with execute V2";
+    PRODUCER.addUpdateQuery(query, /*updatedRows*/ 99, true);
+    try (final PreparedStatement stmt = connection.prepareStatement(query)) {
+      boolean isResultSet = stmt.execute();
+      assertFalse(isResultSet);
+      int updated = stmt.getUpdateCount();
+      assertEquals(99, updated);
+      assertFalse(stmt.getMoreResults());
+      assertEquals(-1, stmt.getUpdateCount());
+    }
+  }
+
   @Test
   public void testUpdateQueryWithParameters() throws SQLException {
     String query = "Fake update with parameters";
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
index 632cb0ba56..6acce9c2a6 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
@@ -62,6 +62,9 @@ public class ArrowFlightStatementExecuteTest {
   private static final String SAMPLE_LARGE_UPDATE_QUERY =
       "UPDATE this_large_table SET this_large_field = that_large_field FROM this_large_test WHERE this_large_condition";
   private static final long SAMPLE_LARGE_UPDATE_COUNT = Long.MAX_VALUE;
+  private static final String SAMPLE_QUERY_CMD_V2 = "SELECT * FROM this_test_v2";
+  private static final String SAMPLE_LARGE_UPDATE_QUERY_V2 =
+      "UPDATE this_large_table_v2 SET this_large_field = that_large_field FROM this_large_test WHERE this_large_condition";
   private static final MockFlightSqlProducer PRODUCER = new MockFlightSqlProducer();
 
   @RegisterExtension
@@ -96,6 +99,31 @@ public static void setUpBeforeClass() {
             }));
     PRODUCER.addUpdateQuery(SAMPLE_UPDATE_QUERY, SAMPLE_UPDATE_COUNT);
     PRODUCER.addUpdateQuery(SAMPLE_LARGE_UPDATE_QUERY, SAMPLE_LARGE_UPDATE_COUNT);
+
+    // V2 queries with is_update field set
+    PRODUCER.addSelectQuery(
+        SAMPLE_QUERY_CMD_V2,
+        SAMPLE_QUERY_SCHEMA,
+        Collections.singletonList(
+            listener -> {
+              try (final BufferAllocator allocator = new RootAllocator(Long.MAX_VALUE);
+                  final VectorSchemaRoot root =
+                      VectorSchemaRoot.create(SAMPLE_QUERY_SCHEMA, allocator)) {
+                final UInt1Vector vector = (UInt1Vector) root.getVector(VECTOR_NAME);
+                IntStream.range(0, SAMPLE_QUERY_ROWS)
+                    .forEach(index -> vector.setSafe(index, index));
+                vector.setValueCount(SAMPLE_QUERY_ROWS);
+                root.setRowCount(SAMPLE_QUERY_ROWS);
+                listener.start(root);
+                listener.putNext();
+              } catch (final Throwable throwable) {
+                listener.error(throwable);
+              } finally {
+                listener.completed();
+              }
+            }),
+        false);
+    PRODUCER.addUpdateQuery(SAMPLE_LARGE_UPDATE_QUERY_V2, SAMPLE_LARGE_UPDATE_COUNT, true);
   }
 
   @BeforeEach
@@ -168,4 +196,42 @@ public void testUpdateCountShouldStartOnZero() throws SQLException {
         is(allOf(equalTo(statement.getLargeUpdateCount()), equalTo(0L))));
     assertThat(statement.getResultSet(), is(nullValue()));
   }
+
+  @Test
+  public void testExecuteShouldRunSelectQueryV2() throws SQLException {
+    assertThat(statement.execute(SAMPLE_QUERY_CMD_V2), is(true));
+    final Set<Byte> numbers =
+        IntStream.range(0, SAMPLE_QUERY_ROWS)
+            .boxed()
+            .map(Integer::byteValue)
+            .collect(Collectors.toCollection(HashSet::new));
+    try (final ResultSet resultSet = statement.getResultSet()) {
+      final int columnCount = resultSet.getMetaData().getColumnCount();
+      assertThat(columnCount, is(1));
+      int rowCount = 0;
+      for (; resultSet.next(); rowCount++) {
+        assertThat(numbers.remove(resultSet.getByte(1)), is(true));
+      }
+      assertThat(rowCount, is(equalTo(SAMPLE_QUERY_ROWS)));
+    }
+    assertThat(numbers, is(Collections.emptySet()));
+    assertThat(
+        (long) statement.getUpdateCount(),
+        is(allOf(equalTo(statement.getLargeUpdateCount()), equalTo(-1L))));
+  }
+
+  @Test
+  public void testExecuteShouldRunUpdateQueryForLargeUpdateV2() throws SQLException {
+    assertThat(statement.execute(SAMPLE_LARGE_UPDATE_QUERY_V2), is(false)); // UPDATE query.
+    final long updateCountSmall = statement.getUpdateCount();
+    final long updateCountLarge = statement.getLargeUpdateCount();
+    assertThat(updateCountLarge, is(equalTo(SAMPLE_LARGE_UPDATE_COUNT)));
+    assertThat(
+        updateCountSmall,
+        is(
+            allOf(
+                equalTo((long) AvaticaUtils.toSaturatedInt(updateCountLarge)),
+                not(equalTo(updateCountLarge)))));
+    assertThat(statement.getResultSet(), is(nullValue()));
+  }
 }
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
index 45c2a96404..6627d91ab6 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
@@ -87,6 +87,7 @@
 import org.apache.arrow.vector.types.pojo.Schema;
 import org.apache.arrow.vector.util.JsonStringArrayList;
 import org.apache.calcite.avatica.Meta.StatementType;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /** An ad-hoc {@link FlightSqlProducer} for tests. */
 public final class MockFlightSqlProducer implements FlightSqlProducer {
@@ -101,6 +102,7 @@ public final class MockFlightSqlProducer implements FlightSqlProducer {
   private final SqlInfoBuilder sqlInfoBuilder = new SqlInfoBuilder();
   private final Map<String, Schema> parameterSchemas = new HashMap<>();
   private final Map<String, List<List<Object>>> expectedParameterValues = new HashMap<>();
+  private final Map<String, Boolean> isUpdateMap = new HashMap<>();
 
   private final Map<String, Integer> actionTypeCounter = new HashMap<>();
 
@@ -176,6 +178,40 @@ public void addUpdateQuery(final String sqlCommand, final long updatedRows) {
         });
   }
 
+  /**
+   * Registers a new {@link StatementType#SELECT} SQL query, optionally setting the is_update field.
+   *
+   * @param sqlCommand the SQL command under which to register the new query.
+   * @param schema the schema to use for the query result.
+   * @param resultProviders the result provider for this query.
+   * @param isUpdate value to report for the is_update field, or {@code null} to leave it unset.
+   */
+  public void addSelectQuery(
+      final String sqlCommand,
+      final Schema schema,
+      final List<Consumer<ServerStreamListener>> resultProviders,
+      final @Nullable Boolean isUpdate) {
+    addSelectQuery(sqlCommand, schema, resultProviders);
+    if (isUpdate != null) {
+      isUpdateMap.put(sqlCommand, isUpdate);
+    }
+  }
+
+  /**
+   * Registers a new {@link StatementType#UPDATE} SQL query, optionally setting the is_update field.
+   *
+   * @param sqlCommand the SQL command.
+   * @param updatedRows the number of rows affected.
+   * @param isUpdate value to report for the is_update field, or {@code null} to leave it unset.
+   */
+  public void addUpdateQuery(
+      final String sqlCommand, final long updatedRows, final @Nullable Boolean isUpdate) {
+    addUpdateQuery(sqlCommand, updatedRows);
+    if (isUpdate != null) {
+      isUpdateMap.put(sqlCommand, isUpdate);
+    }
+  }
+
   /**
    * Adds a catalog query to the results.
    *
@@ -247,6 +283,12 @@ public void createPreparedStatement(
         resultBuilder.setParameterSchema(ByteString.copyFrom(outputStream.toByteArray()));
       }
 
+      // Set is_update field if present
+      final Boolean isUpdate = isUpdateMap.get(query);
+      if (isUpdate != null) {
+        resultBuilder.setIsUpdate(isUpdate);
+      }
+
       listener.onNext(new Result(pack(resultBuilder.build()).toByteArray()));
     } catch (final Throwable t) {
       listener.onError(t);
diff --git a/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java b/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
index 623f9311e8..0af09faee1 100644
--- a/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
+++ b/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
@@ -1284,6 +1284,19 @@ public Schema getParameterSchema() {
       return parameterSchema;
     }
 
+    /**
+     * Returns whether the server indicated this prepared statement is an update query.
+     *
+     * @return true if the server indicated this is an update query, false if the server indicated
+     *     this is a select query, or null if the server did not provide this information.
+     */
+    public Boolean isUpdate() {
+      if (preparedStatementResult.hasIsUpdate()) {
+        return preparedStatementResult.getIsUpdate();
+      }
+      return null;
+    }
+
     /** Get the schema of the result set (should be identical to {@link #getResultSetSchema()}). */
     public SchemaResult fetchSchema(CallOption... options) {
       checkOpen();

From fcba1b0345faed30621863af85a102c6d2fc1362 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 07:51:48 +0200
Subject: [PATCH 10/28] MINOR: Bump org.cyclonedx:cyclonedx-maven-plugin from
 2.9.1 to 2.9.2 (#1198)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin)
from 2.9.1 to 2.9.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/releases">org.cyclonedx:cyclonedx-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>2.9.2</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li>chore: upgrade maven-dependency-analyzer/asm, support Java 25 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/630">#630</a>)
<a href="https://github.com/shihyuho"><code>@​shihyuho</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>Bump commons-codec:commons-codec from 1.17.1 to 1.22.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/650">#650</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/622">#622</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore: upgrade maven-dependency-analyzer/asm, support Java 25 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/630">#630</a>)
<a href="https://github.com/shihyuho"><code>@​shihyuho</code></a></li>
</ul>
<h2>🔧 Build</h2>
<ul>
<li>update scm urls (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/662">#662</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>switch to Central Publishing Portal (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/659">#659</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>Bump org.apache.maven.plugins:maven-project-info-reports-plugin from
3.8.0 to 3.9.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/655">#655</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump plugin-tools.version from 3.15.0 to 3.15.2 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/654">#654</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump io.takari.maven.plugins:takari-plugin-integration-testing from
3.0.1 to 3.1.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/616">#616</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-invoker-plugin from 3.7.0 to
3.9.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/617">#617</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump io.takari.maven.plugins:takari-plugin-testing from 3.0.0 to
3.1.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/618">#618</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.13.0 to
3.14.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/621">#621</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump actions/checkout from 6.0.1 to 6.0.2 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/639">#639</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump actions/setup-java from 4 to 5 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/620">#620</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>use shields.io badge (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/648">#648</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>Bump actions/checkout from 6.0.0 to 6.0.1 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/635">#635</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump actions/checkout from 4.2.2 to 6.0.0 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/633">#633</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore: GH workflow permissions (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/606">#606</a>)
<a
href="https://github.com/jkowalleck"><code>@​jkowalleck</code></a></li>
<li>simplify compiler release configuration (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/518">#518</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>Bump JamesIves/github-pages-deploy-action from 4.7.1 to 4.7.3 (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/590">#590</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>upgrade to Doxia 2: m-site-p and skin (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/593">#593</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
<li>add Reproducible Central report (<a
href="https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/592">#592</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/0fe189d0cd2c80acb1f518e53fbb703456e6534a"><code>0fe189d</code></a>
[maven-release-plugin] prepare release cyclonedx-maven-plugin-2.9.2</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/96c218c71646aa987d5778b9f0f035f40ff45239"><code>96c218c</code></a>
update scm urls</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/0fe08b4215263965690c0a0a022c1fdbc396cad8"><code>0fe08b4</code></a>
Revert &quot;Bump JamesIves/github-pages-deploy-action from 4.7.3 to
4.8.0&quot;</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/6779e48e4108e5c1881109f39ebda293311ec591"><code>6779e48</code></a>
Revert &quot;Bump release-drafter/release-drafter from 6 to 7&quot;</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/955fead7657740f51b738de11961d4c1eb233bb3"><code>955fead</code></a>
switch to Central Publishing Portal</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/50dbac7e4cd969764e2bfb8e971b0fcf5fcbebba"><code>50dbac7</code></a>
Bump release-drafter/release-drafter from 6 to 7</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/d50bc582155e15a6a1560edab0f1e94d019601e1"><code>d50bc58</code></a>
Bump org.apache.maven.plugins:maven-project-info-reports-plugin</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/1034644886969032df5552fd4132102baeca40c8"><code>1034644</code></a>
Bump plugin-tools.version from 3.15.0 to 3.15.2</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/018ab8e4fdf3b73049497a76bea952983b88389f"><code>018ab8e</code></a>
Bump commons-codec:commons-codec from 1.17.1 to 1.22.0</li>
<li><a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/e3597051e8c6eb694e9ccd044b9b5a0829166add"><code>e359705</code></a>
Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0</li>
<li>Additional commits viewable in <a
href="https://github.com/CycloneDX/cyclonedx-maven-plugin/compare/cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.cyclonedx:cyclonedx-maven-plugin&package-manager=maven&previous-version=2.9.1&new-version=2.9.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index c39eafc209..6a97ac4620 100644
--- a/pom.xml
+++ b/pom.xml
@@ -522,7 +522,7 @@ under the License.
         <plugin>
           <groupId>org.cyclonedx</groupId>
           <artifactId>cyclonedx-maven-plugin</artifactId>
-          <version>2.9.1</version>
+          <version>2.9.2</version>
         </plugin>
         <plugin>
           <groupId>org.apache.drill.tools</groupId>

From bd8cd52fc8426b485a8b3e64997fb178c84c9de2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 07:54:25 +0200
Subject: [PATCH 11/28] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-10 to
 1.5.7-11 (#1184)

Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-10 to 1.5.7-11.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/luben/zstd-jni/commits/v1.5.7-11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.github.luben:zstd-jni&package-manager=maven&previous-version=1.5.7-10&new-version=1.5.7-11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 compression/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compression/pom.xml b/compression/pom.xml
index 41cdb03796..aa7dee6f89 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
     <dependency>
       <groupId>com.github.luben</groupId>
       <artifactId>zstd-jni</artifactId>
-      <version>1.5.7-10</version>
+      <version>1.5.7-11</version>
     </dependency>
   </dependencies>
 </project>

From 04471f4f8900e0a91efe0d6ae717c3211aa5efbd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 2 Jul 2026 08:11:17 +0200
Subject: [PATCH 12/28] MINOR: Bump logback.version from 1.5.32 to 1.5.34
 (#1171)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps `logback.version` from 1.5.32 to 1.5.34.
Updates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java &quot;21&quot; 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan=&quot;true&quot; attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code>&lt;conversionRule&gt;</code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the &quot;java.lang&quot; and
&quot;java.util&quot; packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
&quot;TLSv1.2&quot;. This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as &quot;&amp;&quot; as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />

Updates `ch.qos.logback:logback-core` from 1.5.32 to 1.5.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-core's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.34</h2>
<p><strong>2026-06-01 Release of logback version 1.5.34</strong></p>
<p>• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues <a
href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a
href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>),
reported by Naotsugu Kobayashi.</p>
<p>• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java &quot;21&quot; 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.33</h2>
<p><strong>2026-05-27 Release of logback version 1.5.33</strong></p>
<p>• <code>PropertiesConfiguratorModelHandler</code> now registers
properties file URLs to the <code>ConfigurationWatchList</code> when
scan is enabled (via local scan=&quot;true&quot; attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in <a
href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p>
<p>• When processing <code>&lt;conversionRule&gt;</code> elements and
both <code>class</code> and <code>converterClass</code> attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in <a
href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p>
<p>• <code>HardenedModelInputStream</code> will no longer accept to
deserialize all classes located under the &quot;java.lang&quot; and
&quot;java.util&quot; packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by <a
href="https://github.com/york-shen">York Shen</a> and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p>
<p>• SSL parameters for <code>SSLSocketAppender</code> now enable
hostname verification by default. Moreover, the default protocol is now
&quot;TLSv1.2&quot;. This potential vulnerability was reported by York
Shen.</p>
<p>• When printing the status message field,
<code>ViewStatusMessagesServletBase</code> now escapes special
characters such as &quot;&amp;&quot; as character entities. This
potential vulnerability was reported by York Shen.</p>
<p>• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe"><code>e62272a</code></a>
prepare release 1.5.34</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341"><code>1e9e926</code></a>
add resolveProxyClassRejectsDynamicProxies unit test</li>
<li><a
href="https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f"><code>2de5cbe</code></a>
added StackTraceElementProxyTest, minor edits to AGENTS.md</li>
<li><a
href="https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e"><code>0e9b927</code></a>
in case StackTraceElement is null use a substitute, fixing
issues/1040</li>
<li><a
href="https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818"><code>f7a0654</code></a>
prevent resolveProxyClass bypass</li>
<li><a
href="https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0"><code>249b81f</code></a>
docs are no longer distributed</li>
<li><a
href="https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8"><code>1c3b26a</code></a>
start work on 1.5.34-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647"><code>124e8b4</code></a>
prepare release 1.5.33</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3"><code>d8fd6f2</code></a>
escapeTags in message field when printing status messages</li>
<li><a
href="https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4"><code>95edbeb</code></a>
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 6a97ac4620..231720eb44 100644
--- a/pom.xml
+++ b/pom.xml
@@ -113,7 +113,7 @@ under the License.
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
     <checker.framework.version>4.2.0</checker.framework.version>
-    <logback.version>1.5.32</logback.version>
+    <logback.version>1.5.34</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>
     <!-- List of add-opens arg line arguments for tests -->

From 8ce39730fe969b41c8620b02f3fa77c974d90784 Mon Sep 17 00:00:00 2001
From: Jordan Epstein <32082339+jordepic@users.noreply.github.com>
Date: Thu, 2 Jul 2026 18:16:18 -0500
Subject: [PATCH 13/28] GH-1179: Correct the size of var-width vector with >0
 start offset during vector append (#1180)

## What's Changed

Fix VectorAppender data size computation for variable-width vectors with
non-zero start offsets

When appending a variable width offset vector in DataFusion comet I was
receiving exceptions
due to allocating too much memory. This is because Comet passes variable
width arrays back
to Java where the initial offset vector entry is greater than 0. Prior
to this change, arrow-java
determines how many bytes to copy by just looking at the last offset
entry in the buffer,
completely disregarding the value of the first. If first = 100 and last
= 200, Java will still
copy 200 bytes instead of 100. In this change we fix that.

Closes #1179

---------

Co-authored-by: Jordan Epstein <jordan.epstein@imc.com>
---
 .../arrow/vector/util/VectorAppender.java     |  92 ++++++---
 .../arrow/vector/util/TestVectorAppender.java | 189 ++++++++++++++++++
 2 files changed, 257 insertions(+), 24 deletions(-)

diff --git a/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java b/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
index e7c0d11cb9..2cfeb0a04d 100644
--- a/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
+++ b/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
@@ -125,10 +125,15 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
         targetVector
             .getOffsetBuffer()
             .getInt((long) targetVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
+    // The delta vector's offset buffer need not start at zero (e.g. a vector imported through
+    // the C data interface from a sliced array), so the amount of data to append is the
+    // distance between its first and last offsets, not the last offset itself.
+    int deltaDataStart = deltaVector.getOffsetBuffer().getInt(0);
     int deltaDataSize =
         deltaVector
-            .getOffsetBuffer()
-            .getInt((long) deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
+                .getOffsetBuffer()
+                .getInt((long) deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH)
+            - deltaDataStart;
     int newValueCapacity = targetDataSize + deltaDataSize;
 
     // make sure there is enough capacity
@@ -149,7 +154,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
 
     // append data buffer
     MemoryUtil.copyMemory(
-        deltaVector.getDataBuffer().memoryAddress(),
+        deltaVector.getDataBuffer().memoryAddress() + deltaDataStart,
         targetVector.getDataBuffer().memoryAddress() + targetDataSize,
         deltaDataSize);
 
@@ -160,7 +165,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
             + (targetVector.getValueCount() + 1) * BaseVariableWidthVector.OFFSET_WIDTH,
         deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
 
-    // increase each offset from the second buffer
+    // rebase each appended offset to the target's data, accounting for the delta's start offset
     for (int i = 0; i < deltaVector.getValueCount(); i++) {
       int oldOffset =
           targetVector
@@ -172,7 +177,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
           .getOffsetBuffer()
           .setInt(
               (long) (targetVector.getValueCount() + 1 + i) * BaseVariableWidthVector.OFFSET_WIDTH,
-              oldOffset + targetDataSize);
+              oldOffset - deltaDataStart + targetDataSize);
     }
     ((BaseVariableWidthVector) targetVector).setLastSet(newValueCount - 1);
     targetVector.setValueCount(newValueCount);
@@ -196,11 +201,15 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
             .getOffsetBuffer()
             .getLong(
                 (long) targetVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
+    // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+    // offset buffer need not start at zero
+    long deltaDataStart = deltaVector.getOffsetBuffer().getLong(0);
     long deltaDataSize =
         deltaVector
-            .getOffsetBuffer()
-            .getLong(
-                (long) deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
+                .getOffsetBuffer()
+                .getLong(
+                    (long) deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH)
+            - deltaDataStart;
     long newValueCapacity = targetDataSize + deltaDataSize;
 
     // make sure there is enough capacity
@@ -221,7 +230,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
 
     // append data buffer
     MemoryUtil.copyMemory(
-        deltaVector.getDataBuffer().memoryAddress(),
+        deltaVector.getDataBuffer().memoryAddress() + deltaDataStart,
         targetVector.getDataBuffer().memoryAddress() + targetDataSize,
         deltaDataSize);
 
@@ -232,7 +241,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
             + (targetVector.getValueCount() + 1) * BaseLargeVariableWidthVector.OFFSET_WIDTH,
         deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
 
-    // increase each offset from the second buffer
+    // rebase each appended offset to the target's data, accounting for the delta's start offset
     for (int i = 0; i < deltaVector.getValueCount(); i++) {
       long oldOffset =
           targetVector
@@ -245,7 +254,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
           .setLong(
               (long) (targetVector.getValueCount() + 1 + i)
                   * BaseLargeVariableWidthVector.OFFSET_WIDTH,
-              oldOffset + targetDataSize);
+              oldOffset - deltaDataStart + targetDataSize);
     }
     ((BaseLargeVariableWidthVector) targetVector).setLastSet(newValueCount - 1);
     targetVector.setValueCount(newValueCount);
@@ -331,16 +340,20 @@ public ValueVector visit(ListVector deltaVector, Void value) {
         targetVector
             .getOffsetBuffer()
             .getInt((long) targetVector.getValueCount() * ListVector.OFFSET_WIDTH);
-    int deltaListSize =
+    // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+    // offset buffer need not start at zero
+    int deltaListStart = deltaVector.getOffsetBuffer().getInt(0);
+    int deltaListEnd =
         deltaVector
             .getOffsetBuffer()
             .getInt((long) deltaVector.getValueCount() * ListVector.OFFSET_WIDTH);
+    int deltaListSize = deltaListEnd - deltaListStart;
 
     ListVector targetListVector = (ListVector) targetVector;
 
     // make sure the underlying vector has value count set
     targetListVector.getDataVector().setValueCount(targetListSize);
-    deltaVector.getDataVector().setValueCount(deltaListSize);
+    deltaVector.getDataVector().setValueCount(deltaListEnd);
 
     // make sure there is enough capacity
     while (targetVector.getValueCapacity() < newValueCount) {
@@ -372,13 +385,16 @@ public ValueVector visit(ListVector deltaVector, Void value) {
           .getOffsetBuffer()
           .setInt(
               (long) (targetVector.getValueCount() + 1 + i) * ListVector.OFFSET_WIDTH,
-              oldOffset + targetListSize);
+              oldOffset - deltaListStart + targetListSize);
     }
     targetListVector.setLastSet(newValueCount - 1);
 
     // append underlying vectors
-    VectorAppender innerAppender = new VectorAppender(targetListVector.getDataVector());
-    deltaVector.getDataVector().accept(innerAppender, null);
+    appendDataVector(
+        targetListVector.getDataVector(),
+        deltaVector.getDataVector(),
+        deltaListStart,
+        deltaListSize);
 
     targetVector.setValueCount(newValueCount);
     return targetVector;
@@ -400,17 +416,21 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
         targetVector
             .getOffsetBuffer()
             .getLong((long) targetVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
-    long deltaListSize =
+    // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+    // offset buffer need not start at zero
+    long deltaListStart = deltaVector.getOffsetBuffer().getLong(0);
+    long deltaListEnd =
         deltaVector
             .getOffsetBuffer()
             .getLong((long) deltaVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
+    long deltaListSize = deltaListEnd - deltaListStart;
 
-    ListVector targetListVector = (ListVector) targetVector;
+    LargeListVector targetListVector = (LargeListVector) targetVector;
 
     // make sure the underlying vector has value count set
     // todo recheck these casts when int64 vectors are supported
     targetListVector.getDataVector().setValueCount(checkedCastToInt(targetListSize));
-    deltaVector.getDataVector().setValueCount(checkedCastToInt(deltaListSize));
+    deltaVector.getDataVector().setValueCount(checkedCastToInt(deltaListEnd));
 
     // make sure there is enough capacity
     while (targetVector.getValueCapacity() < newValueCount) {
@@ -427,10 +447,10 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
 
     // append offset buffer
     MemoryUtil.copyMemory(
-        deltaVector.getOffsetBuffer().memoryAddress() + ListVector.OFFSET_WIDTH,
+        deltaVector.getOffsetBuffer().memoryAddress() + LargeListVector.OFFSET_WIDTH,
         targetVector.getOffsetBuffer().memoryAddress()
             + (targetVector.getValueCount() + 1) * LargeListVector.OFFSET_WIDTH,
-        (long) deltaVector.getValueCount() * ListVector.OFFSET_WIDTH);
+        (long) deltaVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
 
     // increase each offset from the second buffer
     for (int i = 0; i < deltaVector.getValueCount(); i++) {
@@ -443,18 +463,42 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
           .getOffsetBuffer()
           .setLong(
               (long) (targetVector.getValueCount() + 1 + i) * LargeListVector.OFFSET_WIDTH,
-              oldOffset + targetListSize);
+              oldOffset - deltaListStart + targetListSize);
     }
     targetListVector.setLastSet(newValueCount - 1);
 
     // append underlying vectors
-    VectorAppender innerAppender = new VectorAppender(targetListVector.getDataVector());
-    deltaVector.getDataVector().accept(innerAppender, null);
+    appendDataVector(
+        targetListVector.getDataVector(),
+        deltaVector.getDataVector(),
+        checkedCastToInt(deltaListStart),
+        checkedCastToInt(deltaListSize));
 
     targetVector.setValueCount(newValueCount);
     return targetVector;
   }
 
+  /**
+   * Appends the range [start, start + length) of the delta vector's data vector to the target
+   * vector's data vector. The range may not cover the whole delta data vector when the delta's
+   * offset buffer does not start at zero.
+   */
+  private static void appendDataVector(
+      ValueVector targetDataVector, ValueVector deltaDataVector, int start, int length) {
+    if (start == 0 && length == deltaDataVector.getValueCount()) {
+      VectorAppender innerAppender = new VectorAppender(targetDataVector);
+      deltaDataVector.accept(innerAppender, null);
+      return;
+    }
+    TransferPair transferPair =
+        deltaDataVector.getTransferPair(deltaDataVector.getField(), deltaDataVector.getAllocator());
+    transferPair.splitAndTransfer(start, length);
+    try (ValueVector slicedDeltaDataVector = transferPair.getTo()) {
+      VectorAppender innerAppender = new VectorAppender(targetDataVector);
+      slicedDeltaDataVector.accept(innerAppender, null);
+    }
+  }
+
   @Override
   public ValueVector visit(FixedSizeListVector deltaVector, Void value) {
     Preconditions.checkArgument(
diff --git a/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java b/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
index df5521a1ad..9a8143f51b 100644
--- a/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
+++ b/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
@@ -26,10 +26,13 @@
 import java.util.List;
 import java.util.stream.IntStream;
 import java.util.stream.Stream;
+import org.apache.arrow.memory.ArrowBuf;
 import org.apache.arrow.memory.BufferAllocator;
 import org.apache.arrow.memory.RootAllocator;
 import org.apache.arrow.memory.util.CommonUtil;
+import org.apache.arrow.vector.BaseLargeVariableWidthVector;
 import org.apache.arrow.vector.BaseValueVector;
+import org.apache.arrow.vector.BaseVariableWidthVector;
 import org.apache.arrow.vector.BaseVariableWidthViewVector;
 import org.apache.arrow.vector.BigIntVector;
 import org.apache.arrow.vector.BitVector;
@@ -53,6 +56,7 @@
 import org.apache.arrow.vector.holders.NullableBigIntHolder;
 import org.apache.arrow.vector.holders.NullableFloat4Holder;
 import org.apache.arrow.vector.holders.NullableIntHolder;
+import org.apache.arrow.vector.ipc.message.ArrowFieldNode;
 import org.apache.arrow.vector.testing.ValueVectorDataPopulator;
 import org.apache.arrow.vector.types.Types;
 import org.apache.arrow.vector.types.pojo.ArrowType;
@@ -178,6 +182,82 @@ public void testAppendVariableWidthVector() {
     }
   }
 
+  @Test
+  public void testAppendVariableWidthVectorWithNonZeroStartOffset() {
+    try (VarCharVector target = new VarCharVector("", allocator);
+        VarCharVector delta = new VarCharVector("", allocator)) {
+
+      target.allocateNew(64, 4);
+      ValueVectorDataPopulator.setVector(target, "a0", "a1");
+
+      // Build a delta vector whose offset buffer does not start at zero, as produced e.g. by
+      // importing a sliced array through the C data interface. The values are "BBBB" and
+      // "CCCC"; the data buffer additionally holds 4 bytes of unreferenced prefix ("AAAA").
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(12);
+          ArrowBuf data = allocator.buffer(12)) {
+        validity.setByte(0, 0b11);
+        offsets.setInt(0, 4);
+        offsets.setInt(4, 8);
+        offsets.setInt(8, 12);
+        data.setBytes(0, "AAAABBBBCCCC".getBytes(StandardCharsets.UTF_8));
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets, data));
+      }
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      // the unreferenced prefix must not be appended
+      assertEquals(
+          4 + 8,
+          target
+              .getOffsetBuffer()
+              .getInt((long) target.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH));
+
+      try (VarCharVector expected = new VarCharVector("expected", allocator)) {
+        expected.allocateNew();
+        ValueVectorDataPopulator.setVector(expected, "a0", "a1", "BBBB", "CCCC");
+        assertVectorsEqual(expected, target);
+      }
+    }
+  }
+
+  @Test
+  public void testAppendLargeVariableWidthVectorWithNonZeroStartOffset() {
+    try (LargeVarCharVector target = new LargeVarCharVector("", allocator);
+        LargeVarCharVector delta = new LargeVarCharVector("", allocator)) {
+
+      target.allocateNew(64, 4);
+      ValueVectorDataPopulator.setVector(target, "a0", "a1");
+
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(24);
+          ArrowBuf data = allocator.buffer(12)) {
+        validity.setByte(0, 0b11);
+        offsets.setLong(0, 4);
+        offsets.setLong(8, 8);
+        offsets.setLong(16, 12);
+        data.setBytes(0, "AAAABBBBCCCC".getBytes(StandardCharsets.UTF_8));
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets, data));
+      }
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(
+          4 + 8,
+          target
+              .getOffsetBuffer()
+              .getLong((long) target.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH));
+
+      try (LargeVarCharVector expected = new LargeVarCharVector("expected", allocator)) {
+        expected.allocateNew();
+        ValueVectorDataPopulator.setVector(expected, "a0", "a1", "BBBB", "CCCC");
+        assertVectorsEqual(expected, target);
+      }
+    }
+  }
+
   @Test
   public void testAppendVariableWidthViewVector() {
     final int length1 = 10;
@@ -431,6 +511,115 @@ public void testAppendListVector() {
     }
   }
 
+  @Test
+  public void testAppendListVectorWithNonZeroStartOffset() {
+    try (ListVector target = ListVector.empty("target", allocator);
+        ListVector delta = ListVector.empty("delta", allocator)) {
+
+      target.allocateNew();
+      ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), Arrays.asList(2, 3));
+
+      // Build a delta vector whose offset buffer does not start at zero, as produced e.g. by
+      // importing a sliced array through the C data interface: lists [10, 11] and [12, 13],
+      // with one unreferenced prefix element (9) in the data vector.
+      delta.addOrGetVector(FieldType.nullable(Types.MinorType.INT.getType()));
+      IntVector deltaDataVector = (IntVector) delta.getDataVector();
+      deltaDataVector.allocateNew(5);
+      for (int i = 0; i < 5; i++) {
+        deltaDataVector.set(i, 9 + i);
+      }
+      deltaDataVector.setValueCount(5);
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(12)) {
+        validity.setByte(0, 0b11);
+        offsets.setInt(0, 1);
+        offsets.setInt(4, 3);
+        offsets.setInt(8, 5);
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets));
+      }
+      assertEquals(Arrays.asList(10, 11), delta.getObject(0));
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(4, target.getValueCount());
+      // the unreferenced prefix element must not be appended
+      assertEquals(
+          4 + 4,
+          target.getOffsetBuffer().getInt((long) target.getValueCount() * ListVector.OFFSET_WIDTH));
+      assertEquals(Arrays.asList(0, 1), target.getObject(0));
+      assertEquals(Arrays.asList(2, 3), target.getObject(1));
+      assertEquals(Arrays.asList(10, 11), target.getObject(2));
+      assertEquals(Arrays.asList(12, 13), target.getObject(3));
+    }
+  }
+
+  @Test
+  public void testAppendLargeListVector() {
+    try (LargeListVector target = LargeListVector.empty("target", allocator);
+        LargeListVector delta = LargeListVector.empty("delta", allocator)) {
+
+      target.allocateNew();
+      ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), null, Arrays.asList(4, 5));
+
+      delta.allocateNew();
+      ValueVectorDataPopulator.setVector(delta, Arrays.asList(10, 11, 12), Arrays.asList(13, 14));
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(5, target.getValueCount());
+      assertEquals(Arrays.asList(0, 1), target.getObject(0));
+      assertTrue(target.isNull(1));
+      assertEquals(Arrays.asList(4, 5), target.getObject(2));
+      assertEquals(Arrays.asList(10, 11, 12), target.getObject(3));
+      assertEquals(Arrays.asList(13, 14), target.getObject(4));
+    }
+  }
+
+  @Test
+  public void testAppendLargeListVectorWithNonZeroStartOffset() {
+    try (LargeListVector target = LargeListVector.empty("target", allocator);
+        LargeListVector delta = LargeListVector.empty("delta", allocator)) {
+
+      target.allocateNew();
+      ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), Arrays.asList(2, 3));
+
+      // same as testAppendListVectorWithNonZeroStartOffset, with 8-byte offsets
+      delta.addOrGetVector(FieldType.nullable(Types.MinorType.INT.getType()));
+      IntVector deltaDataVector = (IntVector) delta.getDataVector();
+      deltaDataVector.allocateNew(5);
+      for (int i = 0; i < 5; i++) {
+        deltaDataVector.set(i, 9 + i);
+      }
+      deltaDataVector.setValueCount(5);
+      try (ArrowBuf validity = allocator.buffer(1);
+          ArrowBuf offsets = allocator.buffer(24)) {
+        validity.setByte(0, 0b11);
+        offsets.setLong(0, 1);
+        offsets.setLong(8, 3);
+        offsets.setLong(16, 5);
+        delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets));
+      }
+      assertEquals(Arrays.asList(10, 11), delta.getObject(0));
+
+      VectorAppender appender = new VectorAppender(target);
+      delta.accept(appender, null);
+
+      assertEquals(4, target.getValueCount());
+      // the unreferenced prefix element must not be appended
+      assertEquals(
+          4 + 4,
+          target
+              .getOffsetBuffer()
+              .getLong((long) target.getValueCount() * LargeListVector.OFFSET_WIDTH));
+      assertEquals(Arrays.asList(0, 1), target.getObject(0));
+      assertEquals(Arrays.asList(2, 3), target.getObject(1));
+      assertEquals(Arrays.asList(10, 11), target.getObject(2));
+      assertEquals(Arrays.asList(12, 13), target.getObject(3));
+    }
+  }
+
   @Test
   public void testAppendEmptyListVector() {
     try (ListVector target = ListVector.empty("target", allocator);

From 9e863319b1e3bedda45dbb12d5989f6b1330f664 Mon Sep 17 00:00:00 2001
From: Abdul Rawoof Khan <abdulr@bugqore.com>
Date: Mon, 6 Jul 2026 06:39:33 +0530
Subject: [PATCH 14/28] GH-1206: validate decompressed length in
 Lz4CompressionCodec (#1207)

## What's Changed

`Lz4CompressionCodec.doDecompress` sizes the output buffer to the bytes
it actually decompressed, but sets `writerIndex` to the length taken
from the untrusted 8-byte prefix. A buffer whose prefix claims more than
the real output leaves the returned `ArrowBuf` with a `writerIndex` past
its capacity, and consumers then read off-heap memory beyond the
allocation. This adds the actual-vs-claimed length check the ZSTD codec
already does, so a mismatch throws instead of producing an over-long
buffer.

Closes #1206.
---
 .../compression/Lz4CompressionCodec.java      |  7 ++++++
 .../compression/TestCompressionCodec.java     | 22 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java b/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
index 91cefc2a9e..f268e815fe 100644
--- a/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
+++ b/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
@@ -80,6 +80,13 @@ protected ArrowBuf doDecompress(BufferAllocator allocator, ArrowBuf compressedBu
     }
 
     byte[] outBytes = out.toByteArray();
+    if (outBytes.length != decompressedLength) {
+      throw new RuntimeException(
+          "Expected != actual decompressed length: "
+              + decompressedLength
+              + " != "
+              + outBytes.length);
+    }
     ArrowBuf decompressedBuffer = allocator.buffer(outBytes.length);
     decompressedBuffer.setBytes(/* index= */ 0, outBytes);
     decompressedBuffer.writerIndex(decompressedLength);
diff --git a/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java b/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
index b8fb4e28b9..d2d2921649 100644
--- a/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
+++ b/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
@@ -20,6 +20,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.ByteArrayOutputStream;
@@ -59,6 +60,7 @@
 import org.apache.arrow.vector.util.ByteArrayReadableSeekableByteChannel;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
@@ -231,6 +233,26 @@ void testEmptyBuffer(int vectorLength, CompressionCodec codec) throws Exception
     AutoCloseables.close(decompressedBuffers);
   }
 
+  @Test
+  void testLz4DecompressRejectsWrongLength() {
+    byte[] data = new byte[512]; // all zeros, highly compressible
+    ArrowBuf orig = allocator.buffer(data.length);
+    orig.setBytes(0, data);
+    orig.writerIndex(data.length);
+
+    CompressionCodec codec = new Lz4CompressionCodec();
+    ArrowBuf compressed = codec.compress(allocator, orig);
+
+    // tamper with the 8-byte uncompressed-length prefix so it no longer matches
+    // the real decompressed size
+    compressed.setLong(0, 1_000_000L);
+
+    RuntimeException e =
+        assertThrows(RuntimeException.class, () -> codec.decompress(allocator, compressed));
+    assertTrue(e.getMessage().contains("decompressed length"));
+    compressed.close();
+  }
+
   private static Stream<CompressionUtil.CodecType> codecTypes() {
     return Arrays.stream(CompressionUtil.CodecType.values());
   }

From c7e8e75c9978c60234dbcbd31311ac3ee2975fa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Pupier?= <apupier@ibm.com>
Date: Mon, 6 Jul 2026 08:50:26 +0200
Subject: [PATCH 15/28] MINOR: Restrict trigger push branch for GitHub Workflow
 (#1204)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Feature branches rarely need their own CI runs: the code is already
tested when a pull request is opened against a release branch. If the
push trigger has no branch restriction and pull_request is also
configured, every push to a branch with an open PR runs the workflow
twice: once for the push and once for the PR synchronisation.

Always give the push trigger an explicit list of branches: this stops
branches created from a release branch from inheriting its workflow
runs.

see
https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=430408443#GitHubActionsRecommendedPractices-Restrictthepushtriggertospecificbranches

## What's Changed

Please fill in a description of the changes here.

**This contains breaking changes.** <!-- Remove this line if there are
no breaking changes. -->

Closes #NNN.

Note that I needed to recreate a PR as the previous one was closed
https://github.com/apache/arrow-java/pull/1202#issuecomment-4864548916

Signed-off-by: Aurélien Pupier <apupier@ibm.com>
---
 .github/workflows/dev.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 25b08700fd..7c590c749a 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -19,7 +19,9 @@ name: Dev
 
 on:
   pull_request: {}
-  push: {}
+  push:
+    branches-ignore:
+      - dependabot/**
 
 concurrency:
   group: ${{ github.repository }}-${{ github.ref }}-${{ github.workflow }}

From 9e100a3b7f681a64f11eb4405e9e43431caf3647 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:21:40 +0200
Subject: [PATCH 16/28] MINOR: Bump com.squareup.okhttp3:mockwebserver3 from
 5.3.2 to 5.4.0 (#1215)

Bumps
[com.squareup.okhttp3:mockwebserver3](https://github.com/square/okhttp)
from 5.3.2 to 5.4.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:mockwebserver3's
changelog</a>.</em></p>
<blockquote>
<h2>Version 5.4.0</h2>
<p><em>2026-06-08</em></p>
<ul>
<li>New: Add superpowers to interceptors. Interceptors can now override
anything settable on
<code>OkHttpClient.Builder</code>, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom <code>Call.Factory</code> wrappers.</li>
<li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li>
<li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
<code>okhttp-coroutines</code> artifact.</li>
<li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li>
<li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a>
Prepare for release 5.4.0.</li>
<li><a
href="https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a>
Update eclipse.osgi to v3.24.200 (<a
href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a>
Update bnd to v7.3.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a>
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a>
Update dependency macos to v26 (<a
href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a>
Update shadow.plugin to v9.4.2 (<a
href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a>
Update spotless.plugin to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a>
Update plugin com.diffplug.spotless to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a>
Update spotless.plugin to v8.5.1 (<a
href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a>
Apply gradle lint correctly (<a
href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.squareup.okhttp3:mockwebserver3&package-manager=maven&previous-version=5.3.2&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 9a8406cf31..e25d8438af 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -123,7 +123,7 @@ under the License.
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>mockwebserver3</artifactId>
-      <version>5.3.2</version>
+      <version>5.4.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From e087824935d283d3636d8edb908a79df2de217c4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:25:41 +0200
Subject: [PATCH 17/28] MINOR: Bump com.diffplug.spotless:spotless-maven-plugin
 from 3.6.0 to 3.8.0 (#1214)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 3.6.0 to 3.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/diffplug/spotless/releases">com.diffplug.spotless:spotless-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>Maven Plugin v3.8.0</h2>
<h3>Added</h3>
<ul>
<li>Add support for custom string format for license header copyright
year via <code>yearStringFormat()</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2965">#2965</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>&lt;expandWildcardImports&gt;</code> no longer triggers a full
transitive dependency resolution on every build. Dependency resolution
is now deferred until the step actually runs, so projects that do not
use <code>&lt;expandWildcardImports&gt;</code> (or that use version
ranges) are no longer penalized. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2983">#2983</a>)</li>
</ul>
<h2>Maven Plugin v3.7.0</h2>
<h3>Fixed</h3>
<ul>
<li>Parse standard git year output in LicenseHeaderStep. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2940">#2940</a>)</li>
<li><code>&lt;toggleOffOn&gt;</code> no longer disables lint-only steps
such as <code>&lt;forbidWildcardImports&gt;</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2962">#2962</a>)</li>
<li>Fix <code>StringIndexOutOfBoundsException</code> in scenarios where
copyright year is surrounded by whitespace. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2973">#2973</a>)</li>
</ul>
<h3>Added</h3>
<ul>
<li>Add support for AsciiDoc formatting via <code>adocfmt</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2960">#2960</a>)</li>
<li><code>&lt;flexmark&gt;</code> step now supports arbitrary formatter
options via <code>&lt;formatterOptions&gt;</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2968">#2968</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/diffplug/spotless/blob/main/CHANGES.md">com.diffplug.spotless:spotless-maven-plugin's
changelog</a>.</em></p>
<blockquote>
<h1>spotless-lib and spotless-lib-extra releases</h1>
<p>If you are a Spotless user (as opposed to developer), then you are
probably looking for:</p>
<ul>
<li><a
href="https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md">https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md</a></li>
<li><a
href="https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md">https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md</a></li>
</ul>
<p>This document is intended for Spotless developers.</p>
<p>We adhere to the <a
href="https://keepachangelog.com/en/1.0.0/">keepachangelog</a> format
(starting after version <code>1.27.0</code>).</p>
<h2>[Unreleased]</h2>
<h2>[4.8.0] - 2026-06-29</h2>
<h3>Added</h3>
<ul>
<li>Add support for custom string format for license header copyright
year via <code>yearStringFormat()</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2965">#2965</a>)</li>
</ul>
<h2>[4.7.0] - 2026-06-16</h2>
<h3>Added</h3>
<ul>
<li>Add support for AsciiDoc formatting via <code>adocfmt</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2960">#2960</a>)</li>
<li><code>flexmark</code> step now supports arbitrary formatter options
via a <code>formatterOptions</code> map. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2968">#2968</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>FenceStep.preserveWithin</code> now forwards lints from nested
steps while still suppressing lints inside preserved blocks. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2962">#2962</a>)</li>
<li>Support <code>ktfmt</code> 0.63 and use its new builder API for
formatting options to better avoid future breaking changes.</li>
<li>Parse standard git year output in LicenseHeaderStep. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2940">#2940</a>)</li>
<li>Fix <code>StringIndexOutOfBoundsException</code> in scenarios where
copyright year is surrounded by whitespace. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2973">#2973</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Bump default <code>greclipse</code> version to latest
<code>4.35</code> -&gt; <code>4.39</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2924">#2924</a>)</li>
</ul>
<h2>[4.6.2] - 2026-05-27</h2>
<h3>Fixed</h3>
<ul>
<li><code>P2Provisioner</code> now passes cache directory overrides
directly to Solstice. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2944">#2944</a>)</li>
<li><code>forbidWildcardImports</code> and
<code>forbidModuleImports</code> now detect imports that have leading
whitespace (indentation/tabs). (<a
href="https://redirect.github.com/diffplug/spotless/pull/2939">#2939</a>)</li>
<li><code>versionCatalog</code> step no longer splits long inline tables
across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line
inline tables. The <code>maxLineLength</code> option has been removed.
(<a
href="https://redirect.github.com/diffplug/spotless/issues/2948">#2948</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li><code>EclipseJdtFormtterStep</code> now can conditionally set
compiler source/compliance options. Allows for better parsing of AST
Node for newer language features and more correct sorting; e.g. records
or seal classes. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2942">#2942</a>)</li>
<li><code>Formatter</code> no longer recomputes line-ending
normalization (<code>LineEnding.toUnix</code>) a second time for every
formatter step that changes content, removing redundant O(n) work from
the core formatting loop. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2934">#2934</a>)</li>
<li>expandWildcardImports support pom type dependency. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2839">#2839</a>)</li>
</ul>
<h2>[4.6.1] - 2026-05-15</h2>
<h3>Fixed</h3>
<ul>
<li><code>LicenseHeaderStep</code> in <code>SET_FROM_GIT</code> year
mode no longer invokes <code>git log</code> through <code>bash -c</code>
/ <code>cmd /c</code>, eliminating a shell-injection vector when
processing repositories that contain files whose names include shell
metacharacters.</li>
</ul>
<h2>[4.6.0] - 2026-05-14</h2>
<h3>Added</h3>
<ul>
<li><code>scalafmt()</code> now reads the version from the
<code>version</code> field in the scalafmt config file when no version
is explicitly set in the plugin config, falling back to the built-in
default only if neither is available. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2922">#2922</a>)</li>
<li>Add <code>versionCatalog</code> step for formatting and sorting
Gradle version catalog (<code>.toml</code>) files. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2916">#2916</a>)</li>
<li>Add <code>javaparserVersion</code> option to the Cleanthat step,
allowing callers to override the JavaParser version pulled in
transitively by Cleanthat. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2903">#2903</a>)</li>
</ul>
<h3>Fixed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/diffplug/spotless/commit/03d43ba2cdc81050e07b62646c08b22e39505368"><code>03d43ba</code></a>
Published maven/3.8.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/8b80c1388017f9b390fd9681007ba58a8c5d77f7"><code>8b80c13</code></a>
Published gradle/8.8.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/8ee6cf904ae77a4baec287132c69a63d4b5f4052"><code>8ee6cf9</code></a>
Published lib/4.8.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/6c02c0bf3fa0914206b28b2e9abec5e2061273e4"><code>6c02c0b</code></a>
Add missing changelog entry.</li>
<li><a
href="https://github.com/diffplug/spotless/commit/264f4cc904ad85149a90822c0835c17a615cee8e"><code>264f4cc</code></a>
Add regression test for forbidWildcardImports inside toggleOffOn (<a
href="https://redirect.github.com/diffplug/spotless/issues/2982">#2982</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/6abb06449354899642d716dfb3daf67a888bac9b"><code>6abb064</code></a>
fix <a
href="https://redirect.github.com/diffplug/spotless/issues/2983">#2983</a>,
expandWildcardImports triggers a full transitive reso… (<a
href="https://redirect.github.com/diffplug/spotless/issues/2984">#2984</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/f4536d41caebdda8201cdb126832ea96a75e5afe"><code>f4536d4</code></a>
Update plugin spotbugs to v6.5.8 (<a
href="https://redirect.github.com/diffplug/spotless/issues/2987">#2987</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/873454acbc24dd66a0d334f29b30d5dcb645cd0a"><code>873454a</code></a>
Update plugin spotbugs to v6.5.8</li>
<li><a
href="https://github.com/diffplug/spotless/commit/000b8a8f9f0398f60aeafee4d2fbd90a6a61b7f1"><code>000b8a8</code></a>
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (<a
href="https://redirect.github.com/diffplug/spotless/issues/2985">#2985</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/84ebcab6a588c0ae7ddb8d883f5f60947e488e0a"><code>84ebcab</code></a>
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1</li>
<li>Additional commits viewable in <a
href="https://github.com/diffplug/spotless/compare/maven/3.6.0...maven/3.8.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.diffplug.spotless:spotless-maven-plugin&package-manager=maven&previous-version=3.6.0&new-version=3.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 bom/pom.xml | 2 +-
 pom.xml     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 3201761e81..2d1085b160 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -208,7 +208,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>3.6.0</version>
+          <version>3.8.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
diff --git a/pom.xml b/pom.xml
index 231720eb44..017e3acb81 100644
--- a/pom.xml
+++ b/pom.xml
@@ -492,7 +492,7 @@ under the License.
         <plugin>
           <groupId>com.diffplug.spotless</groupId>
           <artifactId>spotless-maven-plugin</artifactId>
-          <version>3.6.0</version>
+          <version>3.8.0</version>
         </plugin>
         <plugin>
           <groupId>org.codehaus.mojo</groupId>

From 1801a8a0937fb4aaac3654c66ec9109a6892666c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:28:19 +0200
Subject: [PATCH 18/28] MINOR: Bump
 com.gradle:common-custom-user-data-maven-extension from 2.2.0 to 2.3.0
 (#1213)

Bumps
[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)
from 2.2.0 to 2.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/common-custom-user-data-maven-extension/releases">com.gradle:common-custom-user-data-maven-extension's
releases</a>.</em></p>
<blockquote>
<h2>2.3.0</h2>
<ul>
<li>[NEW] Capture Cursor as an AI agent via the
<code>CURSOR_AGENT</code> environment variable</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/61a5a45a57981e2dd66b67b9fbc4fde626a02e02"><code>61a5a45</code></a>
[maven-release-plugin] prepare release v2.3.0</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/398a231a48153a893b36e282ab72a8fa8c979161"><code>398a231</code></a>
[Renovate Bot] Update actions/setup-java digest to 1bcf9fb (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/389">#389</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/f66a5c678feaf0292a70b96466abc5d437a3993a"><code>f66a5c6</code></a>
Merge pull request <a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/391">#391</a>
from gradle/erichaagdev/capture-cursor-ai-agent</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/8311f5845f801278c52094b38ecb2e3e97052420"><code>8311f58</code></a>
Capture Cursor as an AI agent</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/0236fc861cfb0391b8bb6b5abfc4c7c5ca834cc0"><code>0236fc8</code></a>
[Renovate Bot] Update dependency
org.eclipse.sisu:org.eclipse.sisu.inject to ...</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/0d8c2c5201316f4747ff8eaa038d47ac465a54d9"><code>0d8c2c5</code></a>
[Renovate Bot] Update GitHub Actions to v7 (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/386">#386</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/21ef159386fce25b750914e21c879496f7c01e7a"><code>21ef159</code></a>
[Renovate Bot] Update Maven dependencies (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/387">#387</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/d9240f0c0626d1bb0b0ef5341186fb342e48f7db"><code>d9240f0</code></a>
[Renovate Bot] Update Maven dependencies to v0.11.0 (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/384">#384</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/83935cce4e8aaab79a246cb1e27a14cc974ad64f"><code>83935cc</code></a>
Auto-merge GitHub Actions digest re-pins (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/385">#385</a>)</li>
<li><a
href="https://github.com/gradle/common-custom-user-data-maven-extension/commit/9d03ae646b229aaaf652be3e52eccdc579ef8a06"><code>9d03ae6</code></a>
[Renovate Bot] Update GitHub Actions to ad2b381 (<a
href="https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/383">#383</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/common-custom-user-data-maven-extension/compare/v2.2.0...v2.3.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:common-custom-user-data-maven-extension&package-manager=maven&previous-version=2.2.0&new-version=2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .mvn/extensions.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index 38b3c807b7..eb06ecc9fb 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -28,6 +28,6 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>common-custom-user-data-maven-extension</artifactId>
-        <version>2.2.0</version>
+        <version>2.3.0</version>
     </extension>
 </extensions>

From afd688e024753c75854e707748fe5ad4411d3361 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:29:40 +0200
Subject: [PATCH 19/28] MINOR: Bump com.gradle:develocity-maven-extension from
 2.4.1 to 2.5.0 (#1212)

Bumps com.gradle:develocity-maven-extension from 2.4.1 to 2.5.0.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:develocity-maven-extension&package-manager=maven&previous-version=2.4.1&new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .mvn/extensions.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index eb06ecc9fb..74482cb2c4 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -23,7 +23,7 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>develocity-maven-extension</artifactId>
-        <version>2.4.1</version>
+        <version>2.5.0</version>
     </extension>
     <extension>
         <groupId>com.gradle</groupId>

From 59010e63bb58c702ccdbcf6f7e0fb047bf8c8f73 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:31:03 +0200
Subject: [PATCH 20/28] MINOR: Bump checker.framework.version from 4.2.0 to
 4.2.1 (#1211)

Bumps `checker.framework.version` from 4.2.0 to 4.2.1.
Updates `org.checkerframework:checker-qual` from 4.2.0 to 4.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker-qual's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.2.1</h2>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker-qual's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/ef8cecd00663136e5bb4d6d3d32f936d500f519c"><code>ef8cecd</code></a>
new release 4.2.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/5d046116bece9b5ebb359fab260c2d17988a5e41"><code>5d04611</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/0907ddc90cd25f32e5bf8922d8277d0b41de7fc2"><code>0907ddc</code></a>
Use <code>@MonotonicNonNull</code></li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6a7d71c8cbba0c3c14547d4c06ddb500d15c71d2"><code>6a7d71c</code></a>
Gradle formatting</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/c10d86a0c787c2e5ca95a2c5bb9f4c598b23504e"><code>c10d86a</code></a>
Update plugin com-gradleup-shadow to v9.4.3 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7778">#7778</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/ec79d1f81a434153c13e0fb83692119304cf2908"><code>ec79d1f</code></a>
Update Gradle to v9.6.1 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7779">#7779</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/f95a2e030e54bae2e26a5e7fa47177acceb4ef6b"><code>f95a2e0</code></a>
More examples for <code>-AresourceLeakIgnoredExceptions</code> (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7774">#7774</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/79948a2df22a82425a3a17b70b6d784c812d7d5d"><code>79948a2</code></a>
Update Gradle to v9.6.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7775">#7775</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e013552e6274b87c9f5dd1c768b4dd12a828707f"><code>e013552</code></a>
Update actions/checkout action to v7 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7776">#7776</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4ba90c265ca8ee0ad4da7ce67af275ee6c7c40e1"><code>4ba90c2</code></a>
Update plugin com-diffplug-spotless to v8.7.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7773">#7773</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.2.0...checker-framework-4.2.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `org.checkerframework:checker` from 4.2.0 to 4.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/releases">org.checkerframework:checker's
releases</a>.</em></p>
<blockquote>
<h2>Checker Framework 4.2.1</h2>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md">org.checkerframework:checker's
changelog</a>.</em></p>
<blockquote>
<h2>Version 4.2.1 (2026-07-01)</h2>
<h3>Closed issues</h3>
<p><a
href="https://redirect.github.com/typetools/checker-framework/issues/7726">#7726</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typetools/checker-framework/commit/ef8cecd00663136e5bb4d6d3d32f936d500f519c"><code>ef8cecd</code></a>
new release 4.2.1</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/5d046116bece9b5ebb359fab260c2d17988a5e41"><code>5d04611</code></a>
Prep for release.</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/0907ddc90cd25f32e5bf8922d8277d0b41de7fc2"><code>0907ddc</code></a>
Use <code>@MonotonicNonNull</code></li>
<li><a
href="https://github.com/typetools/checker-framework/commit/6a7d71c8cbba0c3c14547d4c06ddb500d15c71d2"><code>6a7d71c</code></a>
Gradle formatting</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/c10d86a0c787c2e5ca95a2c5bb9f4c598b23504e"><code>c10d86a</code></a>
Update plugin com-gradleup-shadow to v9.4.3 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7778">#7778</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/ec79d1f81a434153c13e0fb83692119304cf2908"><code>ec79d1f</code></a>
Update Gradle to v9.6.1 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7779">#7779</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/f95a2e030e54bae2e26a5e7fa47177acceb4ef6b"><code>f95a2e0</code></a>
More examples for <code>-AresourceLeakIgnoredExceptions</code> (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7774">#7774</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/79948a2df22a82425a3a17b70b6d784c812d7d5d"><code>79948a2</code></a>
Update Gradle to v9.6.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7775">#7775</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/e013552e6274b87c9f5dd1c768b4dd12a828707f"><code>e013552</code></a>
Update actions/checkout action to v7 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7776">#7776</a>)</li>
<li><a
href="https://github.com/typetools/checker-framework/commit/4ba90c265ca8ee0ad4da7ce67af275ee6c7c40e1"><code>4ba90c2</code></a>
Update plugin com-diffplug-spotless to v8.7.0 (<a
href="https://redirect.github.com/typetools/checker-framework/issues/7773">#7773</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/typetools/checker-framework/compare/checker-framework-4.2.0...checker-framework-4.2.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 017e3acb81..d9f9d59c43 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
     <checkstyle.version>10.23.0</checkstyle.version>
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
-    <checker.framework.version>4.2.0</checker.framework.version>
+    <checker.framework.version>4.2.1</checker.framework.version>
     <logback.version>1.5.34</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>

From f2594c99cc98923ad5949713d4519c5d4f24f4f6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:32:02 +0200
Subject: [PATCH 21/28] MINOR: [CI] Bump docker/login-action from 4.2.0 to
 4.4.0 (#1210)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [docker/login-action](https://github.com/docker/login-action) from
4.2.0 to 4.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.0</h2>
<ul>
<li>Skip empty <code>registry-auth</code> secret mask by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1077.0 <a
href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p>
<h2>v4.3.0</h2>
<ul>
<li>Preserve names in esbuild bundle by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1076.0 <a
href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li>
<li>Bump <code>@​sigstore/core</code> from 3.1.0 to 3.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li>
<li>Bump <code>@​sigstore/verify</code> from 3.1.0 to 3.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li>
<li>Bump js-yaml from 4.1.1 to 5.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li>
<li>Bump sigstore from 4.1.0 to 4.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li>
<li>Bump tmp from 0.2.5 to 0.2.7 in <a
href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li>
<li>Bump undici from 6.24.1 to 6.27.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li>
<li>Bump vite from 7.3.3 to 7.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a>
from crazy-max/fix-registry-auth-empty-mask</li>
<li><a
href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a>
skip empty registry-auth secret mask</li>
<li><a
href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/b249b43765525dd7951068267a34cf63f22ab4f0"><code>b249b43</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1032">#1032</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/1b67977736863551a88ff218642a2d7628b10520"><code>1b67977</code></a>
build(deps): bump docker/bake-action from 7.2.0 to 7.3.0</li>
<li><a
href="https://github.com/docker/login-action/commit/9d49d6a3234c78daa10c3c12183ef7b6caa8e69e"><code>9d49d6a</code></a>
build(deps): bump docker/bake-action/subaction/matrix</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.2.0&new-version=4.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/rc.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index fdfcd1cce3..5d2fb6683a 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
         with:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

From 915428751b8871406268aeb27bd2f055dcfba6bf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:00:46 +0200
Subject: [PATCH 22/28] MINOR: Bump logback.version from 1.5.34 to 1.5.37
 (#1209)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps `logback.version` from 1.5.34 to 1.5.37.
Updates `ch.qos.logback:logback-classic` from 1.5.34 to 1.5.37
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-classic's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.37</h2>
<p><strong>2026-06-26 Release of logback version 1.5.37</strong></p>
<ol>
<li>• Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java expressions
using the Janino library, support for such expressions has been removed.
Users are offered the an <a
href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html">online
migration service</a> or the <code>&lt;condition&gt;</code> element
introduced in version 1.5.20. See the <a
href="https://logback.qos.ch/manual/configuration.html#conditional">relevant
documentation</a> for more details.</li>
</ol>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag
v_1.5.37. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.36</h2>
<p><strong>2026-06-25 Release of logback version 1.5.36</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
reject certain references that are associated with ACE attacks. This
issue was reported by &quot;yulate&quot; (<a
href="mailto:yulate531@gmail.com.com">yulate531@gmail.com.com</a>) and
registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag
v_1.5.36. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.35</h2>
<p><strong>026-06-23 Release of logback version 1.5.35</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (<a
href="mailto:icysun@qq.com">icysun@qq.com</a>) and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
<code>ContextInitializer</code> now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.</p>
<p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
<code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code>
will need an alternative approach for console charset detection.</p>
<p>• The logback-examples module is now included in artifacts published
to Maven Central.</p>
<p>• <code>JoranConfigurator.makeAnotherInstance()</code> and
<code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code>
are now protected, allowing derived configurators to override these
methods.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048"><code>c1df7f5</code></a>
prepare release 1.5.37</li>
<li><a
href="https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5"><code>a189967</code></a>
remove conditional based on janino</li>
<li><a
href="https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446"><code>aaa9052</code></a>
start work on 1.5.37-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888"><code>9b94c37</code></a>
prepare release 1.5.36</li>
<li><a
href="https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb"><code>e6a8280</code></a>
prevent attacks using disallowed references</li>
<li><a
href="https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f"><code>24c4b63</code></a>
start work on 1.5.36-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7"><code>08bd159</code></a>
preapre release 1.5.35</li>
<li><a
href="https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0"><code>37d256b</code></a>
indentation changes only</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3"><code>d3d7307</code></a>
minor comment</li>
<li><a
href="https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0"><code>fa0411a</code></a>
radomize file location</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37">compare
view</a></li>
</ul>
</details>
<br />

Updates `ch.qos.logback:logback-core` from 1.5.34 to 1.5.37
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/qos-ch/logback/releases">ch.qos.logback:logback-core's
releases</a>.</em></p>
<blockquote>
<h2>Logback 1.5.37</h2>
<p><strong>2026-06-26 Release of logback version 1.5.37</strong></p>
<ol>
<li>• Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java expressions
using the Janino library, support for such expressions has been removed.
Users are offered the an <a
href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html">online
migration service</a> or the <code>&lt;condition&gt;</code> element
introduced in version 1.5.20. See the <a
href="https://logback.qos.ch/manual/configuration.html#conditional">relevant
documentation</a> for more details.</li>
</ol>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag
v_1.5.37. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.36</h2>
<p><strong>2026-06-25 Release of logback version 1.5.36</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
reject certain references that are associated with ACE attacks. This
issue was reported by &quot;yulate&quot; (<a
href="mailto:yulate531@gmail.com.com">yulate531@gmail.com.com</a>) and
registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag
v_1.5.36. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
<h2>Logback 1.5.35</h2>
<p><strong>026-06-23 Release of logback version 1.5.35</strong></p>
<p>• The 'condition' attribute in <code>&lt;if&gt;</code> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (<a
href="mailto:icysun@qq.com">icysun@qq.com</a>) and registered as <a
href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>.
<strong>Please note that version 1.5.37 provides the full fix to this
vulnerability.</strong></p>
<p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
<code>ContextInitializer</code> now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.</p>
<p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
<code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code>
will need an alternative approach for console charset detection.</p>
<p>• The logback-examples module is now included in artifacts published
to Maven Central.</p>
<p>• <code>JoranConfigurator.makeAnotherInstance()</code> and
<code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code>
are now protected, allowing derived configurators to override these
methods.</p>
<p>• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java &quot;21&quot; 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048"><code>c1df7f5</code></a>
prepare release 1.5.37</li>
<li><a
href="https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5"><code>a189967</code></a>
remove conditional based on janino</li>
<li><a
href="https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446"><code>aaa9052</code></a>
start work on 1.5.37-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888"><code>9b94c37</code></a>
prepare release 1.5.36</li>
<li><a
href="https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb"><code>e6a8280</code></a>
prevent attacks using disallowed references</li>
<li><a
href="https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f"><code>24c4b63</code></a>
start work on 1.5.36-SNAPSHOT</li>
<li><a
href="https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7"><code>08bd159</code></a>
preapre release 1.5.35</li>
<li><a
href="https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0"><code>37d256b</code></a>
indentation changes only</li>
<li><a
href="https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3"><code>d3d7307</code></a>
minor comment</li>
<li><a
href="https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0"><code>fa0411a</code></a>
radomize file location</li>
<li>Additional commits viewable in <a
href="https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré <jbonofre@apache.org>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index d9f9d59c43..78137eb4e9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -113,7 +113,7 @@ under the License.
     <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
     <error_prone_core.version>2.42.0</error_prone_core.version>
     <checker.framework.version>4.2.1</checker.framework.version>
-    <logback.version>1.5.34</logback.version>
+    <logback.version>1.5.37</logback.version>
     <doclint>none</doclint>
     <additionalparam>-Xdoclint:none</additionalparam>
     <!-- List of add-opens arg line arguments for tests -->

From a9f0086090e649b83c89ea864c82ed7fcc84ab2f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 22:19:02 +0200
Subject: [PATCH 23/28] MINOR: Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2
 to 5.4.0 (#1208)

Bumps
[com.squareup.okhttp3:okhttp-jvm](https://github.com/square/okhttp) from
5.3.2 to 5.4.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:okhttp-jvm's
changelog</a>.</em></p>
<blockquote>
<h2>Version 5.4.0</h2>
<p><em>2026-06-08</em></p>
<ul>
<li>New: Add superpowers to interceptors. Interceptors can now override
anything settable on
<code>OkHttpClient.Builder</code>, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom <code>Call.Factory</code> wrappers.</li>
<li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li>
<li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
<code>okhttp-coroutines</code> artifact.</li>
<li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li>
<li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a>
Prepare for release 5.4.0.</li>
<li><a
href="https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a>
Update eclipse.osgi to v3.24.200 (<a
href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a>
Update bnd to v7.3.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a>
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a>
Update dependency macos to v26 (<a
href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a>
Update shadow.plugin to v9.4.2 (<a
href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a>
Update spotless.plugin to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a>
Update plugin com.diffplug.spotless to v8.6.0 (<a
href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a>
Update spotless.plugin to v8.5.1 (<a
href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li>
<li><a
href="https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a>
Apply gradle lint correctly (<a
href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 flight/flight-sql-jdbc-core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index e25d8438af..be2ee32868 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -135,7 +135,7 @@ under the License.
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>
       <artifactId>okhttp-jvm</artifactId>
-      <version>5.3.2</version>
+      <version>5.4.0</version>
       <scope>test</scope>
     </dependency>
     <dependency>

From 7f1f9f588af610b842ee1c3bccf6afbd528ae4db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9lder=20Greg=C3=B3rio?= <helder.gregorio@dremio.com>
Date: Thu, 9 Jul 2026 14:42:25 +0100
Subject: [PATCH 24/28] GH-1188: Reduce test workflow waste (#1189)

## Summary

This PR reduces wasted GitHub Actions time in the `Test` workflow by
removing redundant rebuilds, improving caching, and skipping integration
work when it is not relevant.

## What changed

- Removed `clean` from `ci/scripts/test.sh` so the test phase reuses the
classes compiled earlier in the job instead of deleting and recompiling
them.
- Narrowed the Maven/Docker cache key to POM changes, so source-only
edits do not invalidate the dependency cache.
- Enabled Maven dependency caching on the macOS and Windows test jobs.
- Added `pull-requests: read` so the integration job can inspect changed
files.

Closes #1188

Note: The changes on this PR were highlighted and addressed with AI
assistance
---
 .github/workflows/test.yml | 24 +++++++++++++-----------
 ci/scripts/test.sh         |  7 ++++---
 2 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ac8080d075..41a42c05ed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -66,7 +66,7 @@ jobs:
         uses: actions/cache@v6
         with:
           path: .docker
-          key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml', '**/*.java') }}
+          key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml') }}
           restore-keys: maven-${{ matrix.jdk }}-${{ matrix.maven }}-
       - name: Execute Docker Build
         env:
@@ -94,16 +94,17 @@ jobs:
             jdk: 17
             macos: latest
     steps:
-      - name: Set up Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: ${{ matrix.jdk }}
       - name: Checkout Arrow
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: ${{ matrix.jdk }}
+          cache: 'maven'
       - name: Build
         shell: bash
         env:
@@ -125,16 +126,17 @@ jobs:
       matrix:
         jdk: [17]
     steps:
-      - name: Set up Java
-        uses: actions/setup-java@v5
-        with:
-          java-version: ${{ matrix.jdk }}
-          distribution: 'temurin'
       - name: Checkout Arrow
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          java-version: ${{ matrix.jdk }}
+          distribution: 'temurin'
+          cache: 'maven'
       - name: Build
         shell: bash
         env:
diff --git a/ci/scripts/test.sh b/ci/scripts/test.sh
index cacc20034e..8061ee455d 100755
--- a/ci/scripts/test.sh
+++ b/ci/scripts/test.sh
@@ -34,10 +34,11 @@ fi
 mvn="mvn -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
 # Use `2 * ncores` threads
 mvn="${mvn} -T 2C"
+mvn="${mvn} -Denforcer.skip=true"
 
 pushd "${build_dir}"
 
-${mvn} -Darrow.test.dataRoot="${source_dir}/testing/data" clean test
+${mvn} -Darrow.test.dataRoot="${source_dir}/testing/data" test
 
 projects=()
 if [ "${ARROW_JAVA_JNI}" = "ON" ]; then
@@ -46,7 +47,7 @@ if [ "${ARROW_JAVA_JNI}" = "ON" ]; then
   projects+=(gandiva)
 fi
 if [ "${#projects[@]}" -gt 0 ]; then
-  ${mvn} clean test \
+  ${mvn} test \
     -Parrow-jni \
     -pl "$(
       IFS=,
@@ -56,7 +57,7 @@ if [ "${#projects[@]}" -gt 0 ]; then
 fi
 
 if [ "${ARROW_JAVA_CDATA}" = "ON" ]; then
-  ${mvn} clean test -Parrow-c-data -pl c -Darrow.c.jni.dist.dir="${java_jni_dist_dir}"
+  ${mvn} test -Parrow-c-data -pl c -Darrow.c.jni.dist.dir="${java_jni_dist_dir}"
 fi
 
 popd

From 21b6a05154b7713b12ace4c0ba3572ba5cc8fe66 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:19:32 +0900
Subject: [PATCH 25/28] MINOR: [CI] Bump actions/setup-python from 6 to 7
 (#1235)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/setup-python](https://github.com/actions/setup-python)
from 6 to 7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li>
<li>Pin SHA commits and update docs with latest versions by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li>
<li>Remove the pip-install input by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li>
</ul>
<h3>Bug Fix</h3>
<ul>
<li>Fix to Classify stderr warning messages as warnings instead of
errors in annotations by <a
href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li>Validate and retry manifest fetch to prevent silent failures by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Bump certifi from 2020.6.20 to 2024.7.4 in
/<strong>tests</strong>/data by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li>
<li>Remove EOL Python versions and Bumps numpy text fixture by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add RHEL support and include Linux distro in cache keys by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li>
<li>Fix pip cache error handling on Windows by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li>
<li>Upgrade actions dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li>Upgrade dependency versions and test workflow configuration by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Update advanced-usage.md by <a
href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li><a href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Dependency Upgrades</h3>
<ul>
<li>Upgrade dependencies to Node 24 compatible versions by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a>
Pin SHA commits and update docs with latest versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a>
from actions/philip-gai/bump-actions-cache-6-2-0</li>
<li><a
href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a>
Remove the pip-install input (<a
href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a>
Validate and retry manifest fetch to prevent silent failures (<a
href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a>
Annotation code fix (<a
href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a>
remove EOL Python versions and Bumps numpy text fixture (<a
href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a>
Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data
(<a
href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-python/compare/v6...v7">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-python&package-manager=github_actions&previous-version=6&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dev.yml  | 2 +-
 .github/workflows/rc.yml   | 4 ++--
 .github/workflows/test.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 7c590c749a..f4dc9ad6f1 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -40,7 +40,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.x'
       - name: pre-commit (cache)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 5d2fb6683a..18a721ac02 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -195,7 +195,7 @@ jobs:
           repository: apache/parquet-testing
           path: arrow/cpp/submodules/parquet-testing
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           cache: 'pip'
           python-version: 3.12
@@ -446,7 +446,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           cache: 'pip'
       - name: Download source archive
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 41a42c05ed..853b7cec09 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -198,7 +198,7 @@ jobs:
           key: integration-conda-${{ hashFiles('cpp/**') }}
           restore-keys: integration-conda-
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: 3.12
       - name: Setup Archery

From 06170242bde2f492e068235efdd2183a3cbd87d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9lder=20Greg=C3=B3rio?= <helder.gregorio@dremio.com>
Date: Sat, 25 Jul 2026 14:35:09 +0100
Subject: [PATCH 26/28] GH-1244: Move integration tests to separate workflow
 (#1245)

## What's Changed

Move the `integration` job from `test.yml` into its own
`integration.yml` workflow.

The new workflow uses top-level `paths` filters, so integration tests
run only when changes affect relevant code or build inputs.
This should also help to reduce the amount of runner time. Topic
initially triggered in the [mailing
list](https://lists.apache.org/thread/drf0o5kzg1zfmok7gc09k8qz8hh9ymvh)

Closes #1244
---
 .github/workflows/integration.yml | 127 ++++++++++++++++++++++++++++++
 .github/workflows/test.yml        |  69 ----------------
 2 files changed, 127 insertions(+), 69 deletions(-)
 create mode 100644 .github/workflows/integration.yml

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
new file mode 100644
index 0000000000..3872d03d2f
--- /dev/null
+++ b/.github/workflows/integration.yml
@@ -0,0 +1,127 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Integration
+
+on:
+  push:
+    branches:
+      - '**'
+      - '!dependabot/**'
+    tags:
+      - '**'
+    paths:
+      - '.github/workflows/integration.yml'
+      - '**/pom.xml'
+      - 'c/**'
+      - 'ci/scripts/**'
+      - 'compose.yaml'
+      - 'flight/**'
+      - 'format/**'
+      - 'testing/data/**'
+      - 'vector/**'
+  pull_request:
+    paths:
+      - '.github/workflows/integration.yml'
+      - '**/pom.xml'
+      - 'c/**'
+      - 'ci/scripts/**'
+      - 'compose.yaml'
+      - 'flight/**'
+      - 'format/**'
+      - 'testing/data/**'
+      - 'vector/**'
+
+concurrency:
+  group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DOCKER_VOLUME_PREFIX: ".docker/"
+
+jobs:
+  integration:
+    name: AMD64 integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout Arrow
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          repository: apache/arrow
+          submodules: recursive
+      - name: Checkout Arrow Rust
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-rs
+          path: rust
+      - name: Checkout Arrow nanoarrow
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-nanoarrow
+          path: nanoarrow
+      - name: Checkout Arrow .NET
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-dotnet
+          path: dotnet
+      - name: Checkout Arrow Go
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-go
+          path: go
+      - name: Checkout Arrow Java
+        uses: actions/checkout@v7
+        with:
+          path: java
+      - name: Checkout Arrow JavaScript
+        uses: actions/checkout@v7
+        with:
+          repository: apache/arrow-js
+          path: js
+      - name: Free up disk space
+        run: |
+          ci/scripts/util_free_space.sh
+      - name: Cache Docker Volumes
+        uses: actions/cache@v6
+        with:
+          path: .docker
+          key: integration-conda-${{ hashFiles('cpp/**') }}
+          restore-keys: integration-conda-
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: 3.12
+      - name: Setup Archery
+        run: pip install -e dev/archery[docker]
+      - name: Execute Docker Build
+        run: |
+          source ci/scripts/util_enable_core_dumps.sh
+          archery docker run \
+            -e ARCHERY_DEFAULT_BRANCH=main \
+            -e ARCHERY_INTEGRATION_TARGET_IMPLEMENTATIONS=java \
+            -e ARCHERY_INTEGRATION_WITH_DOTNET=1 \
+            -e ARCHERY_INTEGRATION_WITH_GO=1 \
+            -e ARCHERY_INTEGRATION_WITH_JAVA=1 \
+            -e ARCHERY_INTEGRATION_WITH_JS=1 \
+            -e ARCHERY_INTEGRATION_WITH_NANOARROW=1 \
+            -e ARCHERY_INTEGRATION_WITH_RUST=1 \
+            conda-integration
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 853b7cec09..653b16fa32 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -147,72 +147,3 @@ jobs:
         env:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: ci/scripts/test.sh . build jni
-
-  integration:
-    name: AMD64 integration
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - name: Checkout Arrow
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          repository: apache/arrow
-          submodules: recursive
-      - name: Checkout Arrow Rust
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-rs
-          path: rust
-      - name: Checkout Arrow nanoarrow
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-nanoarrow
-          path: nanoarrow
-      - name: Checkout Arrow .NET
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-dotnet
-          path: dotnet
-      - name: Checkout Arrow Go
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-go
-          path: go
-      - name: Checkout Arrow Java
-        uses: actions/checkout@v7
-        with:
-          path: java
-      - name: Checkout Arrow JavaScript
-        uses: actions/checkout@v7
-        with:
-          repository: apache/arrow-js
-          path: js
-      - name: Free up disk space
-        run: |
-          ci/scripts/util_free_space.sh
-      - name: Cache Docker Volumes
-        uses: actions/cache@v6
-        with:
-          path: .docker
-          key: integration-conda-${{ hashFiles('cpp/**') }}
-          restore-keys: integration-conda-
-      - name: Setup Python
-        uses: actions/setup-python@v7
-        with:
-          python-version: 3.12
-      - name: Setup Archery
-        run: pip install -e dev/archery[docker]
-      - name: Execute Docker Build
-        run: |
-          source ci/scripts/util_enable_core_dumps.sh
-          archery docker run \
-            -e ARCHERY_DEFAULT_BRANCH=main \
-            -e ARCHERY_INTEGRATION_TARGET_IMPLEMENTATIONS=java \
-            -e ARCHERY_INTEGRATION_WITH_DOTNET=1 \
-            -e ARCHERY_INTEGRATION_WITH_GO=1 \
-            -e ARCHERY_INTEGRATION_WITH_JAVA=1 \
-            -e ARCHERY_INTEGRATION_WITH_JS=1 \
-            -e ARCHERY_INTEGRATION_WITH_NANOARROW=1 \
-            -e ARCHERY_INTEGRATION_WITH_RUST=1 \
-            conda-integration

From 85d7ef30ee5f623cf3442dd989df09c3c5754ad2 Mon Sep 17 00:00:00 2001
From: Sandesh Kumar <sandeshkr419@gmail.com>
Date: Thu, 6 Aug 2026 17:29:51 -0700
Subject: [PATCH 27/28] GH-1239: Fix memory leak when C Data import hits
 allocator limit mid-array (#1240)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`ReferenceCountedArrowArray.unsafeAssociateAllocation` calls `retain()`
before `wrapForeignAllocation`. If `wrapForeignAllocation` throws
(allocator over its limit), the retain is never balanced, the reference
count stays elevated, and the C Data release callback never fires —
leaking the producer's native memory.

**Fix:** call `retain()` after `wrapForeignAllocation` returns. Same
behavior on the success path; on failure the existing `finally` in
`ArrayImporter.importArray` drives the count to zero and fires the
release callback.

**Test:** `ImportOutOfMemoryTest` — exports a batch from a "producer"
allocator, tries to import it into a too-small consumer, and asserts the
producer drains to zero after the OOM. Fails on the original code,
passes with the fix.

Fixes: https://github.com/apache/arrow-java/issues/1239

---------

Signed-off-by: Sandesh Kumar <kusandes@amazon.com>
Co-authored-by: Sandesh Kumar <kusandes@amazon.com>
---
 .../arrow/c/ReferenceCountedArrowArray.java   |  19 ++-
 .../apache/arrow/c/ImportOutOfMemoryTest.java | 139 ++++++++++++++++++
 2 files changed, 151 insertions(+), 7 deletions(-)
 create mode 100644 c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java

diff --git a/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java b/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
index cf50f9417b..f51fb25105 100644
--- a/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
+++ b/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
@@ -64,13 +64,18 @@ void release() {
    */
   ArrowBuf unsafeAssociateAllocation(
       BufferAllocator trackingAllocator, long capacity, long memoryAddress) {
+    // Retain only after wrapForeignAllocation succeeds. On the allocator-limit OOM path,
+    // wrapForeignAllocation throws before the ForeignAllocation is associated, so release0()
+    // is not called; retaining first would leave the count elevated with no matching release0().
+    ArrowBuf buf =
+        trackingAllocator.wrapForeignAllocation(
+            new ForeignAllocation(capacity, memoryAddress) {
+              @Override
+              protected void release0() {
+                ReferenceCountedArrowArray.this.release();
+              }
+            });
     retain();
-    return trackingAllocator.wrapForeignAllocation(
-        new ForeignAllocation(capacity, memoryAddress) {
-          @Override
-          protected void release0() {
-            ReferenceCountedArrowArray.this.release();
-          }
-        });
+    return buf;
   }
 }
diff --git a/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java b/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java
new file mode 100644
index 0000000000..7c099f2ef0
--- /dev/null
+++ b/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java
@@ -0,0 +1,139 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.arrow.c;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.arrow.memory.BufferAllocator;
+import org.apache.arrow.memory.OutOfMemoryException;
+import org.apache.arrow.memory.RootAllocator;
+import org.apache.arrow.vector.FieldVector;
+import org.apache.arrow.vector.VarCharVector;
+import org.apache.arrow.vector.VectorSchemaRoot;
+import org.apache.arrow.vector.types.pojo.Schema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Regression test: a mid-import {@link OutOfMemoryException} must not leak the imported array.
+ *
+ * <p>A "producer" allocator owns the exported batch; if the C Data release callback fires, the
+ * producer drains to zero. A too-small consumer allocator forces an OOM part-way through the
+ * import. The test asserts the producer drains, confirming the release callback fired despite the
+ * failure.
+ */
+final class ImportOutOfMemoryTest {
+  private static final int ROWS = 1024;
+  private static final int VALUE_BYTES = 256;
+  private static final int COLUMNS = 4;
+  // Far smaller than the exported batch, so the import OOMs part-way through the buffers.
+  private static final long TINY_LIMIT = 16 * 1024;
+
+  private RootAllocator root;
+
+  @BeforeEach
+  public void setUp() {
+    root = new RootAllocator(Long.MAX_VALUE);
+  }
+
+  @AfterEach
+  public void tearDown() {
+    root.close();
+  }
+
+  @Test
+  public void importOomDoesNotLeakExportedArray() {
+    // "producer" owns only the exported batch buffers; the C Data struct containers live on a
+    // separate allocator (they are consumed/closed by import, which would otherwise muddy the
+    // producer's balance). So producer draining to zero is an exact signal that the array's release
+    // callback fired.
+    try (BufferAllocator producer = root.newChildAllocator("producer", 0, Long.MAX_VALUE);
+        BufferAllocator structs = root.newChildAllocator("structs", 0, Long.MAX_VALUE)) {
+      try (ArrowArray array = ArrowArray.allocateNew(structs);
+          ArrowSchema schema = ArrowSchema.allocateNew(structs)) {
+        exportBatch(producer, array, schema);
+        assertTrue(
+            producer.getAllocatedMemory() > 0, "producer holds the exported batch before import");
+
+        // A consumer allocator far too small to hold the batch: the import throws part-way through.
+        try (BufferAllocator consumer = root.newChildAllocator("consumer", 0, TINY_LIMIT);
+            CDataDictionaryProvider provider = new CDataDictionaryProvider()) {
+          Schema importSchema = Data.importSchema(consumer, schema, provider);
+          try (VectorSchemaRoot importRoot = VectorSchemaRoot.create(importSchema, consumer)) {
+            Exception thrown =
+                assertThrows(
+                    Exception.class,
+                    () -> Data.importIntoVectorSchemaRoot(consumer, array, importRoot, provider));
+            assertTrue(
+                hasOutOfMemoryCause(thrown),
+                "mid-import failure must be an allocator OOM: " + thrown);
+          }
+        }
+
+        // The array's release callback must have fired despite the mid-import OOM, freeing the
+        // whole exported batch. On the unfixed retain-before-wrap code the batch is stranded.
+        assertEquals(
+            0L,
+            producer.getAllocatedMemory(),
+            "import OOM leaked the exported batch (producer not drained)");
+      }
+    }
+  }
+
+  /** True if {@code t} is, or is caused by, an Arrow {@link OutOfMemoryException}. */
+  private static boolean hasOutOfMemoryCause(Throwable t) {
+    for (Throwable cause = t; cause != null; cause = cause.getCause()) {
+      if (cause instanceof OutOfMemoryException) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Builds a wide multi-column VarChar batch on {@code alloc} and exports it into the C structs.
+   */
+  private void exportBatch(BufferAllocator alloc, ArrowArray array, ArrowSchema schema) {
+    byte[] value = new byte[VALUE_BYTES];
+    for (int i = 0; i < value.length; i++) {
+      value[i] = (byte) 'x';
+    }
+    List<FieldVector> vectors = new ArrayList<>(COLUMNS);
+    for (int c = 0; c < COLUMNS; c++) {
+      VarCharVector vector = new VarCharVector("col" + c, alloc);
+      vector.allocateNew((long) ROWS * VALUE_BYTES, ROWS);
+      for (int r = 0; r < ROWS; r++) {
+        vector.setSafe(r, value);
+      }
+      vector.setValueCount(ROWS);
+      vectors.add(vector);
+    }
+    try (VectorSchemaRoot source = new VectorSchemaRoot(vectors)) {
+      long total = 0;
+      for (FieldVector vector : source.getFieldVectors()) {
+        total += vector.getBufferSize();
+      }
+      assertTrue(total > TINY_LIMIT, "test setup: batch must exceed the consumer limit");
+      Data.exportVectorSchemaRoot(alloc, source, null, array, schema);
+    }
+  }
+}

From fa20039f39a7deacf5624ba8a6ee10e9d31e98ce Mon Sep 17 00:00:00 2001
From: David Li <li.davidm96@gmail.com>
Date: Fri, 14 Aug 2026 10:57:43 +0900
Subject: [PATCH 28/28] GH-1241: Bump vcpkg version to stay in sync with
 apache/arrow (#1260)

This fixes the CI for Linux.

Closes #1241.
---
 .env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.env b/.env
index 51daa0406c..ef0c5fb101 100644
--- a/.env
+++ b/.env
@@ -53,4 +53,4 @@ MAVEN=3.9.9
 # Versions for various dependencies used to build artifacts
 # Keep in sync with apache/arrow
 ARROW_REPO_ROOT=./arrow
-VCPKG="66c0373dc7fca549e5803087b9487edfe3aca0a1"    # 2026.01.16 Release
+VCPKG="9b965a116838c6cdcd36bca60d1b81b030c8ab8d"    # 2026.05.27 (not release, upstream commit)