LOCALLY_HELD_MEMORY_UPDATER =
+ AtomicLongFieldUpdater.newUpdater(Accountant.class, "locallyHeldMemory");
+
+ private volatile long peakAllocation = 0;
/**
* Maximum local memory that can be held. This can be externally updated. Changing it won't cause
* past memory to change but will change responses to future allocation efforts
*/
- private final AtomicLong allocationLimit = new AtomicLong();
+ private volatile long allocationLimit = 0;
/** Currently allocated amount of memory. */
- private final AtomicLong locallyHeldMemory = new AtomicLong();
+ private volatile long locallyHeldMemory = 0;
public Accountant(
@Nullable Accountant parent, String name, long reservation, long maxAllocation) {
@@ -64,7 +72,7 @@ public Accountant(
this.parent = parent;
this.name = name;
this.reservation = reservation;
- this.allocationLimit.set(maxAllocation);
+ ALLOCATION_LIMIT_UPDATER.set(this, maxAllocation);
if (reservation != 0) {
Preconditions.checkArgument(parent != null, "parent must not be null");
@@ -117,12 +125,12 @@ private AllocationOutcome.Status allocateBytesInternal(long size) {
}
private void updatePeak() {
- final long currentMemory = locallyHeldMemory.get();
+ final long currentMemory = locallyHeldMemory;
while (true) {
- final long previousPeak = peakAllocation.get();
+ final long previousPeak = peakAllocation;
if (currentMemory > previousPeak) {
- if (!peakAllocation.compareAndSet(previousPeak, currentMemory)) {
+ if (!PEAK_ALLOCATION_UPDATER.compareAndSet(this, previousPeak, currentMemory)) {
// peak allocation changed underneath us. try again.
continue;
}
@@ -166,7 +174,7 @@ private AllocationOutcome.Status allocate(
final boolean incomingUpdatePeak,
final boolean forceAllocation,
@Nullable AllocationOutcomeDetails details) {
- final long oldLocal = locallyHeldMemory.getAndAdd(size);
+ final long oldLocal = LOCALLY_HELD_MEMORY_UPDATER.getAndAdd(this, size);
final long newLocal = oldLocal + size;
// Borrowed from Math.addExact (but avoid exception here)
// Overflow if result has opposite sign of both arguments
@@ -174,7 +182,7 @@ private AllocationOutcome.Status allocate(
// failure
final boolean overflow = ((oldLocal ^ newLocal) & (size ^ newLocal)) < 0;
final long beyondReservation = newLocal - reservation;
- final boolean beyondLimit = overflow || newLocal > allocationLimit.get();
+ final boolean beyondLimit = overflow || newLocal > allocationLimit;
final boolean updatePeak = forceAllocation || (incomingUpdatePeak && !beyondLimit);
if (details != null) {
@@ -214,7 +222,7 @@ private AllocationOutcome.Status allocate(
public void releaseBytes(long size) {
// reduce local memory. all memory released above reservation should be released up the tree.
- final long newSize = locallyHeldMemory.addAndGet(-size);
+ final long newSize = LOCALLY_HELD_MEMORY_UPDATER.addAndGet(this, -size);
Preconditions.checkArgument(newSize >= 0, "Accounted size went negative.");
@@ -255,7 +263,7 @@ public String getName() {
* @return Limit in bytes.
*/
public long getLimit() {
- return allocationLimit.get();
+ return allocationLimit;
}
/**
@@ -274,7 +282,7 @@ public long getInitReservation() {
* @param newLimit The limit in bytes.
*/
public void setLimit(long newLimit) {
- allocationLimit.set(newLimit);
+ ALLOCATION_LIMIT_UPDATER.set(this, newLimit);
}
/**
@@ -284,7 +292,7 @@ public void setLimit(long newLimit) {
* @return Currently allocate memory in bytes.
*/
public long getAllocatedMemory() {
- return locallyHeldMemory.get();
+ return locallyHeldMemory;
}
/**
@@ -293,17 +301,17 @@ public long getAllocatedMemory() {
* @return The peak allocated memory in bytes.
*/
public long getPeakMemoryAllocation() {
- return peakAllocation.get();
+ return peakAllocation;
}
public long getHeadroom() {
- long localHeadroom = allocationLimit.get() - locallyHeldMemory.get();
+ long localHeadroom = allocationLimit - locallyHeldMemory;
if (parent == null) {
return localHeadroom;
}
// Amount of reserved memory left on top of what parent has
- long reservedHeadroom = Math.max(0, reservation - locallyHeldMemory.get());
+ long reservedHeadroom = Math.max(0, reservation - locallyHeldMemory);
return Math.min(localHeadroom, parent.getHeadroom() + reservedHeadroom);
}
}
diff --git a/memory/memory-core/src/main/java/org/apache/arrow/memory/ArrowBuf.java b/memory/memory-core/src/main/java/org/apache/arrow/memory/ArrowBuf.java
index b8012fe643..9712be34d7 100644
--- a/memory/memory-core/src/main/java/org/apache/arrow/memory/ArrowBuf.java
+++ b/memory/memory-core/src/main/java/org/apache/arrow/memory/ArrowBuf.java
@@ -24,7 +24,6 @@
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.nio.ReadOnlyBufferException;
-import java.util.concurrent.atomic.AtomicLong;
import org.apache.arrow.memory.BaseAllocator.Verbosity;
import org.apache.arrow.memory.util.CommonUtil;
import org.apache.arrow.memory.util.HistoricalLog;
@@ -57,9 +56,8 @@ public final class ArrowBuf implements AutoCloseable {
private static final int DOUBLE_SIZE = Double.BYTES;
private static final int LONG_SIZE = Long.BYTES;
- private static final AtomicLong idGenerator = new AtomicLong(0);
private static final int LOG_BYTES_PER_ROW = 10;
- private final long id = idGenerator.incrementAndGet();
+
private final ReferenceManager referenceManager;
private final @Nullable BufferManager bufferManager;
private final long addr;
@@ -67,7 +65,8 @@ public final class ArrowBuf implements AutoCloseable {
private long writerIndex;
private final @Nullable HistoricalLog historicalLog =
BaseAllocator.DEBUG
- ? new HistoricalLog(BaseAllocator.DEBUG_LOG_LENGTH, "ArrowBuf[%d]", id)
+ ? new HistoricalLog(
+ BaseAllocator.DEBUG_LOG_LENGTH, "ArrowBuf[%d]", System.identityHashCode(this))
: null;
private volatile long capacity;
@@ -218,7 +217,8 @@ public long memoryAddress() {
@Override
public String toString() {
- return String.format("ArrowBuf[%d], address:%d, capacity:%d", id, memoryAddress(), capacity);
+ return String.format(
+ "ArrowBuf[%d], address:%d, capacity:%d", getId(), memoryAddress(), capacity);
}
@Override
@@ -1080,12 +1080,15 @@ public String toHexString(final long start, final int length) {
}
/**
- * Get the integer id assigned to this ArrowBuf for debugging purposes.
+ * Get the id assigned to this ArrowBuf for debugging purposes.
+ *
+ * Returns {@link System#identityHashCode(Object)} which provides a unique identifier for this
+ * buffer without any per-instance memory overhead.
*
- * @return integer id
+ * @return the identity hash code for this buffer
*/
public long getId() {
- return id;
+ return System.identityHashCode(this);
}
/**
diff --git a/memory/memory-core/src/main/java/org/apache/arrow/memory/BufferLedger.java b/memory/memory-core/src/main/java/org/apache/arrow/memory/BufferLedger.java
index b562a421e7..eb90efcbb5 100644
--- a/memory/memory-core/src/main/java/org/apache/arrow/memory/BufferLedger.java
+++ b/memory/memory-core/src/main/java/org/apache/arrow/memory/BufferLedger.java
@@ -17,8 +17,7 @@
package org.apache.arrow.memory;
import java.util.IdentityHashMap;
-import java.util.concurrent.atomic.AtomicInteger;
-import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicIntegerFieldUpdater;
import org.apache.arrow.memory.util.CommonUtil;
import org.apache.arrow.memory.util.HistoricalLog;
import org.apache.arrow.util.Preconditions;
@@ -32,12 +31,13 @@
public class BufferLedger implements ValueWithKeyIncluded, ReferenceManager {
private final @Nullable IdentityHashMap buffers =
BaseAllocator.DEBUG ? new IdentityHashMap<>() : null;
- private static final AtomicLong LEDGER_ID_GENERATOR = new AtomicLong(0);
- // unique ID assigned to each ledger
- private final long ledgerId = LEDGER_ID_GENERATOR.incrementAndGet();
- private final AtomicInteger bufRefCnt = new AtomicInteger(0); // start at zero so we can
- // manage request for retain
- // correctly
+
+ // AtomicIntegerFieldUpdater for bufRefCnt to reduce memory overhead
+ private static final AtomicIntegerFieldUpdater BUF_REF_CNT_UPDATER =
+ AtomicIntegerFieldUpdater.newUpdater(BufferLedger.class, "bufRefCnt");
+ // start at zero so we can manage request for retain correctly
+ private volatile int bufRefCnt = 0;
+
private final long lCreationTime = System.nanoTime();
private final BufferAllocator allocator;
private final AllocationManager allocationManager;
@@ -78,7 +78,7 @@ public BufferAllocator getAllocator() {
*/
@Override
public int getRefCount() {
- return bufRefCnt.get();
+ return bufRefCnt;
}
/**
@@ -86,7 +86,7 @@ public int getRefCount() {
* ArrowBufs managed by this ledger will share the ref count.
*/
void increment() {
- bufRefCnt.incrementAndGet();
+ BUF_REF_CNT_UPDATER.incrementAndGet(this);
}
/**
@@ -144,7 +144,7 @@ private int decrement(int decrement) {
allocator.assertOpen();
final int outcome;
synchronized (allocationManager) {
- outcome = bufRefCnt.addAndGet(-decrement);
+ outcome = BUF_REF_CNT_UPDATER.addAndGet(this, -decrement);
if (outcome == 0) {
lDestructionTime = System.nanoTime();
// refcount of this reference manager has dropped to 0
@@ -174,7 +174,7 @@ public void retain(int increment) {
if (historicalLog != null) {
historicalLog.recordEvent("retain(%d)", increment);
}
- final int originalReferenceCount = bufRefCnt.getAndAdd(increment);
+ final int originalReferenceCount = BUF_REF_CNT_UPDATER.getAndAdd(this, increment);
Preconditions.checkArgument(originalReferenceCount > 0);
}
@@ -472,13 +472,13 @@ public long getAccountedSize() {
void print(StringBuilder sb, int indent, BaseAllocator.Verbosity verbosity) {
CommonUtil.indent(sb, indent)
.append("ledger[")
- .append(ledgerId)
+ .append(System.identityHashCode(this))
.append("] allocator: ")
.append(allocator.getName())
.append("), isOwning: ")
.append(", size: ")
.append(", references: ")
- .append(bufRefCnt.get())
+ .append(bufRefCnt)
.append(", life: ")
.append(lCreationTime)
.append("..")
diff --git a/performance/src/main/java/org/apache/arrow/memory/MemoryFootprintBenchmarks.java b/performance/src/main/java/org/apache/arrow/memory/MemoryFootprintBenchmarks.java
new file mode 100644
index 0000000000..395ba13b9d
--- /dev/null
+++ b/performance/src/main/java/org/apache/arrow/memory/MemoryFootprintBenchmarks.java
@@ -0,0 +1,213 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.arrow.memory;
+
+import java.lang.management.ManagementFactory;
+import java.lang.management.MemoryMXBean;
+import java.lang.management.MemoryUsage;
+import java.util.concurrent.TimeUnit;
+import org.openjdk.jmh.annotations.Benchmark;
+import org.openjdk.jmh.annotations.BenchmarkMode;
+import org.openjdk.jmh.annotations.Fork;
+import org.openjdk.jmh.annotations.Level;
+import org.openjdk.jmh.annotations.Measurement;
+import org.openjdk.jmh.annotations.Mode;
+import org.openjdk.jmh.annotations.OutputTimeUnit;
+import org.openjdk.jmh.annotations.Scope;
+import org.openjdk.jmh.annotations.Setup;
+import org.openjdk.jmh.annotations.State;
+import org.openjdk.jmh.annotations.TearDown;
+import org.openjdk.jmh.annotations.Warmup;
+import org.openjdk.jmh.runner.Runner;
+import org.openjdk.jmh.runner.RunnerException;
+import org.openjdk.jmh.runner.options.Options;
+import org.openjdk.jmh.runner.options.OptionsBuilder;
+
+/**
+ * Benchmarks for memory footprint of Arrow memory objects.
+ *
+ * This benchmark measures the heap memory overhead of creating many ArrowBuf instances. The
+ * optimizations using AtomicFieldUpdater instead of AtomicLong/AtomicInteger objects should reduce
+ * memory overhead significantly.
+ *
+ *
Expected savings per instance: - ArrowBuf: 8 bytes (id field removed) - BufferLedger: 28 bytes
+ * (20 from AtomicInteger + 8 from ledgerId) - Accountant: 48 bytes (3 × 16 bytes from AtomicLong
+ * objects)
+ *
+ *
For 1M ArrowBuf instances, this should save approximately 8 MB of heap memory.
+ */
+@State(Scope.Benchmark)
+@Fork(
+ value = 1,
+ jvmArgs = {"-Xms2g", "-Xmx2g"})
+@Warmup(iterations = 3, time = 1, timeUnit = TimeUnit.SECONDS)
+@Measurement(iterations = 5, time = 1, timeUnit = TimeUnit.SECONDS)
+public class MemoryFootprintBenchmarks {
+
+ /** Number of ArrowBuf instances to create for memory footprint measurement. */
+ private static final int NUM_BUFFERS = 100_000;
+
+ /** Size in bytes of each buffer allocation. */
+ private static final int BUFFER_SIZE = 1024;
+
+ /** Root allocator used for all buffer allocations in the benchmark. */
+ private RootAllocator allocator;
+
+ /** Array to hold references to allocated buffers, preventing garbage collection. */
+ private ArrowBuf[] buffers;
+
+ /** JMX bean for querying heap memory usage statistics. */
+ private MemoryMXBean memoryBean;
+
+ /**
+ * Sets up the benchmark state before each trial.
+ *
+ *
Initializes the memory monitoring bean, creates a root allocator with sufficient capacity,
+ * and allocates the buffer reference array.
+ */
+ @Setup(Level.Trial)
+ public void setup() {
+ memoryBean = ManagementFactory.getMemoryMXBean();
+ allocator = new RootAllocator((long) NUM_BUFFERS * BUFFER_SIZE);
+ buffers = new ArrowBuf[NUM_BUFFERS];
+ }
+
+ /**
+ * Cleans up buffers after each benchmark invocation.
+ *
+ *
Closes all allocated buffers to prevent memory leaks and ensure each iteration starts with a
+ * clean slate. This is critical for the memory footprint benchmark which allocates many buffers
+ * that would otherwise accumulate across warmup and measurement iterations.
+ */
+ @TearDown(Level.Invocation)
+ public void tearDown() {
+ for (int i = 0; i < NUM_BUFFERS; i++) {
+ if (buffers[i] != null) {
+ buffers[i].close();
+ buffers[i] = null;
+ }
+ }
+ }
+
+ /**
+ * Cleans up the allocator after the trial completes.
+ *
+ *
Closes the root allocator to release all resources after all warmup and measurement
+ * iterations are complete.
+ */
+ @TearDown(Level.Trial)
+ public void tearDownTrial() {
+ allocator.close();
+ }
+
+ /**
+ * Benchmark that measures heap memory usage when creating many ArrowBuf instances.
+ *
+ *
This benchmark creates {@value #NUM_BUFFERS} ArrowBuf instances and measures the heap memory
+ * used. With the AtomicFieldUpdater optimizations, we expect to save approximately 800 KB of heap
+ * memory (8 bytes × 100,000 instances) just from removing the id field in ArrowBuf.
+ *
+ *
The benchmark performs garbage collection before and after allocation to ensure accurate
+ * measurement of heap memory delta. Results are printed to stdout for analysis.
+ *
+ * @return the total heap memory used by the allocated buffers in bytes
+ */
+ @Benchmark
+ @BenchmarkMode(Mode.SingleShotTime)
+ @OutputTimeUnit(TimeUnit.MILLISECONDS)
+ public long measureArrowBufMemoryFootprint() {
+ // Force GC before measurement
+ System.gc();
+ System.gc();
+ System.gc();
+
+ MemoryUsage heapBefore = memoryBean.getHeapMemoryUsage();
+ long usedBefore = heapBefore.getUsed();
+
+ // Allocate buffers
+ for (int i = 0; i < NUM_BUFFERS; i++) {
+ buffers[i] = allocator.buffer(BUFFER_SIZE);
+ }
+
+ // Force GC to get accurate measurement
+ System.gc();
+ System.gc();
+ System.gc();
+
+ MemoryUsage heapAfter = memoryBean.getHeapMemoryUsage();
+ long usedAfter = heapAfter.getUsed();
+
+ long memoryUsed = usedAfter - usedBefore;
+
+ // Print memory usage for analysis
+ System.out.printf(
+ "Created %d ArrowBuf instances. Heap memory used: %d bytes (%.2f MB)%n",
+ NUM_BUFFERS, memoryUsed, memoryUsed / (1024.0 * 1024.0));
+ System.out.printf(
+ "Average memory per ArrowBuf: %.2f bytes%n", (double) memoryUsed / NUM_BUFFERS);
+
+ return memoryUsed;
+ }
+
+ /**
+ * Benchmark that measures allocation and deallocation performance.
+ *
+ *
This complements the memory footprint benchmark by measuring the time it takes to allocate
+ * and deallocate 1,000 buffers in a tight loop. This helps identify any performance regressions
+ * introduced by memory optimizations.
+ *
+ *
Uses a local buffer array to avoid interference with the shared {@link #buffers} array used
+ * by other benchmarks.
+ */
+ @Benchmark
+ @BenchmarkMode(Mode.AverageTime)
+ @OutputTimeUnit(TimeUnit.MICROSECONDS)
+ public void measureAllocationPerformance() {
+ ArrowBuf[] localBuffers = new ArrowBuf[1000];
+
+ for (int i = 0; i < 1000; i++) {
+ localBuffers[i] = allocator.buffer(BUFFER_SIZE);
+ }
+
+ for (int i = 0; i < 1000; i++) {
+ localBuffers[i].close();
+ }
+ }
+
+ /**
+ * Main entry point for running the benchmarks standalone.
+ *
+ *
This allows running the benchmarks directly from the command line or IDE without using the
+ * Maven JMH plugin. Example usage:
+ *
+ *
{@code
+ * java -cp target/benchmarks.jar org.apache.arrow.memory.MemoryFootprintBenchmarks
+ * }
+ *
+ * @param args command line arguments (not used)
+ * @throws RunnerException if the benchmark runner encounters an error
+ */
+ public static void main(String[] args) throws RunnerException {
+ Options opt =
+ new OptionsBuilder()
+ .include(MemoryFootprintBenchmarks.class.getSimpleName())
+ .forks(1)
+ .build();
+
+ new Runner(opt).run();
+ }
+}
From 7cbf15994ae7c82fbcb178dded6b3f128219d9ad Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Mar 2026 21:18:49 +0100
Subject: [PATCH 014/120] MINOR: Bump
org.codehaus.mojo:build-helper-maven-plugin from 3.6.0 to 3.6.1 (#1049)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin)
from 3.6.0 to 3.6.1.
Release notes
Sourced from org.codehaus.mojo:build-helper-maven-plugin's
releases.
3.6.1
📝 Documentation updates
👻 Maintenance
📦 Dependency updates
Commits
908df59
[maven-release-plugin] prepare release 3.6.1faafd8f
Use common release-drafter configurationa91b402
Rename Goals to Plugin Documentation in the site menu1e9136d
Bump org.codehaus.mojo:mojo-parent from 87 to 918700ddc
Bump org.apache.maven.shared:file-management from 3.1.0 to 3.2.0ab2c635
Bump org.codehaus.mojo:mojo-parent from 86 to 87611ce40
Typos.02d2b8e
Bump org.codehaus.mojo:mojo-parent from 85 to 86d742e5c
Update site.xml to Doxia 280b89b8
Bump org.codehaus.plexus:plexus-utils from 4.0.1 to 4.0.2- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 2917d6cb9b..6b7003f31a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -497,7 +497,7 @@ under the License.
org.codehaus.mojo
build-helper-maven-plugin
- 3.6.0
+ 3.6.1
org.codehaus.mojo
From 15f50796b5603100702560fad4b4c843f4fa379c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?=
Date: Mon, 9 Mar 2026 15:12:41 +0100
Subject: [PATCH 015/120] MINOR: Fix flaky TestBasicAuth memory leak by waiting
for async buffer release (#1058)
## What's Changed
gRPC/Netty releases Arrow buffers asynchronously after server shutdown.
Poll briefly for the allocator's memory to drain before closing it,
preventing spurious "Memory was leaked" errors in CI.
The fix adds a brief polling loop to wait for the allocator's memory to
drain before closing it.
---
.../java/org/apache/arrow/flight/auth/TestBasicAuth.java | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/flight/flight-core/src/test/java/org/apache/arrow/flight/auth/TestBasicAuth.java b/flight/flight-core/src/test/java/org/apache/arrow/flight/auth/TestBasicAuth.java
index 0c63785c88..0f202ba2d9 100644
--- a/flight/flight-core/src/test/java/org/apache/arrow/flight/auth/TestBasicAuth.java
+++ b/flight/flight-core/src/test/java/org/apache/arrow/flight/auth/TestBasicAuth.java
@@ -178,6 +178,12 @@ public static void shutdown() throws Exception {
AutoCloseables.close(server);
allocator.getChildAllocators().forEach(BufferAllocator::close);
+
+ // gRPC/Netty may still be releasing Arrow buffers asynchronously after server shutdown.
+ // Poll briefly to allow in-flight buffer releases to complete before closing the allocator.
+ for (int i = 0; i < 20 && allocator.getAllocatedMemory() > 0; i++) {
+ Thread.sleep(100);
+ }
AutoCloseables.close(allocator);
}
}
From 2f39438afd4a2c8bf7ba63b7e3aa726c680036e1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Mar 2026 16:32:14 +0100
Subject: [PATCH 016/120] MINOR: Bump org.apache.orc:orc-core from 2.2.2 to
2.3.0 (#1056)
Bumps org.apache.orc:orc-core from 2.2.2 to 2.3.0.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
adapter/orc/pom.xml | 2 +-
dataset/pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/adapter/orc/pom.xml b/adapter/orc/pom.xml
index 89d45e155c..c96ab36119 100644
--- a/adapter/orc/pom.xml
+++ b/adapter/orc/pom.xml
@@ -61,7 +61,7 @@ under the License.
org.apache.orc
orc-core
- 2.2.2
+ 2.3.0
test
diff --git a/dataset/pom.xml b/dataset/pom.xml
index 686a234358..1852c6eddc 100644
--- a/dataset/pom.xml
+++ b/dataset/pom.xml
@@ -130,7 +130,7 @@ under the License.
org.apache.orc
orc-core
- 2.2.2
+ 2.3.0
test
From 07c5f48a16230275cb502b94ffe4a3ca70f9adad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?=
Date: Mon, 9 Mar 2026 17:32:10 +0100
Subject: [PATCH 017/120] MINOR: [CI] Increase JNI macOS job timeout from 45 to
60 minutes (#1060)
As MacOS executor as slightly slower than other executors, this PR
increase the JNI MacOS job timeout to 60 minutes (instead of 45
minutes).
---
.github/workflows/rc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 8039f4c598..b866ff75f2 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -155,7 +155,7 @@ jobs:
jni-macos:
name: JNI ${{ matrix.platform.runs_on }} ${{ matrix.platform.arch }}
runs-on: ${{ matrix.platform.runs_on }}
- timeout-minutes: 45
+ timeout-minutes: 60
needs:
- source
strategy:
From a7313c22c17211ecb666e44e97158a495a176778 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Mar 2026 17:32:56 +0100
Subject: [PATCH 018/120] MINOR: [CI] Bump docker/login-action from 3.7.0 to
4.0.0 (#1053)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [docker/login-action](https://github.com/docker/login-action) from
3.7.0 to 4.0.0.
Release notes
Sourced from docker/login-action's
releases.
v4.0.0
Full Changelog: https://github.com/docker/login-action/compare/v3.7.0...v4.0.0
Commits
b45d80f
Merge pull request #929
from crazy-max/node24176cb9c
node 24 as default runtimecad8984
Merge pull request #920
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...92cbcb2
chore: update generated content5a2d6a7
build(deps): bump the aws-sdk-dependencies group with 2 updates44512b6
Merge pull request #928
from docker/dependabot/npm_and_yarn/docker/actions-to...28737a5
chore: update generated contentdac0793
build(deps): bump @docker/actions-toolkit from 0.76.0 to
0.77.062029f3
Merge pull request #919
from docker/dependabot/npm_and_yarn/actions/core-3.0.008c8f06
chore: update generated content- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/rc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index b866ff75f2..a202777143 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
with:
repository: apache/parquet-testing
path: arrow/cpp/submodules/parquet-testing
- - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+ - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with:
registry: ghcr.io
username: ${{ github.actor }}
From a53339b6ba2321f51f7f10f16a1ce06b12384498 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Mar 2026 18:59:48 +0100
Subject: [PATCH 019/120] MINOR: Bump dep.hadoop.version from 3.4.2 to 3.4.3
(#1055)
Bumps `dep.hadoop.version` from 3.4.2 to 3.4.3.
Updates `org.apache.hadoop:hadoop-client-runtime` from 3.4.2 to 3.4.3
Updates `org.apache.hadoop:hadoop-client-api` from 3.4.2 to 3.4.3
Updates `org.apache.hadoop:hadoop-common` from 3.4.2 to 3.4.3
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 6b7003f31a..e91e8c888f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -102,7 +102,7 @@ under the License.
1.78.0
4.33.4
2.21.0
- 3.4.2
+ 3.4.3
25.2.10
1.12.1
1.17.0
From 7390f551267798d4670eae6b2894c527dbc90403 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 10 Mar 2026 14:46:43 +0100
Subject: [PATCH 020/120] MINOR: Bump io.grpc:grpc-bom from 1.78.0 to 1.79.0
(#1048)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.78.0
to 1.79.0.
Release notes
Sourced from io.grpc:grpc-bom's
releases.
v1.79.0
API Changes
-
core: Delete the never-used
io.grpc.internal.ReadableBuffer.readBytes(ByteBuffer) (#12580)
(738782fb0). This is deeply internal and not accessible, so shouldn’t
impact anything. However, Apache Arrow Java uses
reflection to access private fields; GH-939:
Remove reflection for gRPC buffers is swapping to gRPC’s public
zero-copy APIs
-
opentelemetry: Add target attribute filter for metrics (#12587).
Introduce an optional Predicate targetAttributeFilter to control how
grpc.target is recorded in OpenTelemetry client metrics. When a filter
is provided, targets rejected by the predicate are normalized to
"other" to reduce grpc.target metric cardinality, while
accepted targets are recorded as-is. If no filter is set, existing
behavior is preserved. This change adds a new Builder API on
GrpcOpenTelemetry to allow applications to configure the filter.
Behavior Changes
-
core: Convert AutoConfiguredLB to an actual LB (4bbf8eee5). This is
an internal refactoring, but it does improve how errors are handled for
broken binaries. Previously, not being able to load pick_first would
result in a channel panic. Now it is handled as a regular load balancing
error
-
okhttp: Assert no pending streams before transport READY (#12566)
(ed6d175fc). No pending streams should exist when the transport
transitions to READY. This PR adds an assertion to help verify this
invariant.
Bug Fixes
- core: PickFirstLB should not return a subchannel during CONNECTING
(228fc8ecd). Pick-first in grpc-java has behaved this way since it was
created, and it was of no consequence. However, now there are some load
balancing policies (mainly RLS) that will do a pick() and hope the
result to be reasonably accurate for metrics.
Improvements
-
core: Improve DEADLINE_EXCEEDED message for CallCreds delays
(ead532b39). Previously the error message contained “buffered_nanos” and
“waiting_for_connection” for connection delays. However, we discovered
the same strings were also used if waiting on CallCredentials. Now
you’ll see details like “connecting_and_lb_delay”,
“call_credentials_delay”, and “was_still_waiting”.
-
opentelemetry: Add Android API checking (a9f73f4c0). Previously we
assumed OpenTelemetry support would not be used on Android. It did
happen to be compatible with Android, but since OpenTelemetry does have
some Android support, we now have a check that it remains compatible
-
core: Catch Errors when calling complex config parsing code
(a535ed799). Error (and any other Throwable) is now caught and handled
when parsing configuration (e.g., service config, xds). This will cause
such failures to be handled gracefully instead of panicking the
channel
-
core: Implement LoadBalancer.Helper.createOobChannel() with the
internals of createResolvingOobChannel() (3915d029c). This API is only
expected to be relevant to the gRPC-LB lookaside load balancer, and is
not believed to have behavior changes. Out-of-band channel had been
implemented with its own stripped-down Channel without load balancing.
Reimplementing using the resolving oob channel makes it a full-fledged
channel and reduces the burden when integrating new features and allows
us to have a ManagedChannelBuilder to use with efforts like gRFC A110:
Child Channel Options.
-
xds: Implement the proactive connection logic in RingHashLoadBalancer
as outlined in gRFC A61 (#12596).
Previously, the Java implementation only initialized child balancers
when a ring-chosen endpoint was in TRANSIENT_FAILURE during a picker's
pickSubchannel call. This PR adds the missing logic: when a child
balancer reports TRANSIENT_FAILURE, the LoadBalancer now proactively
initializes the first available IDLE child if no other children are
currently connecting or ready.
This ensures a backup subchannel starts warming up immediately
outside the RPC flow, reducing failover latency and improving overall
resilience. This behavior was previously present but was inadvertently
lost after #10610.
- api: Add RFC 3986 support to DnsNameResolverProvider (#12602)
(f65127cf7) Experimental RFC 3986 target URI parsing mode (disabled by
default)
New Features
Dependencies
-
protobuf: Upgrade Bazel protobuf to 33.1 (#12553)
(b61a8f49c) and load java_proto_library from the protobuf repo
(c7f3cdbc3)
-
protobuf: Fix build with Bazel 9 by upgrading bazel_jar_jar and
grpc-proto versions (#12569)
-
Upgrade dependencies (#12588)
(6422092e3) Netty to 4.1.130, error-prone annotations to 2.45.0,
google-auth-library to 1.41.0, tomcat-embed-core9 to 9.0.113,
tomcat-embed-core to 10.1.50, opentelemetry to 1.57.0,
jetty-ee10-servlet to 12.1.5, jetty-http2-server to 12.1.5,
google-cloud-logging to 3.23.9, google-auth to 1.41.0,
proto-google-common-protos to 2.63.2.
... (truncated)
Commits
381593f
Bump version to 1.79.0f93ecb0
Update README etc to reference 1.79.0f6d140f
xds: Normalize weights before combining endpoint and locality
weightsc589bef
core: clarify dns javadoc/test about trailing path segments65596ae
core: Move 4 test cases from DnsNameResolverTest to
DnsNameResolverProviderTe...59a64f0
core: Use FlagResetRule to set/restore system properties in
DnsNameResolverTe...c5f5ee0
opentelemetry: Add target attribute filter for metrics (#12587)f65127c
api: Add RFC 3986 support to DnsNameResolverProvider (#12602)a535ed7
Catch Errors when calling complex parsing codeebb9420
xds: Merge ClusterResolverLB into CdsLB2- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
---------
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré
---
.../org/apache/arrow/flight/grpc/GetReadableBuffer.java | 6 +++---
pom.xml | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/flight/flight-core/src/main/java/org/apache/arrow/flight/grpc/GetReadableBuffer.java b/flight/flight-core/src/main/java/org/apache/arrow/flight/grpc/GetReadableBuffer.java
index 45c32a86c6..fcba88d212 100644
--- a/flight/flight-core/src/main/java/org/apache/arrow/flight/grpc/GetReadableBuffer.java
+++ b/flight/flight-core/src/main/java/org/apache/arrow/flight/grpc/GetReadableBuffer.java
@@ -87,13 +87,13 @@ public static void readIntoBuffer(
final InputStream stream, final ArrowBuf buf, final int size, final boolean fastPath)
throws IOException {
ReadableBuffer readableBuffer = fastPath ? getReadableBuffer(stream) : null;
+ byte[] heapBytes = new byte[size];
if (readableBuffer != null) {
- readableBuffer.readBytes(buf.nioBuffer(0, size));
+ readableBuffer.readBytes(heapBytes, 0, size);
} else {
- byte[] heapBytes = new byte[size];
ByteStreams.readFully(stream, heapBytes);
- buf.writeBytes(heapBytes);
}
+ buf.writeBytes(heapBytes);
buf.writerIndex(size);
}
}
diff --git a/pom.xml b/pom.xml
index e91e8c888f..19625617b1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
2.0.17
33.4.8-jre
4.2.9.Final
- 1.78.0
+ 1.79.0
4.33.4
2.21.0
3.4.3
From e349a9a837aa9e3c5a56cbdd841f4e9655fa9ab2 Mon Sep 17 00:00:00 2001
From: Logan Riggs
Date: Wed, 11 Mar 2026 00:09:23 -0700
Subject: [PATCH 021/120] GH-1061: Add codegen classifier jar for arrow-vector.
(#1062)
## What's Changed
Add a new codegen classifier jar for arrow-vector that contains tdd and
other template files.
Closes #1061 .
---
docs/source/overview.rst | 3 +++
vector/pom.xml | 28 ++++++++++++++++++++++++++++
2 files changed, 31 insertions(+)
diff --git a/docs/source/overview.rst b/docs/source/overview.rst
index be579c1495..1188054114 100644
--- a/docs/source/overview.rst
+++ b/docs/source/overview.rst
@@ -45,6 +45,9 @@ but some modules are JNI bindings to the C++ library.
* - arrow-vector
- An off-heap reference implementation for Arrow columnar data format.
- Native
+ * - arrow-vector-codegen
+ - Template files for Arrow datatypes suitable for code generation.
+ - Native
* - arrow-tools
- Java applications for working with Arrow ValueVectors.
- Native
diff --git a/vector/pom.xml b/vector/pom.xml
index b24f37d5f9..f46bd0e7b4 100644
--- a/vector/pom.xml
+++ b/vector/pom.xml
@@ -194,6 +194,34 @@ under the License.
+
+ org.apache.maven.plugins
+ maven-jar-plugin
+
+
+ codegen-jar
+
+ jar
+
+ package
+
+
+ codegen
+ ${basedir}/src/main/codegen
+
+ **/*.tdd
+ **/*.fmpp
+ **/*.ftl
+
+
+
+
+
From bdec833fb69f945db9f3c767715c93d09214f2b5 Mon Sep 17 00:00:00 2001
From: Pedro Matias
Date: Wed, 11 Mar 2026 07:34:47 +0000
Subject: [PATCH 022/120] GH-994: Fix DatabaseMetaData NPEs when SqlInfo is
unavailable (#995)
## What's Changed
Multiple DatabaseMetaData methods had NPEs when the method
`ArrowDatabaseMetadata.getSqlInfoAndCacheIfCacheIsEmpty(final SqlInfo
sqlInfoCommand, final Class desiredType)`
returned null.
Now the method never returns null. If the database server does not
provide the requested info, either a sensible default is returned or a
SQLException is thrown.
Closes #994.
---
.../driver/jdbc/ArrowDatabaseMetadata.java | 33 ++++++++-
.../jdbc/ArrowDatabaseMetadataTest.java | 72 +++++++++++++++++++
2 files changed, 104 insertions(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadata.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadata.java
index 502270e1cd..0110525fea 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadata.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadata.java
@@ -45,6 +45,7 @@
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Arrays;
+import java.util.Collections;
import java.util.EnumMap;
import java.util.HashMap;
import java.util.List;
@@ -86,9 +87,12 @@
import org.apache.arrow.vector.util.Text;
import org.apache.calcite.avatica.AvaticaConnection;
import org.apache.calcite.avatica.AvaticaDatabaseMetaData;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/** Arrow Flight JDBC's implementation of {@link DatabaseMetaData}. */
public class ArrowDatabaseMetadata extends AvaticaDatabaseMetaData {
+ private static final Logger LOGGER = LoggerFactory.getLogger(ArrowDatabaseMetadata.class);
private static final String JAVA_REGEX_SPECIALS = "[]()|^-+*?{}$\\.";
private static final Charset CHARSET = StandardCharsets.UTF_8;
private static final byte[] EMPTY_BYTE_ARRAY = new byte[0];
@@ -774,7 +778,34 @@ private T getSqlInfoAndCacheIfCacheIsEmpty(
}
}
}
- return desiredType.cast(cachedSqlInfo.get(sqlInfoCommand));
+ T value = desiredType.cast(cachedSqlInfo.get(sqlInfoCommand));
+ if (value != null) {
+ return value;
+ }
+ LOGGER.debug(
+ "SqlInfo {} not provided by server, returning default for type {}",
+ sqlInfoCommand.name(),
+ desiredType.getSimpleName());
+
+ // Return sensible defaults when SqlInfo is unavailable
+ if (desiredType == Long.class) {
+ return desiredType.cast(0L);
+ } else if (desiredType == Integer.class) {
+ return desiredType.cast(0);
+ } else if (desiredType == Boolean.class) {
+ return desiredType.cast(false);
+ } else if (desiredType == String.class) {
+ return desiredType.cast("");
+ } else if (desiredType == Map.class) {
+ return desiredType.cast(Collections.emptyMap());
+ } else if (desiredType == List.class) {
+ return desiredType.cast(Collections.emptyList());
+ }
+
+ throw new SQLException(
+ String.format(
+ "The value of the SqlInfo %s is null and it could not be cast to %s.",
+ sqlInfoCommand.name(), desiredType.getName()));
}
private Optional convertListSqlInfoToString(final List sqlInfoList) {
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadataTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadataTest.java
index 81579cc387..3ab1460b27 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadataTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowDatabaseMetadataTest.java
@@ -1543,11 +1543,83 @@ public void testEmptySqlInfo() throws Exception {
try (final Connection testConnection =
FLIGHT_SERVER_EMPTY_SQLINFO_TEST_RULE.getConnection(false)) {
final DatabaseMetaData metaData = testConnection.getMetaData();
+
assertThat(metaData.getSQLKeywords(), is(""));
assertThat(metaData.getNumericFunctions(), is(""));
assertThat(metaData.getStringFunctions(), is(""));
assertThat(metaData.getSystemFunctions(), is(""));
assertThat(metaData.getTimeDateFunctions(), is(""));
+
+ assertThat(metaData.getMaxBinaryLiteralLength(), is(0));
+ assertThat(metaData.getMaxCharLiteralLength(), is(0));
+ assertThat(metaData.getMaxColumnNameLength(), is(0));
+ assertThat(metaData.getMaxColumnsInGroupBy(), is(0));
+ assertThat(metaData.getMaxColumnsInIndex(), is(0));
+ assertThat(metaData.getMaxColumnsInOrderBy(), is(0));
+ assertThat(metaData.getMaxColumnsInSelect(), is(0));
+ assertThat(metaData.getMaxColumnsInTable(), is(0));
+ assertThat(metaData.getMaxConnections(), is(0));
+ assertThat(metaData.getMaxCursorNameLength(), is(0));
+ assertThat(metaData.getMaxIndexLength(), is(0));
+ assertThat(metaData.getMaxSchemaNameLength(), is(0));
+ assertThat(metaData.getMaxProcedureNameLength(), is(0));
+ assertThat(metaData.getMaxCatalogNameLength(), is(0));
+ assertThat(metaData.getMaxRowSize(), is(0));
+ assertThat(metaData.getMaxStatementLength(), is(0));
+ assertThat(metaData.getMaxStatements(), is(0));
+ assertThat(metaData.getMaxTableNameLength(), is(0));
+ assertThat(metaData.getMaxTablesInSelect(), is(0));
+ assertThat(metaData.getMaxUserNameLength(), is(0));
+
+ assertThat(metaData.supportsColumnAliasing(), is(false));
+ assertThat(metaData.nullPlusNonNullIsNull(), is(false));
+ assertThat(metaData.supportsTableCorrelationNames(), is(false));
+ assertThat(metaData.supportsDifferentTableCorrelationNames(), is(false));
+ assertThat(metaData.supportsExpressionsInOrderBy(), is(false));
+ assertThat(metaData.supportsOrderByUnrelated(), is(false));
+ assertThat(metaData.supportsLikeEscapeClause(), is(false));
+ assertThat(metaData.supportsNonNullableColumns(), is(false));
+ assertThat(metaData.supportsIntegrityEnhancementFacility(), is(false));
+ assertThat(metaData.isCatalogAtStart(), is(false));
+ assertThat(metaData.supportsSelectForUpdate(), is(false));
+ assertThat(metaData.supportsStoredProcedures(), is(false));
+ assertThat(metaData.supportsCorrelatedSubqueries(), is(false));
+ assertThat(metaData.doesMaxRowSizeIncludeBlobs(), is(false));
+ assertThat(metaData.supportsTransactions(), is(false));
+ assertThat(metaData.dataDefinitionCausesTransactionCommit(), is(false));
+ assertThat(metaData.dataDefinitionIgnoredInTransactions(), is(false));
+ assertThat(metaData.supportsBatchUpdates(), is(false));
+ assertThat(metaData.supportsSavepoints(), is(false));
+ assertThat(metaData.supportsNamedParameters(), is(false));
+ assertThat(metaData.locatorsUpdateCopy(), is(false));
+ assertThat(metaData.supportsStoredFunctionsUsingCallSyntax(), is(false));
+ assertThat(metaData.supportsGroupBy(), is(false));
+ assertThat(metaData.supportsGroupByUnrelated(), is(false));
+ assertThat(metaData.supportsMinimumSQLGrammar(), is(false));
+ assertThat(metaData.supportsCoreSQLGrammar(), is(false));
+ assertThat(metaData.supportsExtendedSQLGrammar(), is(false));
+ assertThat(metaData.supportsANSI92EntryLevelSQL(), is(false));
+ assertThat(metaData.supportsANSI92IntermediateSQL(), is(false));
+ assertThat(metaData.supportsANSI92FullSQL(), is(false));
+ assertThat(metaData.supportsOuterJoins(), is(false));
+ assertThat(metaData.supportsFullOuterJoins(), is(false));
+ assertThat(metaData.supportsLimitedOuterJoins(), is(false));
+ assertThat(metaData.supportsSchemasInProcedureCalls(), is(false));
+ assertThat(metaData.supportsSchemasInIndexDefinitions(), is(false));
+ assertThat(metaData.supportsSchemasInPrivilegeDefinitions(), is(false));
+ assertThat(metaData.supportsCatalogsInIndexDefinitions(), is(false));
+ assertThat(metaData.supportsCatalogsInPrivilegeDefinitions(), is(false));
+ assertThat(metaData.supportsPositionedDelete(), is(false));
+ assertThat(metaData.supportsPositionedUpdate(), is(false));
+ assertThat(metaData.supportsSubqueriesInComparisons(), is(false));
+ assertThat(metaData.supportsSubqueriesInExists(), is(false));
+ assertThat(metaData.supportsSubqueriesInIns(), is(false));
+ assertThat(metaData.supportsSubqueriesInQuantifieds(), is(false));
+ assertThat(metaData.supportsUnion(), is(false));
+ assertThat(metaData.supportsUnionAll(), is(false));
+ assertThat(metaData.supportsConvert(), is(false));
+
+ assertThat(metaData.getDefaultTransactionIsolation(), is(Connection.TRANSACTION_NONE));
}
}
}
From c8666f28569ca7e825b45f8ca39434c12428bec6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 11 Mar 2026 11:09:05 +0100
Subject: [PATCH 023/120] MINOR: Bump
com.gradle:common-custom-user-data-maven-extension from 2.0.3 to 2.1.0 (#998)
Bumps
[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)
from 2.0.3 to 2.1.0.
Release notes
Sourced from com.gradle:common-custom-user-data-maven-extension's
releases.
2.1.0
- [NEW] Add support for evaluating one or more Groovy scripts in the
Develocity storage directory
2.0.7
- [FIX] Added a null-safety check to handle cases where the Maven
session may be null
2.0.6
- [FIX] GitHub Actions build link doesn't include run attempt
2.0.5
- [FIX] Add GitHub run attempt as custom value to precisely identify
GitHub Action run
2.0.4
- [FIX] Add GitHub run number as custom value to precisely identify
GitHub Action run
Commits
0bb5838
[maven-release-plugin] prepare release v2.1.04b1a27c
Update changes.mdb9010d0
Merge pull request #329
from gradle/erichaagdev/groovy-scripts-m2-directory82281ec
Switch Groovy script evaluation order7cdb3cc
Clarify script locations in README2c511ae
Add support for evaluating one or more Groovy scripts in the Develocity
stora...f02dbca
Update to use version 2.0.7 of the Common Custom User Data Maven
Extension88e0f41
Prepare for next round of development36edaf8
[maven-release-plugin] prepare for next development iteration683a966
[maven-release-plugin] prepare release v2.0.7- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
You can trigger a rebase of this PR by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.mvn/extensions.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index 0e25cc84f8..4585435b49 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -28,6 +28,6 @@
com.gradle
common-custom-user-data-maven-extension
- 2.0.3
+ 2.1.0
From 6ffb2d0450effccf115203ae31da10708a35dda8 Mon Sep 17 00:00:00 2001
From: Aleksei Starikov
Date: Wed, 11 Mar 2026 11:23:45 +0100
Subject: [PATCH 024/120] GH-301: [Vector] Allow adding a vector at the end of
VectorSchemaRoot (#1013)
## What's Changed
Allow adding a vector at the end of VectorSchemaRoot in the
`VectorSchemaRoot#addVector()` method.
Previously, the precondition `index < fieldVectors.size()` rejected
`index == fieldVectors.size()`, so appending was impossible. The
precondition is now `index <= fieldVectors.size()`, and when `index ==
fieldVectors.size()` the new vector is appended after all existing
vectors.
The implementation of `VectorSchemaRoot#addVector()` is now aligned with
[BaseTable#insertVector()](https://github.com/apache/arrow-java/blob/main/vector/src/main/java/org/apache/arrow/vector/table/BaseTable.java#L156)
The change is backward compatible, as it extends the functionality of
the `VectorSchemaRoot#addVector()` method.
Closes #301.
---
.../apache/arrow/vector/VectorSchemaRoot.java | 15 +++++++++-----
.../arrow/vector/TestVectorSchemaRoot.java | 20 +++++++++++++++++++
2 files changed, 30 insertions(+), 5 deletions(-)
diff --git a/vector/src/main/java/org/apache/arrow/vector/VectorSchemaRoot.java b/vector/src/main/java/org/apache/arrow/vector/VectorSchemaRoot.java
index a7cb9ced72..4c1fbf761a 100644
--- a/vector/src/main/java/org/apache/arrow/vector/VectorSchemaRoot.java
+++ b/vector/src/main/java/org/apache/arrow/vector/VectorSchemaRoot.java
@@ -199,13 +199,18 @@ public FieldVector getVector(int index) {
*/
public VectorSchemaRoot addVector(int index, FieldVector vector) {
Preconditions.checkNotNull(vector);
- Preconditions.checkArgument(index >= 0 && index < fieldVectors.size());
+ Preconditions.checkArgument(index >= 0 && index <= fieldVectors.size());
List newVectors = new ArrayList<>();
- for (int i = 0; i < fieldVectors.size(); i++) {
- if (i == index) {
- newVectors.add(vector);
+ if (index == fieldVectors.size()) {
+ newVectors.addAll(fieldVectors);
+ newVectors.add(vector);
+ } else {
+ for (int i = 0; i < fieldVectors.size(); i++) {
+ if (i == index) {
+ newVectors.add(vector);
+ }
+ newVectors.add(fieldVectors.get(i));
}
- newVectors.add(fieldVectors.get(i));
}
return new VectorSchemaRoot(newVectors);
}
diff --git a/vector/src/test/java/org/apache/arrow/vector/TestVectorSchemaRoot.java b/vector/src/test/java/org/apache/arrow/vector/TestVectorSchemaRoot.java
index c121d94892..bd3113f8bc 100644
--- a/vector/src/test/java/org/apache/arrow/vector/TestVectorSchemaRoot.java
+++ b/vector/src/test/java/org/apache/arrow/vector/TestVectorSchemaRoot.java
@@ -171,6 +171,26 @@ public void testAddVector() {
}
}
+ @Test
+ public void testAddVectorAtEnd() {
+ try (final IntVector intVector1 = new IntVector("intVector1", allocator);
+ final IntVector intVector2 = new IntVector("intVector2", allocator);
+ final IntVector intVector3 = new IntVector("intVector3", allocator); ) {
+
+ VectorSchemaRoot original = new VectorSchemaRoot(Arrays.asList(intVector1, intVector2));
+ assertEquals(2, original.getFieldVectors().size());
+
+ VectorSchemaRoot newRecordBatch = original.addVector(2, intVector3);
+ assertEquals(3, newRecordBatch.getFieldVectors().size());
+ assertEquals(intVector1, newRecordBatch.getFieldVectors().get(0));
+ assertEquals(intVector2, newRecordBatch.getFieldVectors().get(1));
+ assertEquals(intVector3, newRecordBatch.getFieldVectors().get(2));
+
+ original.close();
+ newRecordBatch.close();
+ }
+ }
+
@Test
public void testRemoveVector() {
try (final IntVector intVector1 = new IntVector("intVector1", allocator);
From 18de621ff2e7a72f54d416b9ef6e6a4a96b2aa8d Mon Sep 17 00:00:00 2001
From: Pedro Matias
Date: Wed, 11 Mar 2026 10:59:07 +0000
Subject: [PATCH 025/120] =?UTF-8?q?GH-1004:=20=20[JDBC]=20Fix=20NPE=20in?=
=?UTF-8?q?=20ArrowFlightJdbcDriver#connect=E2=80=8B(final=20String=20url,?=
=?UTF-8?q?=20final=20Properties=20info)=20=20(#1005)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
## What's Changed
`ArrowFlightJdbcDriver.connect(final String url, final Properties info)`
now properly ignores a null value for `info`, obtaining the properties
solely from the URL.
Closes #1004.
---
.../driver/jdbc/ArrowFlightJdbcDriver.java | 4 +++-
.../jdbc/ArrowFlightJdbcDriverTest.java | 24 +++++++++++++++++++
2 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriver.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriver.java
index 53e6120f62..12ef8030d7 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriver.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriver.java
@@ -75,7 +75,9 @@ public Logger getParentLogger() {
public ArrowFlightConnection connect(final String url, final Properties info)
throws SQLException {
final Properties properties = new Properties(info);
- properties.putAll(info);
+ if (info != null) {
+ properties.putAll(info);
+ }
if (url != null) {
final Optional> maybeProperties = getUrlsArgs(url);
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriverTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriverTest.java
index ae355829d7..88fb9889b6 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriverTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcDriverTest.java
@@ -201,6 +201,30 @@ public void testConnectWithInsensitiveCasePropertyKeys2() throws Exception {
}
}
+ /**
+ * Tests whether the {@link ArrowFlightJdbcDriver} can establish a successful connection to the
+ * Arrow Flight client when provided with null properties.
+ */
+ @Test
+ public void testConnectWithNullProperties() throws Exception {
+ final Driver driver = new ArrowFlightJdbcDriver();
+ try (Connection connection =
+ driver.connect(
+ "jdbc:arrow-flight://"
+ + dataSource.getConfig().getHost()
+ + ":"
+ + dataSource.getConfig().getPort()
+ + "?"
+ + "useEncryption=false"
+ + "&user="
+ + dataSource.getConfig().getUser()
+ + "&password="
+ + dataSource.getConfig().getPassword(),
+ null)) {
+ assertTrue(connection.isValid(300));
+ }
+ }
+
/**
* Tests whether an exception is thrown upon attempting to connect to a malformed URI.
*
From 4a7fb4ef95d9386a0a7102fb18fbe52547527c21 Mon Sep 17 00:00:00 2001
From: Aleksei Starikov
Date: Wed, 11 Mar 2026 14:59:21 +0100
Subject: [PATCH 026/120] GH-552: [Vector] Add absent methods to the
UnionFixedSizeListWriter (#1052)
## What's Changed
Add absent methods to the `UnionFixedSizeListWriter`.
1. Aligned the `UnionFixedSizeListWriter` template with the
`UnionListWriter` template, which added the following previously absent
methods to the generated `UnionFixedSizeListWriter` class:
```
- duration() methods
- DurationWriter duration()
- DurationWriter duration(String name, org.apache.arrow.vector.types.TimeUnit unit)
- DurationWriter duration(String name)
- timeStampSecTZ() methods
- TimeStampSecTZWriter timeStampSecTZ()
- TimeStampSecTZWriter timeStampSecTZ(String name, String timezone)
- TimeStampSecTZWriter timeStampSecTZ(String name)
- timeStampMilliTZ() methods
- TimeStampMilliTZWriter timeStampMilliTZ()
- TimeStampMilliTZWriter timeStampMilliTZ(String name, String timezone)
- TimeStampMilliTZWriter timeStampMilliTZ(String name)
- timeStampMicroTZ() methods
- TimeStampMicroTZWriter timeStampMicroTZ()
- TimeStampMicroTZWriter timeStampMicroTZ(String name, String timezone)
- TimeStampMicroTZWriter timeStampMicroTZ(String name)
- timeStampNanoTZ() methods
- TimeStampNanoTZWriter timeStampNanoTZ()
- TimeStampNanoTZWriter timeStampNanoTZ(String name, String timezone)
- TimeStampNanoTZWriter timeStampNanoTZ(String name)
- fixedSizeBinary() methods
- FixedSizeBinaryWriter fixedSizeBinary()
- FixedSizeBinaryWriter fixedSizeBinary(String name, int byteWidth)
- FixedSizeBinaryWriter fixedSizeBinary(String name)
- write() methods for Duration
- void writeDuration(long value)
- void write(DurationHolder holder)
- write() methods for TimeStampSecTZ
- void writeTimeStampSecTZ(long value)
- void write(TimeStampSecTZHolder holder)
- write() methods for TimeStampMilliTZ
- void writeTimeStampMilliTZ(long value)
- void write(TimeStampMilliTZHolder holder)
- write() methods for TimeStampMicroTZ
- void writeTimeStampMicroTZ(long value)
- void write(TimeStampMicroTZHolder holder)
- write() methods for TimeStampNanoTZ
- void writeTimeStampNanoTZ(long value)
- void write(TimeStampNanoTZHolder holder)
- write() methods for FixedSizeBinary
- void writeFixedSizeBinary(ArrowBuf buffer)
- void write(FixedSizeBinaryHolder holder)
```
2. Add `structName = name;` for 2 existing methods (align them with
other similar methods):
```
- DecimalWriter decimal(String name)
- Decimal256Writer decimal256(String name)
```
3. Remove unused assignments from the `UnionListWriter` template + add
missing overrides.
This fix adds override annotations to the `UnionListWriter` generated
class and extend/fix the code of the `UnionFixedSizeListWriter`
generated class. So, the change is backward compatible.
See the gists for the generated writer classes:
-
[UnionFixedSizeListWriter](https://gist.github.com/axreldable/9908f98d75ec4c0a62e4ccfa176cbbe1)
-
[UnionListWriter](https://gist.github.com/axreldable/881f3cf1ed001c513870daf3ea4f3bbd)
---
Inspired by this [PR](https://github.com/apache/arrow/pull/35353).
---
Closes #552 .
---
.../templates/UnionFixedSizeListWriter.java | 151 +++++--------
.../codegen/templates/UnionListWriter.java | 6 +-
.../arrow/vector/TestFixedSizeListVector.java | 207 ++++++++++++++++++
.../apache/arrow/vector/TestMapVector.java | 35 ++-
.../org/apache/arrow/vector/TestUtils.java | 13 ++
5 files changed, 293 insertions(+), 119 deletions(-)
diff --git a/vector/src/main/codegen/templates/UnionFixedSizeListWriter.java b/vector/src/main/codegen/templates/UnionFixedSizeListWriter.java
index f6e3f63caf..484199ab2a 100644
--- a/vector/src/main/codegen/templates/UnionFixedSizeListWriter.java
+++ b/vector/src/main/codegen/templates/UnionFixedSizeListWriter.java
@@ -35,6 +35,10 @@
<#include "/@includes/vv_imports.ftl" />
+<#function is_timestamp_tz type>
+ <#return type?starts_with("TimeStamp") && type?ends_with("TZ")>
+
+
/*
* This class is generated using freemarker and the ${.template_name} template.
*/
@@ -96,55 +100,30 @@ public void close() throws Exception {
public void setPosition(int index) {
super.setPosition(index);
}
- <#list vv.types as type><#list type.minor as minor><#assign name = minor.class?cap_first />
- <#assign fields = minor.fields!type.fields />
- <#assign uncappedName = name?uncap_first/>
- <#if uncappedName == "int" ><#assign uncappedName = "integer" />
- <#if !minor.typeParams?? >
+ <#list vv.types as type><#list type.minor as minor>
+ <#assign lowerName = minor.class?uncap_first />
+ <#if lowerName == "int" ><#assign lowerName = "integer" />
+ <#assign upperName = minor.class?upper_case />
@Override
- public ${name}Writer ${uncappedName}() {
+ public ${minor.class}Writer ${lowerName}() {
return this;
}
+ <#if minor.typeParams?? >
@Override
- public ${name}Writer ${uncappedName}(String name) {
- structName = name;
- return writer.${uncappedName}(name);
+ public ${minor.class}Writer ${lowerName}(String name<#list minor.typeParams as typeParam>, ${typeParam.type} ${typeParam.name}) {
+ return writer.${lowerName}(name<#list minor.typeParams as typeParam>, ${typeParam.name});
}
-
-
- @Override
- public DecimalWriter decimal() {
- return this;
- }
-
- @Override
- public DecimalWriter decimal(String name, int scale, int precision) {
- return writer.decimal(name, scale, precision);
- }
-
- @Override
- public DecimalWriter decimal(String name) {
- return writer.decimal(name);
- }
-
@Override
- public Decimal256Writer decimal256() {
- return this;
- }
-
- @Override
- public Decimal256Writer decimal256(String name, int scale, int precision) {
- return writer.decimal256(name, scale, precision);
+ public ${minor.class}Writer ${lowerName}(String name) {
+ structName = name;
+ return writer.${lowerName}(name);
}
- @Override
- public Decimal256Writer decimal256(String name) {
- return writer.decimal256(name);
- }
+
@Override
public StructWriter struct() {
@@ -215,87 +194,86 @@ public void end() {
}
@Override
- public void write(DecimalHolder holder) {
- if (writer.idx() >= (idx() + 1) * listSize) {
- throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
- }
- writer.write(holder);
- writer.setPosition(writer.idx() + 1);
- }
-
- @Override
- public void write(Decimal256Holder holder) {
+ public void writeNull() {
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.write(holder);
- writer.setPosition(writer.idx() + 1);
+ writer.writeNull();
}
+ <#list vv.types as type>
+ <#list type.minor as minor>
+ <#assign name = minor.class?cap_first />
+ <#assign fields = minor.fields!type.fields />
+ <#assign uncappedName = name?uncap_first/>
@Override
- public void writeNull() {
+ public void write${name}(<#list fields as field>${field.type} ${field.name}<#if field_has_next>, ) {
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.writeNull();
+ writer.write${name}(<#list fields as field>${field.name}<#if field_has_next>, );
+ writer.setPosition(writer.idx()+1);
}
- public void writeDecimal(long start, ArrowBuf buffer, ArrowType arrowType) {
+ <#if is_timestamp_tz(minor.class) || minor.class == "Duration" || minor.class == "FixedSizeBinary">
+ @Override
+ public void write(${name}Holder holder) {
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.writeDecimal(start, buffer, arrowType);
- writer.setPosition(writer.idx() + 1);
+ writer.write(holder);
+ writer.setPosition(writer.idx()+1);
}
- public void writeDecimal(BigDecimal value) {
+ <#elseif minor.class?starts_with("Decimal")>
+ @Override
+ public void write${name}(long start, ArrowBuf buffer, ArrowType arrowType) {
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.writeDecimal(value);
- writer.setPosition(writer.idx() + 1);
+ writer.write${name}(start, buffer, arrowType);
+ writer.setPosition(writer.idx()+1);
}
- public void writeBigEndianBytesToDecimal(byte[] value, ArrowType arrowType) {
+ @Override
+ public void write(${name}Holder holder) {
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.writeBigEndianBytesToDecimal(value, arrowType);
- writer.setPosition(writer.idx() + 1);
+ writer.write(holder);
+ writer.setPosition(writer.idx()+1);
}
- public void writeDecimal256(long start, ArrowBuf buffer, ArrowType arrowType) {
+ @Override
+ public void write${name}(BigDecimal value) {
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.writeDecimal256(start, buffer, arrowType);
- writer.setPosition(writer.idx() + 1);
+ writer.write${name}(value);
+ writer.setPosition(writer.idx()+1);
}
- public void writeDecimal256(BigDecimal value) {
+ @Override
+ public void writeBigEndianBytesTo${name}(byte[] value, ArrowType arrowType){
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.writeDecimal256(value);
+ writer.writeBigEndianBytesTo${name}(value, arrowType);
writer.setPosition(writer.idx() + 1);
}
-
- public void writeBigEndianBytesToDecimal256(byte[] value, ArrowType arrowType) {
+ <#else>
+ @Override
+ public void write(${name}Holder holder) {
if (writer.idx() >= (idx() + 1) * listSize) {
throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
}
- writer.writeBigEndianBytesToDecimal256(value, arrowType);
- writer.setPosition(writer.idx() + 1);
+ writer.write${name}(<#list fields as field>holder.${field.name}<#if field_has_next>, );
+ writer.setPosition(writer.idx()+1);
}
+
-
- <#list vv.types as type>
- <#list type.minor as minor>
- <#assign name = minor.class?cap_first />
- <#assign fields = minor.fields!type.fields />
- <#assign uncappedName = name?uncap_first/>
- <#if minor.class?ends_with("VarBinary")>
+ <#if minor.class?ends_with("VarBinary")>
@Override
public void write${minor.class}(byte[] value) {
if (writer.idx() >= (idx() + 1) * listSize) {
@@ -349,27 +327,8 @@ public void writeBigEndianBytesToDecimal256(byte[] value, ArrowType arrowType) {
writer.write${minor.class}(value);
writer.setPosition(writer.idx() + 1);
}
-
-
- <#if !minor.typeParams?? >
- @Override
- public void write${name}(<#list fields as field>${field.type} ${field.name}<#if field_has_next>, ) {
- if (writer.idx() >= (idx() + 1) * listSize) {
- throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
- }
- writer.write${name}(<#list fields as field>${field.name}<#if field_has_next>, );
- writer.setPosition(writer.idx() + 1);
- }
-
- public void write(${name}Holder holder) {
- if (writer.idx() >= (idx() + 1) * listSize) {
- throw new IllegalStateException(String.format("values at index %s is greater than listSize %s", idx(), listSize));
- }
- writer.write${name}(<#list fields as field>holder.${field.name}<#if field_has_next>, );
- writer.setPosition(writer.idx() + 1);
- }
+
-
}
diff --git a/vector/src/main/codegen/templates/UnionListWriter.java b/vector/src/main/codegen/templates/UnionListWriter.java
index 4b54739230..394348f029 100644
--- a/vector/src/main/codegen/templates/UnionListWriter.java
+++ b/vector/src/main/codegen/templates/UnionListWriter.java
@@ -123,8 +123,6 @@ public void setPosition(int index) {
<#assign lowerName = minor.class?uncap_first />
<#if lowerName == "int" ><#assign lowerName = "integer" />
<#assign upperName = minor.class?upper_case />
- <#assign capName = minor.class?cap_first />
- <#assign vectName = capName />
@Override
public ${minor.class}Writer ${lowerName}() {
return this;
@@ -370,6 +368,7 @@ public void write(${name}Holder holder) {
}
<#elseif minor.class?starts_with("Decimal")>
+ @Override
public void write${name}(long start, ArrowBuf buffer, ArrowType arrowType) {
writer.write${name}(start, buffer, arrowType);
writer.setPosition(writer.idx()+1);
@@ -381,11 +380,13 @@ public void write(${name}Holder holder) {
writer.setPosition(writer.idx()+1);
}
+ @Override
public void write${name}(BigDecimal value) {
writer.write${name}(value);
writer.setPosition(writer.idx()+1);
}
+ @Override
public void writeBigEndianBytesTo${name}(byte[] value, ArrowType arrowType){
writer.writeBigEndianBytesTo${name}(value, arrowType);
writer.setPosition(writer.idx() + 1);
@@ -429,6 +430,7 @@ public void write(${name}Holder holder) {
writer.setPosition(writer.idx() + 1);
}
+ @Override
public void write${minor.class}(String value) {
writer.write${minor.class}(value);
writer.setPosition(writer.idx() + 1);
diff --git a/vector/src/test/java/org/apache/arrow/vector/TestFixedSizeListVector.java b/vector/src/test/java/org/apache/arrow/vector/TestFixedSizeListVector.java
index 73a88b3a1e..b3455fe52c 100644
--- a/vector/src/test/java/org/apache/arrow/vector/TestFixedSizeListVector.java
+++ b/vector/src/test/java/org/apache/arrow/vector/TestFixedSizeListVector.java
@@ -30,14 +30,21 @@
import java.util.Arrays;
import java.util.List;
import org.apache.arrow.memory.BufferAllocator;
+import org.apache.arrow.vector.complex.BaseRepeatedValueVector;
import org.apache.arrow.vector.complex.FixedSizeListVector;
import org.apache.arrow.vector.complex.ListVector;
import org.apache.arrow.vector.complex.impl.UnionFixedSizeListReader;
import org.apache.arrow.vector.complex.impl.UnionFixedSizeListWriter;
import org.apache.arrow.vector.complex.impl.UnionListReader;
import org.apache.arrow.vector.complex.reader.FieldReader;
+import org.apache.arrow.vector.holders.DurationHolder;
+import org.apache.arrow.vector.holders.FixedSizeBinaryHolder;
+import org.apache.arrow.vector.holders.TimeStampMilliTZHolder;
+import org.apache.arrow.vector.holders.TimeStampNanoTZHolder;
+import org.apache.arrow.vector.types.TimeUnit;
import org.apache.arrow.vector.types.Types.MinorType;
import org.apache.arrow.vector.types.pojo.ArrowType;
+import org.apache.arrow.vector.types.pojo.Field;
import org.apache.arrow.vector.types.pojo.FieldType;
import org.apache.arrow.vector.util.Text;
import org.apache.arrow.vector.util.TransferPair;
@@ -628,6 +635,206 @@ public void testWriteLargeVarBinaryHelpers() throws Exception {
}
}
+ @Test
+ public void testWriterTimeStampNanoTZField() {
+ try (final FixedSizeListVector vector =
+ FixedSizeListVector.empty("vector", /* size= */ 3, allocator)) {
+ UnionFixedSizeListWriter writer = vector.getWriter();
+ writer.allocate();
+
+ final int valueCount = 10;
+
+ for (int i = 0; i < valueCount; i++) {
+ writer.startList();
+ writer.timeStampNanoTZ().writeTimeStampNanoTZ(i * 1000L);
+ writer.timeStampNanoTZ().writeTimeStampNanoTZ((i + 1) * 1000L);
+ writer.timeStampNanoTZ().writeTimeStampNanoTZ((i + 2) * 1000L);
+ writer.endList();
+ }
+ vector.setValueCount(valueCount);
+
+ UnionFixedSizeListReader reader = vector.getReader();
+ for (int i = 0; i < valueCount; i++) {
+ reader.setPosition(i);
+ assertTrue(reader.isSet());
+ assertTrue(reader.next());
+ assertEquals(i * 1000L, reader.reader().readLong().longValue());
+ assertTrue(reader.next());
+ assertEquals((i + 1) * 1000L, reader.reader().readLong().longValue());
+ assertTrue(reader.next());
+ assertEquals((i + 2) * 1000L, reader.reader().readLong().longValue());
+ assertFalse(reader.next());
+ }
+ }
+ }
+
+ @Test
+ public void testWriterUsingHolderTimeStampNanoTZField() {
+ try (final FixedSizeListVector vector =
+ FixedSizeListVector.empty("vector", /* size= */ 3, allocator)) {
+ UnionFixedSizeListWriter writer = vector.getWriter();
+ writer.allocate();
+
+ TimeStampNanoTZHolder holder = new TimeStampNanoTZHolder();
+ holder.timezone = "SomeFakeTimeZone";
+ writer.startList();
+ holder.value = 12341234L;
+ writer.timeStampNanoTZ().write(holder);
+ holder.value = 55555L;
+ writer.timeStampNanoTZ().write(holder);
+
+ // Writing with a different timezone should throw
+ holder.timezone = "AsdfTimeZone";
+ holder.value = 77777;
+ IllegalArgumentException ex =
+ assertThrows(
+ IllegalArgumentException.class, () -> writer.timeStampNanoTZ().write(holder));
+ assertEquals(
+ "holder.timezone: AsdfTimeZone not equal to vector timezone: SomeFakeTimeZone",
+ ex.getMessage());
+
+ writer.endList();
+ vector.setValueCount(1);
+
+ Field expectedDataField =
+ new Field(
+ BaseRepeatedValueVector.DATA_VECTOR_NAME,
+ FieldType.nullable(new ArrowType.Timestamp(TimeUnit.NANOSECOND, "SomeFakeTimeZone")),
+ null);
+ Field expectedField =
+ new Field(
+ vector.getName(),
+ FieldType.nullable(new ArrowType.FixedSizeList(3)),
+ List.of(expectedDataField));
+
+ assertEquals(expectedField, writer.getField());
+ }
+ }
+
+ @Test
+ public void testWriterUsingHolderTimestampMilliTZField() {
+ try (final FixedSizeListVector vector =
+ FixedSizeListVector.empty("vector", /* size= */ 3, allocator)) {
+ UnionFixedSizeListWriter writer = vector.getWriter();
+ writer.allocate();
+
+ TimeStampMilliTZHolder holder = new TimeStampMilliTZHolder();
+ holder.timezone = "SomeFakeTimeZone";
+ writer.startList();
+ holder.value = 12341234L;
+ writer.timeStampMilliTZ().write(holder);
+ holder.value = 55555L;
+ writer.timeStampMilliTZ().write(holder);
+
+ // Writing with a different timezone should throw
+ holder.timezone = "AsdfTimeZone";
+ holder.value = 77777;
+ IllegalArgumentException ex =
+ assertThrows(
+ IllegalArgumentException.class, () -> writer.timeStampMilliTZ().write(holder));
+ assertEquals(
+ "holder.timezone: AsdfTimeZone not equal to vector timezone: SomeFakeTimeZone",
+ ex.getMessage());
+
+ writer.endList();
+ vector.setValueCount(1);
+
+ Field expectedDataField =
+ new Field(
+ BaseRepeatedValueVector.DATA_VECTOR_NAME,
+ FieldType.nullable(new ArrowType.Timestamp(TimeUnit.MILLISECOND, "SomeFakeTimeZone")),
+ null);
+ Field expectedField =
+ new Field(
+ vector.getName(),
+ FieldType.nullable(new ArrowType.FixedSizeList(3)),
+ List.of(expectedDataField));
+
+ assertEquals(expectedField, writer.getField());
+ }
+ }
+
+ @Test
+ public void testWriterUsingHolderDurationField() {
+ try (final FixedSizeListVector vector =
+ FixedSizeListVector.empty("vector", /* size= */ 3, allocator)) {
+ UnionFixedSizeListWriter writer = vector.getWriter();
+ writer.allocate();
+
+ DurationHolder durationHolder = new DurationHolder();
+ durationHolder.unit = TimeUnit.MILLISECOND;
+
+ writer.startList();
+ durationHolder.value = 812374L;
+ writer.duration().write(durationHolder);
+ durationHolder.value = 143451L;
+ writer.duration().write(durationHolder);
+
+ // Writing with a different unit should throw
+ durationHolder.unit = TimeUnit.SECOND;
+ durationHolder.value = 8888888;
+ IllegalArgumentException ex =
+ assertThrows(
+ IllegalArgumentException.class, () -> writer.duration().write(durationHolder));
+ assertEquals("holder.unit: SECOND not equal to vector unit: MILLISECOND", ex.getMessage());
+
+ writer.endList();
+ vector.setValueCount(1);
+
+ Field expectedDataField =
+ new Field(
+ BaseRepeatedValueVector.DATA_VECTOR_NAME,
+ FieldType.nullable(new ArrowType.Duration(TimeUnit.MILLISECOND)),
+ null);
+ Field expectedField =
+ new Field(
+ vector.getName(),
+ FieldType.nullable(new ArrowType.FixedSizeList(3)),
+ List.of(expectedDataField));
+
+ assertEquals(expectedField, writer.getField());
+ }
+ }
+
+ @Test
+ public void testWriterUsingHolderFixedSizeBinaryField() {
+ try (final FixedSizeListVector vector =
+ FixedSizeListVector.empty("vector", /* size= */ 2, allocator)) {
+ UnionFixedSizeListWriter writer = vector.getWriter();
+ writer.allocate();
+
+ FixedSizeBinaryHolder holder1 =
+ TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {11, 22});
+ FixedSizeBinaryHolder holder2 =
+ TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {32, 21});
+
+ writer.startList();
+ writer.fixedSizeBinary().write(holder1);
+ holder1.buffer.close();
+ writer.fixedSizeBinary().write(holder2);
+ holder2.buffer.close();
+
+ writer.endList();
+ vector.setValueCount(1);
+
+ FieldReader reader = vector.getReader();
+ assertTrue(reader.isSet(), "shouldn't be null");
+
+ Field expectedDataField =
+ new Field(
+ BaseRepeatedValueVector.DATA_VECTOR_NAME,
+ FieldType.nullable(new ArrowType.FixedSizeBinary(2)),
+ null);
+ Field expectedField =
+ new Field(
+ vector.getName(),
+ FieldType.nullable(new ArrowType.FixedSizeList(2)),
+ List.of(expectedDataField));
+
+ assertEquals(expectedField, writer.getField());
+ }
+ }
+
private int[] convertListToIntArray(List list) {
int[] values = new int[list.size()];
for (int i = 0; i < list.size(); i++) {
diff --git a/vector/src/test/java/org/apache/arrow/vector/TestMapVector.java b/vector/src/test/java/org/apache/arrow/vector/TestMapVector.java
index 274d2973bd..2f520f3882 100644
--- a/vector/src/test/java/org/apache/arrow/vector/TestMapVector.java
+++ b/vector/src/test/java/org/apache/arrow/vector/TestMapVector.java
@@ -1353,17 +1353,6 @@ public void testCopyFromForExtensionType() throws Exception {
}
}
- private FixedSizeBinaryHolder getFixedSizeBinaryHolder(byte[] array) {
- FixedSizeBinaryHolder holder = new FixedSizeBinaryHolder();
- holder.byteWidth = array.length;
- holder.buffer = allocator.buffer(array.length);
- for (int i = 0; i < array.length; i++) {
- holder.buffer.setByte(i, array[i]);
- }
-
- return holder;
- }
-
/**
* Regression test for GH-586: UnionMapWriter.fixedSizeBinary() should properly delegate to the
* entry writer for both key and value paths.
@@ -1382,8 +1371,10 @@ public void testFixedSizeBinaryWriter() {
// {[11, 22] -> null}
// {null -> [32, 21]} - wrong "for a given entry, the "key" is non-nullable" - todo: it
// shouldn't work. Should it?
- FixedSizeBinaryHolder holder1 = getFixedSizeBinaryHolder(new byte[] {11, 22});
- FixedSizeBinaryHolder holder2 = getFixedSizeBinaryHolder(new byte[] {32, 21});
+ FixedSizeBinaryHolder holder1 =
+ TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {11, 22});
+ FixedSizeBinaryHolder holder2 =
+ TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {32, 21});
writer.setPosition(0); // optional
writer.startMap();
@@ -1399,8 +1390,8 @@ public void testFixedSizeBinaryWriter() {
writer.endMap();
// {1 -> [11, 22], 2 -> [32, 21]}
- holder1 = getFixedSizeBinaryHolder(new byte[] {11, 22});
- holder2 = getFixedSizeBinaryHolder(new byte[] {32, 21});
+ holder1 = TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {11, 22});
+ holder2 = TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {32, 21});
writer.setPosition(1);
writer.startMap();
writer.startEntry();
@@ -1416,8 +1407,8 @@ public void testFixedSizeBinaryWriter() {
holder2.buffer.close();
// {[11, 22] -> 1, [32, 21] -> 2}
- holder1 = getFixedSizeBinaryHolder(new byte[] {11, 22});
- holder2 = getFixedSizeBinaryHolder(new byte[] {32, 21});
+ holder1 = TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {11, 22});
+ holder2 = TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {32, 21});
writer.setPosition(3);
writer.startMap();
writer.startEntry();
@@ -1433,7 +1424,7 @@ public void testFixedSizeBinaryWriter() {
holder2.buffer.close();
// {[11, 22] -> null}
- holder1 = getFixedSizeBinaryHolder(new byte[] {11, 22});
+ holder1 = TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {11, 22});
writer.setPosition(4);
writer.startMap();
writer.startEntry();
@@ -1443,7 +1434,7 @@ public void testFixedSizeBinaryWriter() {
holder1.buffer.close();
// {null -> [32, 21]}
- holder2 = getFixedSizeBinaryHolder(new byte[] {32, 21});
+ holder2 = TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {32, 21});
writer.setPosition(5);
writer.startMap();
writer.startEntry();
@@ -1536,8 +1527,10 @@ public void testFixedSizeBinaryFirstInitialization() {
// populate input vector with the following records
// {[11, 22] -> [32, 21]}
- FixedSizeBinaryHolder holder1 = getFixedSizeBinaryHolder(new byte[] {11, 22});
- FixedSizeBinaryHolder holder2 = getFixedSizeBinaryHolder(new byte[] {32, 21});
+ FixedSizeBinaryHolder holder1 =
+ TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {11, 22});
+ FixedSizeBinaryHolder holder2 =
+ TestUtils.fixedSizeBinaryHolder(allocator, new byte[] {32, 21});
writer.setPosition(0); // optional
writer.startMap();
diff --git a/vector/src/test/java/org/apache/arrow/vector/TestUtils.java b/vector/src/test/java/org/apache/arrow/vector/TestUtils.java
index c28751aa58..d91b2004c0 100644
--- a/vector/src/test/java/org/apache/arrow/vector/TestUtils.java
+++ b/vector/src/test/java/org/apache/arrow/vector/TestUtils.java
@@ -18,6 +18,7 @@
import java.util.Random;
import org.apache.arrow.memory.BufferAllocator;
+import org.apache.arrow.vector.holders.FixedSizeBinaryHolder;
import org.apache.arrow.vector.types.Types.MinorType;
import org.apache.arrow.vector.types.pojo.ArrowType;
import org.apache.arrow.vector.types.pojo.ExtensionTypeRegistry;
@@ -73,4 +74,16 @@ public static void ensureRegistered(ArrowType.ExtensionType type) {
ExtensionTypeRegistry.register(type);
}
}
+
+ public static FixedSizeBinaryHolder fixedSizeBinaryHolder(
+ BufferAllocator allocator, byte[] array) {
+ FixedSizeBinaryHolder holder = new FixedSizeBinaryHolder();
+ holder.byteWidth = array.length;
+ holder.buffer = allocator.buffer(array.length);
+ for (int i = 0; i < array.length; i++) {
+ holder.buffer.setByte(i, array[i]);
+ }
+
+ return holder;
+ }
}
From 77df3ecb2cf5517fb5d37a4b2806844e3b4700df Mon Sep 17 00:00:00 2001
From: Yicong Huang <17627829+Yicong-Huang@users.noreply.github.com>
Date: Thu, 12 Mar 2026 01:39:44 -0700
Subject: [PATCH 027/120] GH-343: Fix BaseVariableWidthVector and
BaseLargeVariableWidthVector offset buffer serialization (#989)
## What's Changed
Fix `BaseVariableWidthVector`/`BaseLargeVariableWidthVector` IPC
serialization when `valueCount` is 0.
### Problem
When `valueCount == 0`, `setReaderAndWriterIndex()` was setting
`offsetBuffer.writerIndex(0)`, which means `readableBytes() == 0`. IPC
serializer uses `readableBytes()` to determine buffer size, so 0 bytes
were written to the IPC stream. This crashes IPC readers in other
libraries because Arrow spec requires offset buffer to have at least one
entry `[0]`.
This is a follow-up to #967 which fixed the same issue in
`ListVector`/`LargeListVector`.
### Fix
Modify `setReaderAndWriterIndex()` to always use `(valueCount + 1) *
OFFSET_WIDTH` for the offset buffer's `writerIndex`, moved outside the
if/else branch. When the offset buffer capacity is insufficient (e.g.,
empty buffer from constructor or loaded via `loadFieldBuffers()`), it
reallocates a properly sized buffer on demand.
### Testing
Added tests for empty `VarCharVector` and `LargeVarCharVector` verifying
offset buffer has correct `readableBytes()` after `setValueCount(0)`.
Closes #343
---------
Co-authored-by: Yicong Huang
---
.../adapter/jdbc/ResultSetUtilityTest.java | 22 ++++++-----
.../vector/BaseLargeVariableWidthVector.java | 16 +++++++-
.../arrow/vector/BaseVariableWidthVector.java | 16 +++++++-
.../apache/arrow/vector/TestValueVector.java | 38 +++++++++++++++++++
4 files changed, 79 insertions(+), 13 deletions(-)
diff --git a/adapter/jdbc/src/test/java/org/apache/arrow/adapter/jdbc/ResultSetUtilityTest.java b/adapter/jdbc/src/test/java/org/apache/arrow/adapter/jdbc/ResultSetUtilityTest.java
index c7dc9b2791..e5039ccf59 100644
--- a/adapter/jdbc/src/test/java/org/apache/arrow/adapter/jdbc/ResultSetUtilityTest.java
+++ b/adapter/jdbc/src/test/java/org/apache/arrow/adapter/jdbc/ResultSetUtilityTest.java
@@ -43,15 +43,19 @@ public void testZeroRowResultSet() throws Exception {
.setReuseVectorSchemaRoot(reuseVectorSchemaRoot)
.build();
- ArrowVectorIterator iter = JdbcToArrow.sqlToArrowVectorIterator(rs, config);
- assertTrue(iter.hasNext(), "Iterator on zero row ResultSet should haveNext() before use");
- VectorSchemaRoot root = iter.next();
- assertNotNull(root, "VectorSchemaRoot from first next() result should never be null");
- assertEquals(
- 0, root.getRowCount(), "VectorSchemaRoot from empty ResultSet should have zero rows");
- assertFalse(
- iter.hasNext(),
- "hasNext() should return false on empty ResultSets after initial next() call");
+ try (ArrowVectorIterator iter = JdbcToArrow.sqlToArrowVectorIterator(rs, config)) {
+ assertTrue(iter.hasNext(), "Iterator on zero row ResultSet should haveNext() before use");
+ VectorSchemaRoot root = iter.next();
+ assertNotNull(root, "VectorSchemaRoot from first next() result should never be null");
+ assertEquals(
+ 0, root.getRowCount(), "VectorSchemaRoot from empty ResultSet should have zero rows");
+ assertFalse(
+ iter.hasNext(),
+ "hasNext() should return false on empty ResultSets after initial next() call");
+ if (!reuseVectorSchemaRoot) {
+ root.close();
+ }
+ }
}
}
}
diff --git a/vector/src/main/java/org/apache/arrow/vector/BaseLargeVariableWidthVector.java b/vector/src/main/java/org/apache/arrow/vector/BaseLargeVariableWidthVector.java
index 6c451f10a7..3fac195786 100644
--- a/vector/src/main/java/org/apache/arrow/vector/BaseLargeVariableWidthVector.java
+++ b/vector/src/main/java/org/apache/arrow/vector/BaseLargeVariableWidthVector.java
@@ -373,14 +373,26 @@ private void setReaderAndWriterIndex() {
valueBuffer.readerIndex(0);
if (valueCount == 0) {
validityBuffer.writerIndex(0);
- offsetBuffer.writerIndex(0);
valueBuffer.writerIndex(0);
} else {
final long lastDataOffset = getStartOffset(valueCount);
validityBuffer.writerIndex(BitVectorHelper.getValidityBufferSizeFromCount(valueCount));
- offsetBuffer.writerIndex((long) (valueCount + 1) * OFFSET_WIDTH);
valueBuffer.writerIndex(lastDataOffset);
}
+ // IPC serializer will determine readable bytes based on `readerIndex` and `writerIndex`.
+ // Both are set to 0 means 0 bytes are written to the IPC stream which will crash IPC readers
+ // in other libraries. According to Arrow spec, we should still output the offset buffer which
+ // is [0].
+ final long requiredOffsetBufferSize = (long) (valueCount + 1) * OFFSET_WIDTH;
+ if (offsetBuffer.capacity() < requiredOffsetBufferSize) {
+ ArrowBuf newOffsetBuffer = allocateOffsetBuffer(requiredOffsetBufferSize);
+ if (offsetBuffer.capacity() > 0) {
+ newOffsetBuffer.setBytes(0, offsetBuffer, 0, offsetBuffer.capacity());
+ }
+ offsetBuffer.getReferenceManager().release();
+ offsetBuffer = newOffsetBuffer;
+ }
+ offsetBuffer.writerIndex(requiredOffsetBufferSize);
}
/** Same as {@link #allocateNewSafe()}. */
diff --git a/vector/src/main/java/org/apache/arrow/vector/BaseVariableWidthVector.java b/vector/src/main/java/org/apache/arrow/vector/BaseVariableWidthVector.java
index 96e2afbd29..d5bd167256 100644
--- a/vector/src/main/java/org/apache/arrow/vector/BaseVariableWidthVector.java
+++ b/vector/src/main/java/org/apache/arrow/vector/BaseVariableWidthVector.java
@@ -389,14 +389,26 @@ private void setReaderAndWriterIndex() {
valueBuffer.readerIndex(0);
if (valueCount == 0) {
validityBuffer.writerIndex(0);
- offsetBuffer.writerIndex(0);
valueBuffer.writerIndex(0);
} else {
final int lastDataOffset = getStartOffset(valueCount);
validityBuffer.writerIndex(BitVectorHelper.getValidityBufferSizeFromCount(valueCount));
- offsetBuffer.writerIndex((long) (valueCount + 1) * OFFSET_WIDTH);
valueBuffer.writerIndex(lastDataOffset);
}
+ // IPC serializer will determine readable bytes based on `readerIndex` and `writerIndex`.
+ // Both are set to 0 means 0 bytes are written to the IPC stream which will crash IPC readers
+ // in other libraries. According to Arrow spec, we should still output the offset buffer which
+ // is [0].
+ final long requiredOffsetBufferSize = (long) (valueCount + 1) * OFFSET_WIDTH;
+ if (offsetBuffer.capacity() < requiredOffsetBufferSize) {
+ ArrowBuf newOffsetBuffer = allocateOffsetBuffer(requiredOffsetBufferSize);
+ if (offsetBuffer.capacity() > 0) {
+ newOffsetBuffer.setBytes(0, offsetBuffer, 0, offsetBuffer.capacity());
+ }
+ offsetBuffer.getReferenceManager().release();
+ offsetBuffer = newOffsetBuffer;
+ }
+ offsetBuffer.writerIndex(requiredOffsetBufferSize);
}
/** Same as {@link #allocateNewSafe()}. */
diff --git a/vector/src/test/java/org/apache/arrow/vector/TestValueVector.java b/vector/src/test/java/org/apache/arrow/vector/TestValueVector.java
index df42d04e60..22c93b0cbe 100644
--- a/vector/src/test/java/org/apache/arrow/vector/TestValueVector.java
+++ b/vector/src/test/java/org/apache/arrow/vector/TestValueVector.java
@@ -3940,4 +3940,42 @@ public void testVectorLoadUnloadOnNonVariadicVectors() {
}
}
}
+
+ @Test
+ public void testEmptyVarCharOffsetBuffer() {
+ // Validates that offset buffer has at least OFFSET_WIDTH bytes (for offset[0]=0)
+ // even when valueCount is 0, per Arrow specification.
+ try (VarCharVector vector = newVarCharVector("varchar", allocator)) {
+ vector.allocateNew();
+ vector.setValueCount(0);
+
+ List buffers = vector.getFieldBuffers();
+ // buffers: [validity, offset, data]
+ assertTrue(
+ buffers.get(1).readableBytes() >= BaseVariableWidthVector.OFFSET_WIDTH,
+ "Offset buffer should have at least "
+ + BaseVariableWidthVector.OFFSET_WIDTH
+ + " bytes for offset[0]");
+ assertEquals(0, vector.getOffsetBuffer().getInt(0));
+ }
+ }
+
+ @Test
+ public void testEmptyLargeVarCharOffsetBuffer() {
+ // Validates that offset buffer has at least OFFSET_WIDTH bytes (for offset[0]=0)
+ // even when valueCount is 0, per Arrow specification.
+ try (LargeVarCharVector vector = new LargeVarCharVector("largevarchar", allocator)) {
+ vector.allocateNew();
+ vector.setValueCount(0);
+
+ List buffers = vector.getFieldBuffers();
+ // buffers: [validity, offset, data]
+ assertTrue(
+ buffers.get(1).readableBytes() >= BaseLargeVariableWidthVector.OFFSET_WIDTH,
+ "Offset buffer should have at least "
+ + BaseLargeVariableWidthVector.OFFSET_WIDTH
+ + " bytes for offset[0]");
+ assertEquals(0, vector.getOffsetBuffer().getLong(0));
+ }
+ }
}
From b410fb26d01c7cefc4c6e3443a53562164001371 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?=
Date: Thu, 12 Mar 2026 11:58:50 +0100
Subject: [PATCH 028/120] MINOR: Bump version to 19.0.0 (#1066)
---
adapter/avro/pom.xml | 2 +-
adapter/jdbc/pom.xml | 2 +-
adapter/orc/pom.xml | 2 +-
algorithm/pom.xml | 2 +-
arrow-variant/pom.xml | 2 +-
bom/pom.xml | 4 ++--
c/pom.xml | 2 +-
compression/pom.xml | 2 +-
dataset/pom.xml | 2 +-
flight/flight-core/pom.xml | 2 +-
flight/flight-integration-tests/pom.xml | 2 +-
flight/flight-sql-jdbc-core/pom.xml | 2 +-
flight/flight-sql-jdbc-driver/pom.xml | 2 +-
flight/flight-sql/pom.xml | 2 +-
flight/pom.xml | 2 +-
format/pom.xml | 2 +-
gandiva/pom.xml | 2 +-
memory/memory-core/pom.xml | 2 +-
memory/memory-netty-buffer-patch/pom.xml | 2 +-
memory/memory-netty/pom.xml | 2 +-
memory/memory-unsafe/pom.xml | 2 +-
memory/pom.xml | 2 +-
performance/pom.xml | 2 +-
pom.xml | 6 +++---
tools/pom.xml | 2 +-
vector/pom.xml | 2 +-
26 files changed, 29 insertions(+), 29 deletions(-)
diff --git a/adapter/avro/pom.xml b/adapter/avro/pom.xml
index 827d19f2a2..18c48a0e8f 100644
--- a/adapter/avro/pom.xml
+++ b/adapter/avro/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
../../pom.xml
diff --git a/adapter/jdbc/pom.xml b/adapter/jdbc/pom.xml
index 2f621d7a05..a0819d7aef 100644
--- a/adapter/jdbc/pom.xml
+++ b/adapter/jdbc/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
../../pom.xml
diff --git a/adapter/orc/pom.xml b/adapter/orc/pom.xml
index c96ab36119..fbb72d6c19 100644
--- a/adapter/orc/pom.xml
+++ b/adapter/orc/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
../../pom.xml
diff --git a/algorithm/pom.xml b/algorithm/pom.xml
index 898c2605b6..116be9aebf 100644
--- a/algorithm/pom.xml
+++ b/algorithm/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-algorithm
Arrow Algorithms
diff --git a/arrow-variant/pom.xml b/arrow-variant/pom.xml
index 3a842178a4..fea724824b 100644
--- a/arrow-variant/pom.xml
+++ b/arrow-variant/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-variant
Arrow Variant
diff --git a/bom/pom.xml b/bom/pom.xml
index 0de43a1217..6a4f741fca 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -29,7 +29,7 @@ under the License.
org.apache.arrow
arrow-bom
- 19.0.0-SNAPSHOT
+ 19.0.0
pom
Arrow Bill of Materials
@@ -68,7 +68,7 @@ under the License.
scm:git:https://github.com/apache/arrow-java.git
scm:git:https://github.com/apache/arrow-java.git
- main
+ v19.0.0
https://github.com/apache/arrow-java/tree/${project.scm.tag}
diff --git a/c/pom.xml b/c/pom.xml
index c90b6dc0ef..b0a7ffe41d 100644
--- a/c/pom.xml
+++ b/c/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-c-data
diff --git a/compression/pom.xml b/compression/pom.xml
index 29f8b41788..92144addc4 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-compression
Arrow Compression
diff --git a/dataset/pom.xml b/dataset/pom.xml
index 1852c6eddc..df5620c641 100644
--- a/dataset/pom.xml
+++ b/dataset/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-dataset
diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index f1d58a0cad..fbed544a1b 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0-SNAPSHOT
+ 19.0.0
flight-core
diff --git a/flight/flight-integration-tests/pom.xml b/flight/flight-integration-tests/pom.xml
index f0f10ada43..5ee7c6fc14 100644
--- a/flight/flight-integration-tests/pom.xml
+++ b/flight/flight-integration-tests/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0-SNAPSHOT
+ 19.0.0
flight-integration-tests
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index da00baf32a..d6fa11688d 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0-SNAPSHOT
+ 19.0.0
flight-sql-jdbc-core
diff --git a/flight/flight-sql-jdbc-driver/pom.xml b/flight/flight-sql-jdbc-driver/pom.xml
index 559c42597d..e6f23bcb08 100644
--- a/flight/flight-sql-jdbc-driver/pom.xml
+++ b/flight/flight-sql-jdbc-driver/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0-SNAPSHOT
+ 19.0.0
flight-sql-jdbc-driver
diff --git a/flight/flight-sql/pom.xml b/flight/flight-sql/pom.xml
index a5954819c3..a58b76acda 100644
--- a/flight/flight-sql/pom.xml
+++ b/flight/flight-sql/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0-SNAPSHOT
+ 19.0.0
flight-sql
diff --git a/flight/pom.xml b/flight/pom.xml
index 2fc3e89ef8..a5a40a834a 100644
--- a/flight/pom.xml
+++ b/flight/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-flight
diff --git a/format/pom.xml b/format/pom.xml
index d3578b63d2..c09fad32fb 100644
--- a/format/pom.xml
+++ b/format/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-format
diff --git a/gandiva/pom.xml b/gandiva/pom.xml
index 5367bfdedf..d26edeb9d6 100644
--- a/gandiva/pom.xml
+++ b/gandiva/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
org.apache.arrow.gandiva
diff --git a/memory/memory-core/pom.xml b/memory/memory-core/pom.xml
index 72ee69d60a..586fddae1a 100644
--- a/memory/memory-core/pom.xml
+++ b/memory/memory-core/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-memory-core
diff --git a/memory/memory-netty-buffer-patch/pom.xml b/memory/memory-netty-buffer-patch/pom.xml
index 07dc7d2403..cb38efa345 100644
--- a/memory/memory-netty-buffer-patch/pom.xml
+++ b/memory/memory-netty-buffer-patch/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-memory-netty-buffer-patch
diff --git a/memory/memory-netty/pom.xml b/memory/memory-netty/pom.xml
index 6d660da117..f33eb95e44 100644
--- a/memory/memory-netty/pom.xml
+++ b/memory/memory-netty/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-memory-netty
diff --git a/memory/memory-unsafe/pom.xml b/memory/memory-unsafe/pom.xml
index 92dc0c9fe5..d941fee645 100644
--- a/memory/memory-unsafe/pom.xml
+++ b/memory/memory-unsafe/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-memory-unsafe
diff --git a/memory/pom.xml b/memory/pom.xml
index bc34c26050..af953ccd21 100644
--- a/memory/pom.xml
+++ b/memory/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-memory
pom
diff --git a/performance/pom.xml b/performance/pom.xml
index 3f18188e3a..685f433f05 100644
--- a/performance/pom.xml
+++ b/performance/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-performance
jar
diff --git a/pom.xml b/pom.xml
index 19625617b1..0b0aa58232 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
pom
Apache Arrow Java Root POM
@@ -82,7 +82,7 @@ under the License.
scm:git:https://github.com/apache/arrow-java.git
scm:git:https://github.com/apache/arrow-java.git
- main
+ v19.0.0
https://github.com/apache/arrow-java/tree/${project.scm.tag}
@@ -92,7 +92,7 @@ under the License.
- 1695310533
+ 1773307790
${project.build.directory}/generated-sources
1.9.0
5.12.2
diff --git a/tools/pom.xml b/tools/pom.xml
index d43adb1fdf..9e557bab76 100644
--- a/tools/pom.xml
+++ b/tools/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-tools
Arrow Tools
diff --git a/vector/pom.xml b/vector/pom.xml
index f46bd0e7b4..bc64cbc76b 100644
--- a/vector/pom.xml
+++ b/vector/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0-SNAPSHOT
+ 19.0.0
arrow-vector
Arrow Vectors
From 77127ef54272b578075c574071f24ee8c1bba22e Mon Sep 17 00:00:00 2001
From: Sutou Kouhei
Date: Mon, 16 Mar 2026 16:17:40 +0900
Subject: [PATCH 029/120] GH-1077: Add missing `export GH_TOKEN` to release
scripts
---
dev/release/bump_version.sh | 1 +
dev/release/release.sh | 1 +
dev/release/release_rc.sh | 1 +
3 files changed, 3 insertions(+)
diff --git a/dev/release/bump_version.sh b/dev/release/bump_version.sh
index 458e930f98..68cafb99bd 100755
--- a/dev/release/bump_version.sh
+++ b/dev/release/bump_version.sh
@@ -37,6 +37,7 @@ if [ ! -f "${SOURCE_DIR}/.env" ]; then
exit 1
fi
. "${SOURCE_DIR}/.env"
+export GH_TOKEN
cd "${SOURCE_TOP_DIR}"
diff --git a/dev/release/release.sh b/dev/release/release.sh
index f08a618c4f..d1db7ad05a 100755
--- a/dev/release/release.sh
+++ b/dev/release/release.sh
@@ -36,6 +36,7 @@ if [ ! -f "${SOURCE_DIR}/.env" ]; then
exit 1
fi
. "${SOURCE_DIR}/.env"
+export GH_TOKEN
git_origin_url="$(git remote get-url origin)"
repository="${git_origin_url#*github.com?}"
diff --git a/dev/release/release_rc.sh b/dev/release/release_rc.sh
index ff77718b8d..0920edbe35 100755
--- a/dev/release/release_rc.sh
+++ b/dev/release/release_rc.sh
@@ -42,6 +42,7 @@ if [ ! -f "${SOURCE_DIR}/.env" ]; then
exit 1
fi
. "${SOURCE_DIR}/.env"
+export GH_TOKEN
cd "${SOURCE_TOP_DIR}"
From d5e132b96500646ea4021d3b032d00a65233b6b5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 08:45:29 +0100
Subject: [PATCH 030/120] MINOR: [CI] Bump actions/download-artifact from 8.0.0
to 8.0.1 (#1068)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[actions/download-artifact](https://github.com/actions/download-artifact)
from 8.0.0 to 8.0.1.
Release notes
Sourced from actions/download-artifact's
releases.
v8.0.1
What's Changed
Full Changelog: https://github.com/actions/download-artifact/compare/v8...v8.0.1
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/rc.yml | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index a202777143..4973b1afb5 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -101,7 +101,7 @@ jobs:
packages: write
steps:
- name: Download source archive
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-source
- name: Extract source archive
@@ -168,7 +168,7 @@ jobs:
MACOSX_DEPLOYMENT_TARGET: "14.0"
steps:
- name: Download source archive
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-source
- name: Extract source archive
@@ -296,7 +296,7 @@ jobs:
arch: "x86_64"
steps:
- name: Download source archive
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-source
- name: Extract source archive
@@ -369,7 +369,7 @@ jobs:
- jni-windows
steps:
- name: Download artifacts
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
path: artifacts
- name: Decompress artifacts
@@ -450,11 +450,11 @@ jobs:
with:
cache: 'pip'
- name: Download source archive
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-source
- name: Download Javadocs
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: reference
- name: Extract source archive
@@ -519,7 +519,7 @@ jobs:
cp ../.asf.yaml ./
git add .nojekyll .asf.yaml
- name: Download
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-html
- name: Extract
@@ -555,7 +555,7 @@ jobs:
- ubuntu-latest
steps:
- name: Download release artifacts
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: release-*
- name: Verify
@@ -589,7 +589,7 @@ jobs:
contents: write
steps:
- name: Download release artifacts
- uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: release-*
path: artifacts
From fa781dcc3c42ab98214743e3aef1eb8fd5297209 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 08:45:54 +0100
Subject: [PATCH 031/120] MINOR: Bump com.squareup.okio:okio-jvm from 3.16.4 to
3.17.0 (#1075)
Bumps [com.squareup.okio:okio-jvm](https://github.com/square/okio) from
3.16.4 to 3.17.0.
Changelog
Sourced from com.squareup.okio:okio-jvm's
changelog.
Version 3.17.0
2026-03-11
-
New: Adjust down the Kotlin stdlib dependency to [Kotlin
2.1.21][kotlin_2_1_21]. Okio is built
with an up-to-date Kotlin compiler (2.2.21), but depends on an older
kotlin-stdlib. We're doing
this so you can update Okio and Kotlin independently.
-
Fix: Return the correct timestamp in
FileMetadata.createdAtMillis on Kotlin/Native on UNIX
platforms. We were incorrectly using the POSIX ctime
(change time) instead of the
birthtime. With this fix Okio now prefers
statx() over stat() on native platforms. This
API first appeared in Linux in 4.11 (2017) and Android in API 30
(2020).
Commits
80a5023
Prepare for release 3.17.0.65c0c26
Switch to FileMetadata to use statx instead of stat on Linux and Apple
platfo...b11f17b
Remove Kotlin/JS IR default parameter workarounds. (#1786)b35f473
Update Gradle to v9.4.0 (#1785)cbcee31
Update actions/upload-artifact action to v7 (#1783)fc7aecb
Update dependency com.android.tools.build:gradle to v9.0.1 (#1781)79aa267
Drop isWasm() early return workaround for KT-60212. (#1777)45459dc
Fix result of an 'errnoToIOException' call is not thrown. inside
`PosixFileSy...9fbab0f
Decode env variables in WASI tests (#1773)50abe89
Stop using AssertJ (#1771)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index d6fa11688d..4b8122fa4d 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -141,7 +141,7 @@ under the License.
com.squareup.okio
okio-jvm
- 3.16.4
+ 3.17.0
test
From 47cd032939f15edbfc7c87fbcb02d585f82e5948 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 08:46:10 +0100
Subject: [PATCH 032/120] MINOR: Bump org.codehaus.mojo:properties-maven-plugin
from 1.2.1 to 1.3.0 (#1072)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[org.codehaus.mojo:properties-maven-plugin](https://github.com/mojohaus/properties-maven-plugin)
from 1.2.1 to 1.3.0.
Release notes
Sourced from org.codehaus.mojo:properties-maven-plugin's
releases.
1.3.0
🚀 New features and improvements
👻 Maintenance
🔧 Build
📦 Dependency updates
Commits
91a2ade
[maven-release-plugin] prepare release
properties-maven-plugin-1.3.0bf56d32
Bump org.codehaus.mojo:mojo-parent from 94 to 9580e20be
Bump org.codehaus.mojo:mojo-parent from 93 to 94e8ae7a5
Bump org.yaml:snakeyaml from 2.4 to 2.5bb39c3d
Bump org.codehaus.mojo:mojo-parent from 92 to 93b41267b
Bump org.codehaus.mojo:mojo-parent from 91 to 92bb548c5
Bump org.codehaus.mojo:mojo-parent from 87 to 913ffa9cb
Use Sisu plugin7adbe3b
Require Maven 3.6.3407342f
Bump org.yaml:snakeyaml from 2.3 to 2.4- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 0b0aa58232..a414dcd229 100644
--- a/pom.xml
+++ b/pom.xml
@@ -502,7 +502,7 @@ under the License.
org.codehaus.mojo
properties-maven-plugin
- 1.2.1
+ 1.3.0
org.codehaus.mojo
From 4242d587b25a74e944f2a01e79d52dcd401d5cf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?=
Date: Mon, 16 Mar 2026 09:37:09 +0100
Subject: [PATCH 033/120] MINOR: Bump version to 20.0.0-SNAPSHOT (#1076)
---
adapter/avro/pom.xml | 2 +-
adapter/jdbc/pom.xml | 2 +-
adapter/orc/pom.xml | 2 +-
algorithm/pom.xml | 2 +-
arrow-variant/pom.xml | 2 +-
bom/pom.xml | 4 ++--
c/pom.xml | 2 +-
compression/pom.xml | 2 +-
dataset/pom.xml | 2 +-
flight/flight-core/pom.xml | 2 +-
flight/flight-integration-tests/pom.xml | 2 +-
flight/flight-sql-jdbc-core/pom.xml | 2 +-
flight/flight-sql-jdbc-driver/pom.xml | 2 +-
flight/flight-sql/pom.xml | 2 +-
flight/pom.xml | 2 +-
format/pom.xml | 2 +-
gandiva/pom.xml | 2 +-
memory/memory-core/pom.xml | 2 +-
memory/memory-netty-buffer-patch/pom.xml | 2 +-
memory/memory-netty/pom.xml | 2 +-
memory/memory-unsafe/pom.xml | 2 +-
memory/pom.xml | 2 +-
performance/pom.xml | 2 +-
pom.xml | 6 +++---
tools/pom.xml | 2 +-
vector/pom.xml | 2 +-
26 files changed, 29 insertions(+), 29 deletions(-)
diff --git a/adapter/avro/pom.xml b/adapter/avro/pom.xml
index 18c48a0e8f..4f7f90d7a9 100644
--- a/adapter/avro/pom.xml
+++ b/adapter/avro/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
../../pom.xml
diff --git a/adapter/jdbc/pom.xml b/adapter/jdbc/pom.xml
index a0819d7aef..9ff44593ff 100644
--- a/adapter/jdbc/pom.xml
+++ b/adapter/jdbc/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
../../pom.xml
diff --git a/adapter/orc/pom.xml b/adapter/orc/pom.xml
index fbb72d6c19..50a9b3a603 100644
--- a/adapter/orc/pom.xml
+++ b/adapter/orc/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
../../pom.xml
diff --git a/algorithm/pom.xml b/algorithm/pom.xml
index 116be9aebf..24adcefa6f 100644
--- a/algorithm/pom.xml
+++ b/algorithm/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-algorithm
Arrow Algorithms
diff --git a/arrow-variant/pom.xml b/arrow-variant/pom.xml
index fea724824b..e578626dd4 100644
--- a/arrow-variant/pom.xml
+++ b/arrow-variant/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-variant
Arrow Variant
diff --git a/bom/pom.xml b/bom/pom.xml
index 6a4f741fca..f9200a7e8d 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -29,7 +29,7 @@ under the License.
org.apache.arrow
arrow-bom
- 19.0.0
+ 20.0.0-SNAPSHOT
pom
Arrow Bill of Materials
@@ -68,7 +68,7 @@ under the License.
scm:git:https://github.com/apache/arrow-java.git
scm:git:https://github.com/apache/arrow-java.git
- v19.0.0
+ main
https://github.com/apache/arrow-java/tree/${project.scm.tag}
diff --git a/c/pom.xml b/c/pom.xml
index b0a7ffe41d..27b6619c4c 100644
--- a/c/pom.xml
+++ b/c/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-c-data
diff --git a/compression/pom.xml b/compression/pom.xml
index 92144addc4..945738d2b8 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-compression
Arrow Compression
diff --git a/dataset/pom.xml b/dataset/pom.xml
index df5620c641..7a0210ce95 100644
--- a/dataset/pom.xml
+++ b/dataset/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-dataset
diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index fbed544a1b..92490dd67b 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0
+ 20.0.0-SNAPSHOT
flight-core
diff --git a/flight/flight-integration-tests/pom.xml b/flight/flight-integration-tests/pom.xml
index 5ee7c6fc14..ec81162e59 100644
--- a/flight/flight-integration-tests/pom.xml
+++ b/flight/flight-integration-tests/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0
+ 20.0.0-SNAPSHOT
flight-integration-tests
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 4b8122fa4d..53c630ab40 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0
+ 20.0.0-SNAPSHOT
flight-sql-jdbc-core
diff --git a/flight/flight-sql-jdbc-driver/pom.xml b/flight/flight-sql-jdbc-driver/pom.xml
index e6f23bcb08..55de7221ec 100644
--- a/flight/flight-sql-jdbc-driver/pom.xml
+++ b/flight/flight-sql-jdbc-driver/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0
+ 20.0.0-SNAPSHOT
flight-sql-jdbc-driver
diff --git a/flight/flight-sql/pom.xml b/flight/flight-sql/pom.xml
index a58b76acda..b7c8931391 100644
--- a/flight/flight-sql/pom.xml
+++ b/flight/flight-sql/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-flight
- 19.0.0
+ 20.0.0-SNAPSHOT
flight-sql
diff --git a/flight/pom.xml b/flight/pom.xml
index a5a40a834a..30f75fa27e 100644
--- a/flight/pom.xml
+++ b/flight/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-flight
diff --git a/format/pom.xml b/format/pom.xml
index c09fad32fb..8c2f2d3387 100644
--- a/format/pom.xml
+++ b/format/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-format
diff --git a/gandiva/pom.xml b/gandiva/pom.xml
index d26edeb9d6..190bf016ce 100644
--- a/gandiva/pom.xml
+++ b/gandiva/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
org.apache.arrow.gandiva
diff --git a/memory/memory-core/pom.xml b/memory/memory-core/pom.xml
index 586fddae1a..1c7b6f8834 100644
--- a/memory/memory-core/pom.xml
+++ b/memory/memory-core/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-memory-core
diff --git a/memory/memory-netty-buffer-patch/pom.xml b/memory/memory-netty-buffer-patch/pom.xml
index cb38efa345..039b2aa04a 100644
--- a/memory/memory-netty-buffer-patch/pom.xml
+++ b/memory/memory-netty-buffer-patch/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-memory-netty-buffer-patch
diff --git a/memory/memory-netty/pom.xml b/memory/memory-netty/pom.xml
index f33eb95e44..4218910980 100644
--- a/memory/memory-netty/pom.xml
+++ b/memory/memory-netty/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-memory-netty
diff --git a/memory/memory-unsafe/pom.xml b/memory/memory-unsafe/pom.xml
index d941fee645..3fafb42802 100644
--- a/memory/memory-unsafe/pom.xml
+++ b/memory/memory-unsafe/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-memory
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-memory-unsafe
diff --git a/memory/pom.xml b/memory/pom.xml
index af953ccd21..4ea3d1f9ca 100644
--- a/memory/pom.xml
+++ b/memory/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-memory
pom
diff --git a/performance/pom.xml b/performance/pom.xml
index 685f433f05..96ea5291ad 100644
--- a/performance/pom.xml
+++ b/performance/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-performance
jar
diff --git a/pom.xml b/pom.xml
index a414dcd229..43149bc957 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
pom
Apache Arrow Java Root POM
@@ -82,7 +82,7 @@ under the License.
scm:git:https://github.com/apache/arrow-java.git
scm:git:https://github.com/apache/arrow-java.git
- v19.0.0
+ main
https://github.com/apache/arrow-java/tree/${project.scm.tag}
@@ -92,7 +92,7 @@ under the License.
- 1773307790
+ 1773644827
${project.build.directory}/generated-sources
1.9.0
5.12.2
diff --git a/tools/pom.xml b/tools/pom.xml
index 9e557bab76..64634b9abe 100644
--- a/tools/pom.xml
+++ b/tools/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-tools
Arrow Tools
diff --git a/vector/pom.xml b/vector/pom.xml
index bc64cbc76b..4d247961c9 100644
--- a/vector/pom.xml
+++ b/vector/pom.xml
@@ -22,7 +22,7 @@ under the License.
org.apache.arrow
arrow-java-root
- 19.0.0
+ 20.0.0-SNAPSHOT
arrow-vector
Arrow Vectors
From 74a7996d40226c659c3b0ae03c0ae75a4964f282 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 09:55:27 +0100
Subject: [PATCH 034/120] MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.20.1
to 11.34 (#1074)
Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.20.1 to 11.34.
Changelog
Sourced from com.nimbusds:oauth2-oidc-sdk's
changelog.
version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.
version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.
version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.
version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).
version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.
version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.
version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.
version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.
version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.
version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.
version 2.9 (2013-09-17)
... (truncated)
Commits
668f6d8
The ParseException message thrown by Prompt.Type.parse must not include
parse...75cde87
Updates test sample X.509 cert chain resourcea7a9623
[maven-release-plugin] prepare release 11.30.2e03c9bb
[maven-release-plugin] prepare for next development iteration6f11e30
Expands AMR test coverageafba676
Adds static AMR.parseList(Collection<String>) method4b700b3
[maven-release-plugin] prepare release 11.31b214cfa
[maven-release-plugin] prepare for next development iteration28628f9
The DPoPCommonVerifier must instantiate the DPoPProofClaimsSetVerifier
with t...4df4d53
The DPoPCommonVerifier must instantiate the DPoPProofClaimsSetVerifier
with t...- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 53c630ab40..ffeff12462 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -182,7 +182,7 @@ under the License.
com.nimbusds
oauth2-oidc-sdk
- 11.20.1
+ 11.34
From 97e491399382215e248b3ba33e7f0d7d9650da5e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 09:59:10 +0100
Subject: [PATCH 035/120] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-6 to
1.5.7-7 (#1073)
Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-6 to 1.5.7-7.
Commits
73bfa27
Bump version to v1.5.7-7322f6bc
Update GH actionsd18bc0a
Use latest MacOS runners1051112
Fix typo in ZstdDictCompress.java2d94b35
address7c2e3ff
Avoid SetLongField call when GetPrimitiveArrayCritical return NULLd82feda
fix: ZstdInputStream decompression failure when underlying stream
returns 0 t...- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
compression/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/compression/pom.xml b/compression/pom.xml
index 945738d2b8..9014b6913a 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
com.github.luben
zstd-jni
- 1.5.7-6
+ 1.5.7-7
From 394d12ef455fad83f76ec4b3a79ac6b5c6fe1139 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 10:04:36 +0100
Subject: [PATCH 036/120] MINOR: Bump com.fasterxml.jackson:jackson-bom from
2.21.0 to 2.21.1 (#1071)
Bumps
[com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom)
from 2.21.0 to 2.21.1.
Commits
08a5a9a
[maven-release-plugin] prepare release jackson-bom-2.21.15b03376
Prep for 2.21.1 release1d78778
Merge branch '2.20' into 2.21cd46b24
Post-release dep version bump17179ff
[maven-release-plugin] prepare for next development iteration2a26844
[maven-release-plugin] prepare release jackson-bom-2.20.26adf11b
Prep for 2.20.2 release441df8a
Post-release version bumpa1b4814
[maven-release-plugin] prepare for next development iteration- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 43149bc957..eb7768780f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,7 +101,7 @@ under the License.
4.2.9.Final
1.79.0
4.33.4
- 2.21.0
+ 2.21.1
3.4.3
25.2.10
1.12.1
From 27382cd92baf29762dba2454d7e9e911c58821e3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 10:07:18 +0100
Subject: [PATCH 037/120] MINOR: Bump checker.framework.version from 3.53.1 to
3.54.0 (#1070)
Bumps `checker.framework.version` from 3.53.1 to 3.54.0.
Updates `org.checkerframework:checker-qual` from 3.53.1 to 3.54.0
Release notes
Sourced from org.checkerframework:checker-qual's
releases.
Checker Framework 3.54.0
Version 3.54.0 (2026-03-02)
User-visible changes
Command-line arguments:
- Added
-AinferOutputDirectory.
- Removed long-deprecated
-Alint=forbidnonnullarraycomponents.
New command-line argument -Aonelinemsg puts error
messages on a single line. This is useful when using a tool that only
shows the first line of the error.
The command-line argument -Anomsgtext surrounds the
error key with brackets instead of parenthesis. This matches Java error
messages.
Implementation details
In AnnotatedTypeFactory,
canonicalAnnotation() returns a non-null value.
In AnnotationClassLoader:
- Renamed
hasWellDefinedTargetMetaAnnotation() to
isTypeQualifierAnnotation(). The method now returns
true for annotations bearing
@InvisibleQualifier or @SubtypeOf, in addition
to the existing @Target(TYPE_USE) check.
In TestDiagnostic:
- Renamed field
message to key.
- Added new nullable field
message for the full message
without the key.
Removed classes and methods that have been deprecated for more than
two years.
Closed issues
#6874,
#7471,
#7475,
#7486.
Changelog
Sourced from org.checkerframework:checker-qual's
changelog.
Version 3.54.0 (2026-03-02)
User-visible changes
Command-line arguments:
- Added
-AinferOutputDirectory.
- Removed long-deprecated
-Alint=forbidnonnullarraycomponents.
New command-line argument -Aonelinemsg puts error
messages on a single line.
This is useful when using a tool that only shows the first line of the
error.
The command-line argument -Anomsgtext surrounds the
error key with brackets
instead of parenthesis. This matches Java error messages.
Implementation details
In AnnotatedTypeFactory,
canonicalAnnotation() returns a non-null value.
In AnnotationClassLoader:
- Renamed
hasWellDefinedTargetMetaAnnotation() to
isTypeQualifierAnnotation().
The method now returns true for annotations bearing
@InvisibleQualifier
or @SubtypeOf, in addition to the existing
@Target(TYPE_USE) check.
In TestDiagnostic:
- Renamed field
message to key.
- Added new nullable field
message for the full message
without the key.
Removed classes and methods that have been deprecated for more than
two years.
Closed issues
#6874,
#7471,
#7475,
#7486.
Commits
a6eff70
new release 3.54.0fd34700
Prep for release.edb6e7a
Print error key in brackets (#7525)a79b1de
Show details of the error message in test failures (#7513)a5ecc22
Clone the JDK using the same fork and branch as CF (#7491)2770c52
Update cimg/base Docker tag to v2026.03bba6bc9
Update plugin com-gradleup-shadow to v9.3.23a6d4d4
Update error-prone monorepo to v2.48.070aa5f3
Update plugin net-ltgt-errorprone to v5.1.00dbd3e7
Prepare for javac AST changes- Additional commits viewable in compare
view
Updates `org.checkerframework:checker` from 3.53.1 to 3.54.0
Release notes
Sourced from org.checkerframework:checker's
releases.
Checker Framework 3.54.0
Version 3.54.0 (2026-03-02)
User-visible changes
Command-line arguments:
- Added
-AinferOutputDirectory.
- Removed long-deprecated
-Alint=forbidnonnullarraycomponents.
New command-line argument -Aonelinemsg puts error
messages on a single line. This is useful when using a tool that only
shows the first line of the error.
The command-line argument -Anomsgtext surrounds the
error key with brackets instead of parenthesis. This matches Java error
messages.
Implementation details
In AnnotatedTypeFactory,
canonicalAnnotation() returns a non-null value.
In AnnotationClassLoader:
- Renamed
hasWellDefinedTargetMetaAnnotation() to
isTypeQualifierAnnotation(). The method now returns
true for annotations bearing
@InvisibleQualifier or @SubtypeOf, in addition
to the existing @Target(TYPE_USE) check.
In TestDiagnostic:
- Renamed field
message to key.
- Added new nullable field
message for the full message
without the key.
Removed classes and methods that have been deprecated for more than
two years.
Closed issues
#6874,
#7471,
#7475,
#7486.
Changelog
Sourced from org.checkerframework:checker's
changelog.
Version 3.54.0 (2026-03-02)
User-visible changes
Command-line arguments:
- Added
-AinferOutputDirectory.
- Removed long-deprecated
-Alint=forbidnonnullarraycomponents.
New command-line argument -Aonelinemsg puts error
messages on a single line.
This is useful when using a tool that only shows the first line of the
error.
The command-line argument -Anomsgtext surrounds the
error key with brackets
instead of parenthesis. This matches Java error messages.
Implementation details
In AnnotatedTypeFactory,
canonicalAnnotation() returns a non-null value.
In AnnotationClassLoader:
- Renamed
hasWellDefinedTargetMetaAnnotation() to
isTypeQualifierAnnotation().
The method now returns true for annotations bearing
@InvisibleQualifier
or @SubtypeOf, in addition to the existing
@Target(TYPE_USE) check.
In TestDiagnostic:
- Renamed field
message to key.
- Added new nullable field
message for the full message
without the key.
Removed classes and methods that have been deprecated for more than
two years.
Closed issues
#6874,
#7471,
#7475,
#7486.
Commits
a6eff70
new release 3.54.0fd34700
Prep for release.edb6e7a
Print error key in brackets (#7525)a79b1de
Show details of the error message in test failures (#7513)a5ecc22
Clone the JDK using the same fork and branch as CF (#7491)2770c52
Update cimg/base Docker tag to v2026.03bba6bc9
Update plugin com-gradleup-shadow to v9.3.23a6d4d4
Update error-prone monorepo to v2.48.070aa5f3
Update plugin net-ltgt-errorprone to v5.1.00dbd3e7
Prepare for javac AST changes- Additional commits viewable in compare
view
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index eb7768780f..27aa503b99 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
10.23.0
true
2.42.0
- 3.53.1
+ 3.54.0
1.5.32
none
-Xdoclint:none
From 899e883428ee067da4542393e7ecc958cfb5d90c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 13:14:24 +0100
Subject: [PATCH 038/120] MINOR: Bump com.google.protobuf:protobuf-bom from
4.33.4 to 4.34.1 (#1086)
Bumps
[com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf)
from 4.33.4 to 4.34.1.
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 27aa503b99..61ecddf867 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,7 +100,7 @@ under the License.
33.4.8-jre
4.2.9.Final
1.79.0
- 4.33.4
+ 4.34.1
2.21.1
3.4.3
25.2.10
From a8b238061bfdab433d25ee223ce11d697a572efd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 13:15:02 +0100
Subject: [PATCH 039/120] MINOR: Bump org.mockito:mockito-bom from 5.21.0 to
5.23.0 (#1087)
Bumps [org.mockito:mockito-bom](https://github.com/mockito/mockito) from
5.21.0 to 5.23.0.
Release notes
Sourced from org.mockito:mockito-bom's
releases.
v5.23.0
NOTE: Breaking change for Android
The mockito-android artifact has a breaking change:
tests now require a device or emulator based on API 28+ (Android P).
This is to enable new support for mocking Kotlin classes. See #3788
for more details.
Changelog
generated by Shipkit Changelog
Gradle Plugin
5.23.0
v5.22.0
Changelog
generated by Shipkit Changelog
Gradle Plugin
5.22.0
Commits
a231205
Fix StackOverflowError with AbstractList after using mockSingleton (#3790)f6a91a6
Replace mockito-android mock maker implementation with
dexmaker-mockito-inlin...aa2298a
fix: make spotless happya6729d6
chore: update BDDMockito with jspecify annotationbb83c92
chore: move jspecify as a compile only dependency47a4695
chore: add jspecify with minimal change. Fixes #350325f1395
Add core API to enable Kotlin singleton mocking (#3762)ef9ee55
Avoids mocking private static methods, as well as package-private static
meth...d16fcfc
Bump graalvm/setup-graalvm from 1.4.4 to 1.4.5 (#3780)27eb8a3
Clarify RETURNS_MOCKS behavior with sealed abstract enums
(Java 15+) (#3773)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 61ecddf867..c96656a67d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -106,7 +106,7 @@ under the License.
25.2.10
1.12.1
1.17.0
- 5.21.0
+ 5.23.0
2
10.23.0
From 1348b8dc8302daebe7bb76df9f3c13bdcf2766e9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 13:16:04 +0100
Subject: [PATCH 040/120] MINOR: Bump io.netty:netty-bom from 4.2.9.Final to
4.2.10.Final (#1085)
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.9.Final to 4.2.10.Final.
Commits
4cc9873
[maven-release-plugin] prepare release netty-4.2.10.Final54b8663
Remove unnecessary allocations and abstractions in HttpContentCompressor
(#16...961f427
Update to netty-tcnative 2.0.75.Final (#16227)3007ba9
Use recommanded finalize chain pattern when override finalize() method
(#16212)b918042
Update some dependencies (#16198)
(#16215)874c995
Reduce allocations on DefaultHeaders::containsValue (#15843)e0fe794
Remove unnecessary null check in WebSocketServerExtensionHandler (#16201)1b0636b
Move default compression options into static variable in
HttpContentCompresso...85a3a0e
codec-http2: move the accessors from Http2Headers to DefaultHttp2Headers
(#16...f44a88d
Improve chunk picking for the large-size buddy allocator (#16179)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index c96656a67d..c0a01c6050 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
5.12.2
2.0.17
33.4.8-jre
- 4.2.9.Final
+ 4.2.10.Final
1.79.0
4.34.1
2.21.1
From d9d6112b3e4037d72aa44e978bc72c2f7706c52c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 18:46:51 +0100
Subject: [PATCH 041/120] MINOR: Bump com.google.guava:guava-bom from
33.4.8-jre to 33.5.0-jre (#1083)
Bumps [com.google.guava:guava-bom](https://github.com/google/guava) from
33.4.8-jre to 33.5.0-jre.
Release notes
Sourced from com.google.guava:guava-bom's
releases.
33.5.0
Maven
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>33.5.0-jre</version>
<!-- or, for Android: -->
<version>33.5.0-android</version>
</dependency>
Jar files
Guava requires one
runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
- Restored the
Automatic-Module-Name to
guava-android. (It, unlike, guava-jre, is not
a proper module.) (7a04a8a955)
- For users of
guava-gwt: Google has
moved off GWT internally. We plan to continue to release
guava-gwt for users of GWT and J2CL, but the artifact is no
longer tested for GWT-specific issues, and we have limited resources to
fix any unexpected issues that might arise. While we do not anticipate
any specific problems, we can't guarantee how long support will
continue.
- Increased our Android
minSdkVersion to 23
(Marshmallow). This follows the minimum of Google's foundational Android
libraries, and we expect it to have no practical impact on users.
(5c23347cc1)
- Listed the JSpecify annotations as an optional dependency in our
OSGi metadata. (2dfd572981)
cache: Improved the handling of exceptions from compute
functions in Cache.asMap(). (We do still recommend
using Caffeine
rather than com.google.common.cache.) (087f2c4a80)collect: Improved Iterators.mergeSorted()
to preserve stability for equal elements. (4dc93be9a8)math: Added saturatedAbs methods to
IntMath and LongMath. (ed0e518f20)net: Added image/avif to
MediaType. (53344caba6)testing: Made CollectorTester available to
Android users. (294c251079)util.concurrent: Added Striped.custom.
(1586eb271d)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index c0a01c6050..200371e265 100644
--- a/pom.xml
+++ b/pom.xml
@@ -97,7 +97,7 @@ under the License.
1.9.0
5.12.2
2.0.17
- 33.4.8-jre
+ 33.5.0-jre
4.2.10.Final
1.79.0
4.34.1
From d5497915c604582e66613c96599b32a812fda4bc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 18:47:12 +0100
Subject: [PATCH 042/120] MINOR: Bump com.fasterxml.jackson:jackson-bom from
2.21.1 to 2.21.2 (#1082)
Bumps
[com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom)
from 2.21.1 to 2.21.2.
Commits
10e12a5
[maven-release-plugin] prepare release jackson-bom-2.21.2d754903
Prep for 2.21.2 release63e1b3b
Post-release dep version bump716ab0d
[maven-release-plugin] prepare for next development iteration- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 200371e265..fe5716a5f1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,7 +101,7 @@ under the License.
4.2.10.Final
1.79.0
4.34.1
- 2.21.1
+ 2.21.2
3.4.3
25.2.10
1.12.1
From 01affd741864c493cb76b9357fb32ead7f977672 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?=
Date: Tue, 24 Mar 2026 07:49:08 +0100
Subject: [PATCH 043/120] GH-1078: Upgrade minimum JDK version from 11 to 17
(#1079)
Update compiler source/target/release to 17 across build config
(pom.xml, bom), CI workflows, Docker images, Brewfile, and
documentation. Replace deprecated boxed-type constructors with valueOf()
in HolderReaderImpl codegen template to fix -Werror under release=17.
## What's Changed
JDK 11 would not be supported in some cases.
**This contains breaking changes.**
Closes #1078.
---
.env | 2 +-
.github/workflows/rc.yml | 4 ++--
.github/workflows/test.yml | 8 ++++----
Brewfile | 2 +-
bom/pom.xml | 8 ++++----
ci/docker/conda-jni.dockerfile | 2 +-
ci/docker/vcpkg-jni.dockerfile | 2 +-
compose.yaml | 4 ++--
docs/source/cdata.rst | 8 ++++----
docs/source/developers/building.rst | 16 ++++++++--------
docs/source/flight_sql_jdbc_driver.rst | 2 +-
docs/source/install.rst | 4 ++--
docs/source/jdbc.rst | 2 +-
docs/source/memory.rst | 2 +-
pom.xml | 10 +++++-----
.../main/codegen/templates/HolderReaderImpl.java | 4 ++--
16 files changed, 40 insertions(+), 40 deletions(-)
diff --git a/.env b/.env
index a7783537d0..2bd7255476 100644
--- a/.env
+++ b/.env
@@ -47,7 +47,7 @@ ARROW_REPO=ghcr.io/apache/arrow-dev
ULIMIT_CORE=-1
# Default versions for various dependencies
-JDK=11
+JDK=17
MAVEN=3.9.9
# Versions for various dependencies used to build artifacts
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 4973b1afb5..9c75b8c807 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -273,7 +273,7 @@ jobs:
run: |
set -e
# make brew Java available to CMake
- export JAVA_HOME=$(brew --prefix openjdk@11)/libexec/openjdk.jdk/Contents/Home
+ export JAVA_HOME=$(brew --prefix openjdk@17)/libexec/openjdk.jdk/Contents/Home
ci/scripts/jni_macos_build.sh . arrow build jni
- name: Compress into single artifact to keep directory structure
run: tar -cvzf jni-macos-${{ matrix.platform.arch }}.tar.gz jni/
@@ -317,7 +317,7 @@ jobs:
- name: Set up Java
uses: actions/setup-java@v5
with:
- java-version: '11'
+ java-version: '17'
distribution: 'temurin'
- name: Download Timezone Database
shell: bash
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2602592799..8c437a056d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -45,7 +45,7 @@ jobs:
strategy:
fail-fast: false
matrix:
- jdk: [11, 17, 21, 23]
+ jdk: [17, 21, 23]
maven: [3.9.9]
image: [ubuntu, conda-jni-cdata]
include:
@@ -88,10 +88,10 @@ jobs:
matrix:
include:
- arch: AMD64
- jdk: 11
+ jdk: 17
macos: 15-intel
- arch: AArch64
- jdk: 11
+ jdk: 17
macos: latest
steps:
- name: Set up Java
@@ -123,7 +123,7 @@ jobs:
strategy:
fail-fast: false
matrix:
- jdk: [11]
+ jdk: [17]
steps:
- name: Set up Java
uses: actions/setup-java@v5
diff --git a/Brewfile b/Brewfile
index af6bd65615..2c47a38af5 100644
--- a/Brewfile
+++ b/Brewfile
@@ -15,5 +15,5 @@
# specific language governing permissions and limitations
# under the License.
-brew "openjdk@11"
+brew "openjdk@17"
brew "sccache"
diff --git a/bom/pom.xml b/bom/pom.xml
index f9200a7e8d..e4ccee02db 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -80,10 +80,10 @@ under the License.
- 11
- 11
- 11
- 11
+ 17
+ 17
+ 17
+ 17
diff --git a/ci/docker/conda-jni.dockerfile b/ci/docker/conda-jni.dockerfile
index e14db73688..3f31b74052 100644
--- a/ci/docker/conda-jni.dockerfile
+++ b/ci/docker/conda-jni.dockerfile
@@ -17,7 +17,7 @@
FROM ghcr.io/mamba-org/micromamba:ubuntu24.04
-ARG jdk=11
+ARG jdk=17
ARG maven=3.9.9
RUN micromamba install -y \
diff --git a/ci/docker/vcpkg-jni.dockerfile b/ci/docker/vcpkg-jni.dockerfile
index d6bd322a39..f2f5d0d45a 100644
--- a/ci/docker/vcpkg-jni.dockerfile
+++ b/ci/docker/vcpkg-jni.dockerfile
@@ -20,7 +20,7 @@ FROM ${base}
# Install Java
# We need Java for JNI headers, but we don't invoke Maven in this build.
-ARG java=11
+ARG java=17
RUN dnf install -y java-$java-openjdk-devel && dnf clean all
# For ci/scripts/{cpp,java}_*.sh
diff --git a/compose.yaml b/compose.yaml
index f5082a22aa..fb290b22fe 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -40,7 +40,7 @@ services:
# docker compose run ubuntu
# Parameters:
# MAVEN: 3.9.9
- # JDK: 11, 17, 21
+ # JDK: 17, 21
image: ${ARCH}/maven:${MAVEN}-eclipse-temurin-${JDK}
volumes:
- .:/arrow-java:delegated
@@ -60,7 +60,7 @@ services:
# docker compose run conda-jni-cdata
# Parameters:
# MAVEN: 3.9.9
- # JDK: 11, 17, 21
+ # JDK: 17, 21
image: ${REPO}:${ARCH}-conda-java-${JDK}-maven-${MAVEN}-jni-integration
build:
context: .
diff --git a/docs/source/cdata.rst b/docs/source/cdata.rst
index 9643d88df3..7b2924d259 100644
--- a/docs/source/cdata.rst
+++ b/docs/source/cdata.rst
@@ -101,8 +101,8 @@ without writing JNI bindings ourselves.
1.0-SNAPSHOT
- 8
- 8
+ 17
+ 17
9.0.0
@@ -237,8 +237,8 @@ For this example, we will build a JAR with all dependencies bundled.
cpptojava
1.0-SNAPSHOT
- 8
- 8
+ 17
+ 17
9.0.0
diff --git a/docs/source/developers/building.rst b/docs/source/developers/building.rst
index f9ef7daea8..b682957714 100644
--- a/docs/source/developers/building.rst
+++ b/docs/source/developers/building.rst
@@ -32,7 +32,7 @@ Arrow Java uses the `Maven `_ build system.
Building requires:
-* JDK 11+
+* JDK 17+
* Maven 3+
.. note::
@@ -345,7 +345,7 @@ configuration file usually located under ``${HOME}/.m2`` with the following snip
jdk
- 21
+ 21
temurin
@@ -383,11 +383,11 @@ Arrow repository, and update the following settings:
right click the directory, and select Mark Directory as > Generated Sources
Root. There is no need to mark other generated sources directories, as only
the ``vector`` module generates sources.
-* For JDK 11, due to an `IntelliJ bug
- `__, you must go into
+* Due to an `IntelliJ bug
+ `__, you may need to go into
Settings > Build, Execution, Deployment > Compiler > Java Compiler and disable
"Use '--release' option for cross-compilation (Java 9 and later)". Otherwise
- you will get an error like "package sun.misc does not exist".
+ you may get an error like "package sun.misc does not exist".
* You may want to disable error-prone entirely if it gives spurious
warnings (disable both error-prone profiles in the Maven tool window
and "Reload All Maven Projects").
@@ -397,7 +397,7 @@ Arrow repository, and update the following settings:
* To enable debugging JNI-based modules like ``dataset``,
activate specific profiles in the Maven tab under "Profiles".
Ensure the profiles ``arrow-c-data``, ``arrow-jni``, ``generate-libs-cdata-all-os``,
- ``generate-libs-jni-macos-linux``, and ``jdk11+`` are enabled, so that the
+ ``generate-libs-jni-macos-linux``, and ``jdk17+`` are enabled, so that the
IDE can build them and enable debugging.
You may not need to update all of these settings if you build/test with the
@@ -478,8 +478,8 @@ Installing Manually
.. code-block:: xml
- 8
- 8
+ 17
+ 17
9.0.0.dev501
diff --git a/docs/source/flight_sql_jdbc_driver.rst b/docs/source/flight_sql_jdbc_driver.rst
index 4deb726b33..6d40434a22 100644
--- a/docs/source/flight_sql_jdbc_driver.rst
+++ b/docs/source/flight_sql_jdbc_driver.rst
@@ -27,7 +27,7 @@ Flight SQL.
Installation and Requirements
=============================
-The driver is compatible with JDK 11+. Note that the following JVM
+The driver is compatible with JDK 17+. Note that the following JVM
parameter is required:
.. code-block:: shell
diff --git a/docs/source/install.rst b/docs/source/install.rst
index b2b1c7163f..e0b34515ef 100644
--- a/docs/source/install.rst
+++ b/docs/source/install.rst
@@ -27,8 +27,8 @@ Java modules are regularly built and tested on macOS and Linux distributions.
Java Compatibility
==================
-Java modules are compatible with JDK 11 and above. Currently, JDK versions
-11, 17, 21, and latest are tested in CI.
+Java modules are compatible with JDK 17 and above. Currently, JDK versions
+17, 21, and latest are tested in CI.
Note that some JDK internals must be exposed by
adding ``--add-opens=java.base/java.nio=org.apache.arrow.memory.core,ALL-UNNAMED`` to the ``java`` command:
diff --git a/docs/source/jdbc.rst b/docs/source/jdbc.rst
index 2f57c34bf8..e054127faa 100644
--- a/docs/source/jdbc.rst
+++ b/docs/source/jdbc.rst
@@ -276,7 +276,7 @@ mapping, with additional support for the UUID extension type noted below.
JDBC value, because a JDBC Timestamp is in UTC, and we have no
timezone information. In this case, the default binder will call
`setTimestamp(int, Timestamp)
- `_,
+ `_,
which will lead to the driver using the "default timezone" (that of
the Java VM).
* \(3) For the Flight SQL JDBC driver, the Arrow UUID extension type
diff --git a/docs/source/memory.rst b/docs/source/memory.rst
index 4a71ed846a..5b9148223a 100644
--- a/docs/source/memory.rst
+++ b/docs/source/memory.rst
@@ -341,7 +341,7 @@ How this works:
.. _`newChildAllocator`: https://arrow.apache.org/java/current/reference/org.apache.arrow.memory.core/org/apache/arrow/memory/RootAllocator.html#newChildAllocator-java.lang.String-org.apache.arrow.memory.AllocationListener-long-long-
.. _`Netty`: https://netty.io/wiki/
.. _`sun.misc.unsafe`: https://web.archive.org/web/20210929024401/http://www.docjar.com/html/api/sun/misc/Unsafe.java.html
-.. _`Direct Memory`: https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/nio/ByteBuffer.html
+.. _`Direct Memory`: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/nio/ByteBuffer.html
.. _`ReferenceManager`: https://arrow.apache.org/java/current/reference/org.apache.arrow.memory.core/org/apache/arrow/memory/ReferenceManager.html
.. _`ReferenceManager.release`: https://arrow.apache.org/java/current/reference/org.apache.arrow.memory.core/org/apache/arrow/memory/ReferenceManager.html#release--
.. _`ReferenceManager.retain`: https://arrow.apache.org/java/current/reference/org.apache.arrow.memory.core/org/apache/arrow/memory/ReferenceManager.html#retain--
diff --git a/pom.xml b/pom.xml
index fe5716a5f1..863169b47b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -119,10 +119,10 @@ under the License.
--add-opens=java.base/java.nio=org.apache.arrow.memory.core,ALL-UNNAMED
- 11
- 11
- 11
- 11
+ 17
+ 17
+ 17
+ 17
... (truncated)
Commits
c8eb81b
in preparation for a release7ff5ee5
Merge pull request #4260
from JackPGreen/update-maven-central-urlda4c337
Merge pull request #4271
from IrisesD/masterd053544
feat: allow CATALOG in CREATE SCHEMA and
DROP SCHEMA (#4277)a448d91
Merge pull request #4273
from naive924/feat/compactThreads6672123
fix: change log858e74a
fix: MVStore.compact: run map copy in parallel by default (¼ cores,
override ...bce0ec1
feat: parallel map copy option for MVStore.compact()d8a6cc3
Fix command syntax in help.csvc45413c
Merge pull request #4266
from andreitokar/issue-4208-2- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
adapter/jdbc/pom.xml | 2 +-
performance/pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/adapter/jdbc/pom.xml b/adapter/jdbc/pom.xml
index 9ff44593ff..a8ac19721d 100644
--- a/adapter/jdbc/pom.xml
+++ b/adapter/jdbc/pom.xml
@@ -59,7 +59,7 @@ under the License.
com.h2database
h2
- 2.3.232
+ 2.4.240
test
diff --git a/performance/pom.xml b/performance/pom.xml
index 96ea5291ad..413d5ba1e0 100644
--- a/performance/pom.xml
+++ b/performance/pom.xml
@@ -75,7 +75,7 @@ under the License.
com.h2database
h2
- 2.3.232
+ 2.4.240
runtime
From 168a969147ea77a6fe8f12fa15c6bc25b1e671f2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:21:57 +0200
Subject: [PATCH 045/120] MINOR: Bump io.netty:netty-bom from 4.2.10.Final to
4.2.12.Final (#1091)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.10.Final to 4.2.12.Final.
Release notes
Sourced from io.netty:netty-bom's
releases.
netty-4.2.12.Final
What's Changed
Full Changelog: https://github.com/netty/netty/compare/netty-4.2.11.Final...netty-4.2.12.Final
netty-4.2.11.Final
Security
What's Changed
... (truncated)
Commits
67ce541
[maven-release-plugin] prepare release netty-4.2.12.Final7074624
Revert "Eliminate redundant bounds checks in CompositeByteBuf
accessors" (#16...c3b0a43
[maven-release-plugin] prepare for next development iterationc94a818
[maven-release-plugin] prepare release netty-4.2.11.Final3b76df1
Merge commit from forkaae944a
Auto-port 4.2: Limit the number of Continuation frames per HTTP2 Headers
(#16...6001499
Eliminate redundant bounds checks in CompositeByteBuf accessors (#16525)a7fbb6f
JdkZlibDecoder: accumulate decompressed output before firing channelRead
(#16...7937553
Enforce io.netty.maxDirectMemory accounting on all Java versions (#16489)893ea2e
Allocate less in QueryStringDecoder.addParam for typical use case (#16527)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 863169b47b..61b5b3f0b2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
5.12.2
2.0.17
33.5.0-jre
- 4.2.10.Final
+ 4.2.12.Final
1.79.0
4.34.1
2.21.2
From 89fa995eac2aa84e0195341bff601dfce66b942e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:22:13 +0200
Subject: [PATCH 046/120] MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.34
to 11.37 (#1096)
Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.34 to 11.37.
Changelog
Sourced from com.nimbusds:oauth2-oidc-sdk's
changelog.
version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.
version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.
version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.
version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).
version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.
version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.
version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.
version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.
version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.
version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.
version 2.9 (2013-09-17)
... (truncated)
Commits
d98de1a
[maven-release-plugin] prepare for next development iteration2ea716f
Shortens InvalidClientException messagesed5773c
TokenRevocationRequest receives custom form parameters supporte133559
Updates tests for shortened InvalidClientException messagesfe43e1f
[maven-release-plugin] prepare release 11.3573224c9
[maven-release-plugin] prepare for next development iterationf3f7286
Adds static JSONObjectUtils.getNonNegativeLong methodsd6899e0
Cleans up JSONObjectUtils.getEnum(net.minidev.json.JSONObject,
java.lang.Stri...9b05d23
Adds non-negative checks when parsing Date instances from Unix
timestamps (is...592d8f4
Adds "acr" and "auth_time" parameter (RFC 9470)
support to TokenIntrospection...- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index ffeff12462..483c019cdc 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -182,7 +182,7 @@ under the License.
com.nimbusds
oauth2-oidc-sdk
- 11.34
+ 11.37
From 4297733dae36ca83234a239b25068db775a09743 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:30:50 +0200
Subject: [PATCH 047/120] MINOR: Bump com.gradle:develocity-maven-extension
from 2.3.4 to 2.4.0 (#1095)
Bumps com.gradle:develocity-maven-extension from 2.3.4 to 2.4.0.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.mvn/extensions.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index 4585435b49..f52dfafb4a 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -23,7 +23,7 @@
com.gradle
develocity-maven-extension
- 2.3.4
+ 2.4.0
com.gradle
From 447372ce4caa5a53387018861e3ea9d1f7be795c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 10:57:29 +0200
Subject: [PATCH 048/120] MINOR: Bump
com.google.api.grpc:proto-google-common-protos from 2.66.0 to 2.67.0 (#1092)
Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.66.0 to 2.67.0.
Release notes
Sourced from com.google.api.grpc:proto-google-common-protos's
releases.
v2.67.0
2.67.0
(2026-02-18)
Features
- observability: introduce minimal tracing
implementation (#4105)
(e4e5e89)
Dependencies
v2.66.1
2.66.1
(2026-02-04)
Documentation
- [common-protos] update reference documentation for
SelectionInput.DROPDOWN to include dynamic data sources and
autosuggestion (9960262)
Changelog
Sourced from com.google.api.grpc:proto-google-common-protos's
changelog.
2.67.0
(2026-02-18)
Features
- observability: introduce minimal tracing
implementation (#4105)
(e4e5e89)
Dependencies
2.66.1
(2026-02-04)
Documentation
- [common-protos] update reference documentation for
SelectionInput.DROPDOWN to include dynamic data sources and
autosuggestion (9960262)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index 92490dd67b..5c6c3378c1 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
com.google.api.grpc
proto-google-common-protos
- 2.66.0
+ 2.67.0
test
From 0703021c8315a55651b6f7446da8cc781f039f72 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 14:56:30 +0200
Subject: [PATCH 049/120] MINOR: Bump org.apache:apache from 33 to 37 (#1033)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [org.apache:apache](https://github.com/apache/maven-apache-parent)
from 33 to 37.
Release notes
Sourced from org.apache:apache's
releases.
Apache Parent POM version 37
🚀 New features and improvements
Apache Parent POM version 36
:boom: Breaking changes
- Update minimum maven version to match current stable version (3.6.3
-> 3.9) (#533)
@DomGarguilo
- Introduce javaVersion property for maven.compiler.* configuration
(#551)
@slawekjaranowski
- Switch JDK >= 9 to only use maven.compiler.release (#543)
@gnodet
🚀 New features and improvements
- Update minimum maven version to match current stable version (3.6.3
-> 3.9) (#533)
@DomGarguilo
- Introduce javaVersion property for maven.compiler.* configuration
(#551)
@slawekjaranowski
- Switch JDK >= 9 to only use maven.compiler.release (#543)
@gnodet
- Add default specification and implementation for javadoc and source
manifest entries (#548)
@slawekjaranowski
📝 Documentation updates
👻 Maintenance
📦 Dependency updates
... (truncated)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
You can trigger a rebase of this PR by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
bom/pom.xml | 2 +-
pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/bom/pom.xml b/bom/pom.xml
index e4ccee02db..267dcef73c 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache
apache
- 33
+ 37
diff --git a/pom.xml b/pom.xml
index 61b5b3f0b2..25d49a0704 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache
apache
- 35
+ 37
org.apache.arrow
From e54681b80e84573f4cb6e7fdcb77b4247768965f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 30 Mar 2026 16:20:40 +0200
Subject: [PATCH 050/120] MINOR: Bump
com.diffplug.spotless:spotless-maven-plugin from 2.44.4 to 3.4.0 (#1088)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 2.44.4 to 3.4.0.
Release notes
Sourced from com.diffplug.spotless:spotless-maven-plugin's
releases.
Maven Plugin v3.4.0
Added
- Add
tableTest format type for standalone
.table files. (#2880)
Changes
- Bump default
tabletest-formatter version
1.0.1 -> 1.1.1, now works with Java 17+.
(#2880)
Lib v3.3.1
Fixed
GitPrePushHookInstaller didn't work on windows, now
fixed. (#2562)
Lib v3.3.0
Added
- Allow specifying path to Biome JSON config file directly in
biome step. Requires biome 2.x. (#2548)
GitPrePushHookInstaller, a reusable library component
for installing a Git pre-push hook that runs formatter
checks. (#2553)- Allow setting Eclipse XML config from a string, not only from files
(#2361)
Changed
- Bump default
gson version to latest 2.11.0
-> 2.13.1. (#2414)
- Bump default
jackson version to latest
2.18.1 -> 2.19.2. (#2558)
- Bump default
gherkin-utils version to latest
9.0.0 -> 9.2.0. (#2408)
- Bump default
cleanthat version to latest
2.22 -> 2.23. (#2556)
Maven Plugin v3.3.0
Added
- Add
tabletest-formatter support for Java and Kotlin.
(#2860)
Fixed
- Fix the ability to specify a wildcard version (
*) for
external formatter executables, which did not work. (#2848)
- [fix]
ConcurrentModificationException in
expandWildcardImports (#2830)
Maven Plugin v3.2.1
Fixed
removeSemicolons() should not be applied to multiline
strings in groovy #2780
(#2792)
Lib v3.2.0
Added
- Support for
idea (#2020,
#2535)
- Add support for removing wildcard imports via
removeWildcardImports step. (#2517)
- scalafmt: enforce version consistency between the version configured
in Spotless and the version declared in Scalafmt config file (#2460)
Fixed
SortPom disable expandEmptyElements, to avoid empty
body warnings. (#2520)- Fix biome formatter for new major release 2.x of biome (#2537)
- Make sure npm-based formatters use the correct
node_modules directory when running in parallel. (#2542)
Changed
- Bump internal dependencies for npm-based formatters (#2542)
Maven Plugin v3.2.0
Added
- Add the ability to specify a wildcard version (
*) for
external formatter executables. (#2757)
Changes
- Dramatic (~100x) performance improvement when using git
ratchetFrom. (#2805)
Fixed
... (truncated)
Commits
708a1b0
Published maven/3.4.01cc0163
Published gradle/8.4.0a4cd808
Published lib/4.5.09066bf6
Add links to the changelog.db8dc1c
Fix for illegal mutation issue with predeclareDeps (#2892)0eb98a9
chore: Updated gradle plugin change3f7f12e
chore: Removes check for predeclare as it's not needed anymore55c0c5c
fix: IsolatedProjectTest.predeclaredIsUnsupported() is now actually
supported...47489af
fix: avoid IllegalMutationException when root project uses
predeclareDeps() w...4010e8b
test: Introduce a test harnessing predeclared deps- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
---------
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré
Co-authored-by: JB Onofré
---
bom/pom.xml | 8 ++++----
flight/flight-integration-tests/pom.xml | 2 +-
flight/flight-sql-jdbc-driver/pom.xml | 2 +-
memory/memory-core/pom.xml | 4 ++--
performance/pom.xml | 6 +++---
pom.xml | 14 +++++++-------
tools/pom.xml | 2 +-
7 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/bom/pom.xml b/bom/pom.xml
index 267dcef73c..d97cc291c2 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -24,7 +24,7 @@ under the License.
org.apache
apache
37
-
+
org.apache.arrow
@@ -78,7 +78,7 @@ under the License.
-
+
17
17
@@ -208,7 +208,7 @@ under the License.
com.diffplug.spotless
spotless-maven-plugin
- 2.44.4
+ 3.4.0
org.codehaus.mojo
@@ -235,7 +235,7 @@ under the License.
${maven.multiModuleProjectDirectory}/dev/license/asf-xml.license
(<configuration|<project)
-
+
diff --git a/flight/flight-integration-tests/pom.xml b/flight/flight-integration-tests/pom.xml
index ec81162e59..f6ae8e16a5 100644
--- a/flight/flight-integration-tests/pom.xml
+++ b/flight/flight-integration-tests/pom.xml
@@ -101,7 +101,7 @@ under the License.
-
+
META-INF/LICENSE.txt
src/shade/LICENSE.txt
diff --git a/flight/flight-sql-jdbc-driver/pom.xml b/flight/flight-sql-jdbc-driver/pom.xml
index 55de7221ec..ff5763702b 100644
--- a/flight/flight-sql-jdbc-driver/pom.xml
+++ b/flight/flight-sql-jdbc-driver/pom.xml
@@ -138,7 +138,7 @@ under the License.
-
+
META-INF/LICENSE.txt
src/shade/LICENSE.txt
diff --git a/memory/memory-core/pom.xml b/memory/memory-core/pom.xml
index 1c7b6f8834..825b3dae4b 100644
--- a/memory/memory-core/pom.xml
+++ b/memory/memory-core/pom.xml
@@ -100,8 +100,8 @@ under the License.
test
-
-
+
+
**/TestOpens.java
diff --git a/performance/pom.xml b/performance/pom.xml
index 413d5ba1e0..d994bff45b 100644
--- a/performance/pom.xml
+++ b/performance/pom.xml
@@ -35,10 +35,10 @@ under the License.
true
.*
1
-
+
5
5
-
+
jmh-result.json
json
@@ -143,7 +143,7 @@ under the License.
java
-classpath
-
+
org.openjdk.jmh.Main
${benchmark.filter}
-f
diff --git a/pom.xml b/pom.xml
index 25d49a0704..06cb916b45 100644
--- a/pom.xml
+++ b/pom.xml
@@ -107,7 +107,7 @@ under the License.
1.12.1
1.17.0
5.23.0
-
+
2
10.23.0
true
@@ -374,7 +374,7 @@ under the License.
-
+
@@ -387,7 +387,7 @@ under the License.
-
+
@@ -400,7 +400,7 @@ under the License.
-
+
@@ -413,7 +413,7 @@ under the License.
-
+
@@ -492,7 +492,7 @@ under the License.
com.diffplug.spotless
spotless-maven-plugin
- 2.44.4
+ 3.4.0
org.codehaus.mojo
@@ -734,7 +734,7 @@ under the License.
${maven.multiModuleProjectDirectory}/dev/license/asf-xml.license
(<configuration|<project)
-
+
diff --git a/tools/pom.xml b/tools/pom.xml
index 64634b9abe..b4d64fd435 100644
--- a/tools/pom.xml
+++ b/tools/pom.xml
@@ -126,7 +126,7 @@ under the License.
-
+
META-INF/LICENSE.txt
src/shade/LICENSE.txt
From d8ad7b6765620c4f3f3078ee87c3d2cfb7423945 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 17:41:35 +0900
Subject: [PATCH 051/120] MINOR: [CI] Bump docker/login-action from 4.0.0 to
4.1.0 (#1103)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [docker/login-action](https://github.com/docker/login-action) from
4.0.0 to 4.1.0.
Release notes
Sourced from docker/login-action's
releases.
v4.1.0
Full Changelog: https://github.com/docker/login-action/compare/v4.0.0...v4.1.0
Commits
4907a6d
Merge pull request #930
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...1e233e6
chore: update generated content6c24ead
build(deps): bump the aws-sdk-dependencies group with 2 updatesee034d7
Merge pull request #958
from docker/dependabot/npm_and_yarn/lodash-4.18.11527209
Merge pull request #937
from docker/dependabot/npm_and_yarn/proxy-agent-depen...d39362a
build(deps): bump lodash from 4.17.23 to 4.18.1a6f092b
chore: update generated content60953f0
build(deps): bump the proxy-agent-dependencies group with 2 updates62c6885
Merge pull request #936
from docker/dependabot/npm_and_yarn/docker/actions-to...102c0e6
chore: update generated content- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/rc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 9c75b8c807..8f52d54bd6 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
with:
repository: apache/parquet-testing
path: arrow/cpp/submodules/parquet-testing
- - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+ - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
registry: ghcr.io
username: ${{ github.actor }}
From 13c8b9353b80f553e720ff50fce0cb103de87c55 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 14:23:37 +0200
Subject: [PATCH 052/120] MINOR: Bump checker.framework.version from 3.54.0 to
3.55.1 (#1105)
Bumps `checker.framework.version` from 3.54.0 to 3.55.1.
Updates `org.checkerframework:checker-qual` from 3.54.0 to 3.55.1
Release notes
Sourced from org.checkerframework:checker-qual's
releases.
Checker Framework 3.55.1
Version 3.55.1 (2026-04-03)
No user-visible changes.
Checker Framework 3.54.1
Version 3.55.0 (2026-04-02)
User-visible changes
The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.
Removed deprecated command-line option -AskipDirs; use
-AskipFiles.
Implementation details
In AnnotatedTypeMirror:
- Renamed
getEffectiveAnnotation*() to
getAnnotation*().
- Renamed
hasEffectiveAnnotation*() to
hasAnnotation*().
Removed deprecated method
ObjectCreationNode.getConstructor(); use
getTypeToInstantiate().
Closed issues
#7079,
#7489,
#7539.
Changelog
Sourced from org.checkerframework:checker-qual's
changelog.
Version 3.55.1 (2026-04-03)
No user-visible changes.
Version 3.55.0 (2026-04-02)
User-visible changes
The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.
Removed deprecated command-line option -AskipDirs; use
-AskipFiles.
Implementation details
In AnnotatedTypeMirror:
- Renamed
getEffectiveAnnotation*() to
getAnnotation*().
- Renamed
hasEffectiveAnnotation*() to
hasAnnotation*().
Removed deprecated method
ObjectCreationNode.getConstructor(); use
getTypeToInstantiate().
Closed issues
#7079,
#7489,
#7539.
Commits
Updates `org.checkerframework:checker` from 3.54.0 to 3.55.1
Release notes
Sourced from org.checkerframework:checker's
releases.
Checker Framework 3.55.1
Version 3.55.1 (2026-04-03)
No user-visible changes.
Checker Framework 3.54.1
Version 3.55.0 (2026-04-02)
User-visible changes
The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.
Removed deprecated command-line option -AskipDirs; use
-AskipFiles.
Implementation details
In AnnotatedTypeMirror:
- Renamed
getEffectiveAnnotation*() to
getAnnotation*().
- Renamed
hasEffectiveAnnotation*() to
hasAnnotation*().
Removed deprecated method
ObjectCreationNode.getConstructor(); use
getTypeToInstantiate().
Closed issues
#7079,
#7489,
#7539.
Changelog
Sourced from org.checkerframework:checker's
changelog.
Version 3.55.1 (2026-04-03)
No user-visible changes.
Version 3.55.0 (2026-04-02)
User-visible changes
The Checker Framework runs under JDK 26 -- that is, it runs on a
version 26 JVM.
Removed deprecated command-line option -AskipDirs; use
-AskipFiles.
Implementation details
In AnnotatedTypeMirror:
- Renamed
getEffectiveAnnotation*() to
getAnnotation*().
- Renamed
hasEffectiveAnnotation*() to
hasAnnotation*().
Removed deprecated method
ObjectCreationNode.getConstructor(); use
getTypeToInstantiate().
Closed issues
#7079,
#7489,
#7539.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 06cb916b45..363ad7bd7d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
10.23.0
true
2.42.0
- 3.54.0
+ 3.55.1
1.5.32
none
-Xdoclint:none
From d952ed48ef257b90a2085bca574ddd9213b67c91 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 14:24:24 +0200
Subject: [PATCH 053/120] MINOR: Bump dep.hadoop.version from 3.4.3 to 3.5.0
(#1104)
Bumps `dep.hadoop.version` from 3.4.3 to 3.5.0.
Updates `org.apache.hadoop:hadoop-client-runtime` from 3.4.3 to 3.5.0
Updates `org.apache.hadoop:hadoop-client-api` from 3.4.3 to 3.5.0
Updates `org.apache.hadoop:hadoop-common` from 3.4.3 to 3.5.0
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 363ad7bd7d..5ef8364176 100644
--- a/pom.xml
+++ b/pom.xml
@@ -102,7 +102,7 @@ under the License.
1.79.0
4.34.1
2.21.2
- 3.4.3
+ 3.5.0
25.2.10
1.12.1
1.17.0
From e4f8c9251229846190716cce5a9772292952c761 Mon Sep 17 00:00:00 2001
From: Sutou Kouhei
Date: Fri, 10 Apr 2026 14:31:54 +0900
Subject: [PATCH 054/120] GH-1107: Increase publish job timeout (#1108)
## What's Changed
We have many artifacts and need `sleep 1` per upload. So 5min timeout is
too short.
Closes #1107.
---
.github/workflows/release.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5ca9cf9b73..a2c5a55544 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
publish:
name: Publish
runs-on: ubuntu-latest
- timeout-minutes: 5
+ timeout-minutes: 30
steps:
- name: Download RC contents
run: |
From 4ca6017bdd8590a6ad0a0a4154d993ec0c416076 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Apr 2026 17:37:40 +0900
Subject: [PATCH 055/120] MINOR: [CI] Bump actions/github-script from 8 to 9
(#1110)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [actions/github-script](https://github.com/actions/github-script)
from 8 to 9.
Release notes
Sourced from actions/github-script's
releases.
v9.0.0
New features:
getOctokit factory function —
Available directly in the script context. Create additional
authenticated Octokit clients with different tokens for multi-token
workflows, GitHub App tokens, and cross-org access. See Creating
additional clients with getOctokit for details and
examples.- Orchestration ID in user-agent — The
ACTIONS_ORCHESTRATION_ID environment variable is
automatically appended to the user-agent string for request
tracing.
Breaking changes:
require('@actions/github') no longer works in
scripts. The upgrade to @actions/github v9
(ESM-only) means require('@actions/github') will fail at
runtime. If you previously used patterns like const { getOctokit }
= require('@actions/github') to create secondary clients, use the
new injected getOctokit function instead — it's available
directly in the script context with no imports needed.getOctokit is now an injected function parameter.
Scripts that declare const getOctokit = ... or let
getOctokit = ... will get a SyntaxError because
JavaScript does not allow const/let
redeclaration of function parameters. Use the injected
getOctokit directly, or use var getOctokit =
... if you need to redeclare it.- If your script accesses other
@actions/github internals
beyond the standard github/octokit client, you
may need to update those references for v9 compatibility.
What's Changed
New Contributors
Full Changelog: https://github.com/actions/github-script/compare/v8.0.0...v9.0.0
Commits
3a2844b
Merge pull request #700
from actions/salmanmkc/expose-getoctokit + prepare re...ca10bbd
fix: use @octokit/core/types import for v7
compatibility86e48e2
merge: incorporate main branch changesc108472
chore: rebuild dist for v9 upgrade and getOctokit factoryafff112
Merge pull request #712
from actions/salmanmkc/deployment-false + fix user-ag...ff8117e
ci: fix user-agent test to handle orchestration ID81c6b78
ci: use deployment: false to suppress deployment noise from integration
tests3953caf
docs: update README examples from @v8 to @v9, add getOctokit docs
and v9 brea...c17d55b
ci: add getOctokit integration test joba047196
test: add getOctokit integration tests via callAsyncFunction- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/comment_bot.yml | 2 +-
.github/workflows/dev_pr.yml | 8 ++++----
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/comment_bot.yml b/.github/workflows/comment_bot.yml
index b4dbc92dfb..507d6a969c 100644
--- a/.github/workflows/comment_bot.yml
+++ b/.github/workflows/comment_bot.yml
@@ -30,7 +30,7 @@ jobs:
if: github.event.comment.body == 'take'
runs-on: ubuntu-latest
steps:
- - uses: actions/github-script@v8
+ - uses: actions/github-script@v9
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |-
diff --git a/.github/workflows/dev_pr.yml b/.github/workflows/dev_pr.yml
index 84740628ee..20946c8185 100644
--- a/.github/workflows/dev_pr.yml
+++ b/.github/workflows/dev_pr.yml
@@ -50,28 +50,28 @@ jobs:
- name: Ensure PR title format
id: title-format
- uses: actions/github-script@v8
+ uses: actions/github-script@v9
with:
script: |
const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);
return scripts.check_title_format({core, github, context});
- name: Label PR
- uses: actions/github-script@v8
+ uses: actions/github-script@v9
with:
script: |
const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);
await scripts.apply_labels({core, github, context});
- name: Ensure PR is labeled
- uses: actions/github-script@v8
+ uses: actions/github-script@v9
with:
script: |
const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);
await scripts.check_labels({core, github, context});
- name: Ensure PR is linked to an issue
- uses: actions/github-script@v8
+ uses: actions/github-script@v9
with:
script: |
const scripts = require(`${process.env.GITHUB_WORKSPACE}/.github/workflows/dev_pr.js`);
From 0d55ba78aeed3e6b28e3d65ced37c360f5e0ed4e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Apr 2026 17:37:53 +0900
Subject: [PATCH 056/120] MINOR: [CI] Bump actions/upload-artifact from 7.0.0
to 7.0.1 (#1111)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[actions/upload-artifact](https://github.com/actions/upload-artifact)
from 7.0.0 to 7.0.1.
Release notes
Sourced from actions/upload-artifact's
releases.
v7.0.1
What's Changed
Full Changelog: https://github.com/actions/upload-artifact/compare/v7...v7.0.1
Commits
043fb46
Merge pull request #797
from actions/yacaovsnc/update-dependency634250c
Include changes in typespec/ts-http-runtime 0.3.5e454baa
Readme: bump all the example versions to v7 (#796)74fad66
Update the readme with direct upload details (#795)- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/rc.yml | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 8f52d54bd6..2658f1da00 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -71,7 +71,7 @@ jobs:
run: |
dev/release/run_rat.sh "${TAR_GZ}"
- name: Upload source archive
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: release-source
path: |
@@ -148,7 +148,7 @@ jobs:
- name: Compress into single artifact to keep directory structure
run: tar -cvzf jni-linux-${{ matrix.platform.arch }}.tar.gz jni/
- name: Upload artifacts
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: jni-linux-${{ matrix.platform.arch }}
path: jni-linux-${{ matrix.platform.arch }}.tar.gz
@@ -278,7 +278,7 @@ jobs:
- name: Compress into single artifact to keep directory structure
run: tar -cvzf jni-macos-${{ matrix.platform.arch }}.tar.gz jni/
- name: Upload artifacts
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: jni-macos-${{ matrix.platform.arch }}
path: jni-macos-${{ matrix.platform.arch }}.tar.gz
@@ -356,7 +356,7 @@ jobs:
shell: bash
run: tar -cvzf jni-windows-${{ matrix.platform.arch }}.tar.gz jni/
- name: Upload artifacts
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: jni-windows-${{ matrix.platform.arch }}
path: jni-windows-${{ matrix.platform.arch }}.tar.gz
@@ -428,12 +428,12 @@ jobs:
cp -a target/site/apidocs reference
tar -cvzf reference.tar.gz reference
- name: Upload binaries
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: release-binaries
path: binaries/*
- name: Upload docs
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: reference
path: reference.tar.gz
@@ -471,7 +471,7 @@ jobs:
- name: Compress into single artifact to keep directory structure
run: tar -cvzf html.tar.gz -C docs/build html
- name: Upload artifacts
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: release-html
path: html.tar.gz
From 8d3e8dd2f01f7ddc22cda5aa04cde30eb5f6d308 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 15:18:55 +0200
Subject: [PATCH 057/120] MINOR: Bump
com.google.api.grpc:proto-google-common-protos from 2.67.0 to 2.70.0 (#1124)
Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.67.0 to 2.70.0.
Release notes
Sourced from com.google.api.grpc:proto-google-common-protos's
releases.
v2.68.0
2.68.0
(2026-03-17)
Features
- Add client request duration metric. (#4132)
(6a76397)
- Add more attributes to golden signals metrics. (#4135)
(59d0624)
- gax-httpjson: add HttpJsonErrorParser utility (#4137)
(a1b7565)
- generator: add extra allowed modules that will not
be removed from the monorepo if they are present (#4124)
(774fe6e)
- o11y: introduce
gcp.client.repo and
gcp.client.artifact attributes (#4120)
(105f644)
- o11y: Introduce
rpc.system.name and
rpc.method in gRPC (#4121)
(7ab6d2e)
- o11y: introduce server.port attribute (#4128)
(56aa343)
Bug Fixes
- add null checks for ApiTracerFactory in ClientContext (#4122)
(4b3dbe2)
- Decrease log level for directpath warnings outside GCE (#4139)
(c9651e7)
- gax-grpc: add pick_first fallback to direct path
service config (#4143)
(b150fe9)
- Populate method level attributes in metrics recording (#4149)
(7b7e6c9)
- suppress warnings in generated projects for non-idiomatic durations
(#4119)
(4206e6e)
- Use ServiceName + MethodName as the regex for Otel (#2543)
(b9ae73f)
Documentation
- hermetic_build: fix config field name in readme (#4130)
(a0c8f67)
Changelog
Sourced from com.google.api.grpc:proto-google-common-protos's
changelog.
Changelog
2.68.0
(2026-03-17)
Features
- Add client request duration metric. (#4132)
(6a76397)
- Add more attributes to golden signals metrics. (#4135)
(59d0624)
- gax-httpjson: add HttpJsonErrorParser utility (#4137)
(a1b7565)
- generator: add extra allowed modules that will not
be removed from the monorepo if they are present (#4124)
(774fe6e)
- o11y: introduce
gcp.client.repo and
gcp.client.artifact attributes (#4120)
(105f644)
- o11y: Introduce
rpc.system.name and
rpc.method in gRPC (#4121)
(7ab6d2e)
- o11y: introduce server.port attribute (#4128)
(56aa343)
Bug Fixes
- add null checks for ApiTracerFactory in ClientContext (#4122)
(4b3dbe2)
- Decrease log level for directpath warnings outside GCE (#4139)
(c9651e7)
- gax-grpc: add pick_first fallback to direct path
service config (#4143)
(b150fe9)
- Populate method level attributes in metrics recording (#4149)
(7b7e6c9)
- suppress warnings in generated projects for non-idiomatic durations
(#4119)
(4206e6e)
- Use ServiceName + MethodName as the regex for Otel (#2543)
(b9ae73f)
Documentation
- hermetic_build: fix config field name in readme (#4130)
(a0c8f67)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index 5c6c3378c1..d199f70da4 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
com.google.api.grpc
proto-google-common-protos
- 2.67.0
+ 2.70.0
test
From 3dca92baf2a806802e437f84bfe06947d4433343 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 15:46:36 +0200
Subject: [PATCH 058/120] MINOR: Bump com.google.guava:guava-bom from
33.5.0-jre to 33.6.0-jre (#1123)
Bumps [com.google.guava:guava-bom](https://github.com/google/guava) from
33.5.0-jre to 33.6.0-jre.
Release notes
Sourced from com.google.guava:guava-bom's
releases.
33.6.0
Maven
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>33.6.0-jre</version>
<!-- or, for Android: -->
<version>33.6.0-android</version>
</dependency>
Jar files
Guava requires one
runtime dependency, which you can download here:
Javadoc
JDiff
Changelog
- Migrated some classes from
finalize() to
PhantomReference in preparation for the removal of finalization.
(786b619dd6, 7c6b17c, aeef90988d)
cache: Deprecated CacheBuilder APIs that
use TimeUnit in favor of those that use
Duration. (73f8b0bb84)collect: Added toImmutableSortedMap
collectors that use the natural comparator. (64d70b9f94)collect: Changed ConcurrentHashMultiset,
ImmutableMap and TreeMultiset deserialization
to avoid mutating
final fields. In extremely unlikely scenarios in which
an instance of that type contains an object that refers back to that
instance, this could lead to a
broken instance that throws NullPointerException when
used. (8240c7e596, 046468055f)graph: Removed @Beta from all APIs in the
package. (dae9566b73)graph: Added support to
Graphs.transitiveClosure() for different strategies for
adding self-loops. (2e13df25b2)graph: Added an asNetwork() view to
Graph and ValueGraph. (909c593c61)hash: Added BloomFilter.serializedSize().
(df9bcc251a)net: Added HttpHeaders.CDN_CACHE_CONTROL.
(75331b5030)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 5ef8364176..a388c90fee 100644
--- a/pom.xml
+++ b/pom.xml
@@ -97,7 +97,7 @@ under the License.
1.9.0
5.12.2
2.0.17
- 33.5.0-jre
+ 33.6.0-jre
4.2.12.Final
1.79.0
4.34.1
From 980b5146b5c659e5a06c4592b59cef0f2514ea72 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 15:57:26 +0200
Subject: [PATCH 059/120] MINOR: Bump org.bouncycastle:bcpkix-jdk18on from 1.83
to 1.84 (#1122)
Bumps
[org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) from
1.83 to 1.84.
Changelog
Sourced from org.bouncycastle:bcpkix-jdk18on's
changelog.
... (truncated)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 483c019cdc..1f9bc3e00e 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -165,7 +165,7 @@ under the License.
org.bouncycastle
bcpkix-jdk18on
- 1.83
+ 1.84
From 09038fbb578d38e98878359557b1e13dcb96b04f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 06:15:04 +0200
Subject: [PATCH 060/120] MINOR: Bump checker.framework.version from 3.55.1 to
4.0.0 (#1113)
Bumps `checker.framework.version` from 3.55.1 to 4.0.0.
Updates `org.checkerframework:checker-qual` from 3.55.1 to 4.0.0
Release notes
Sourced from org.checkerframework:checker-qual's
releases.
Release 4.0.0 of the Checker Framework
Version 4.0.0 (2026-04-07)
User-visible changes
To run the Checker Framework, you need to use a JDK 17 or later
version of javac. That is, you need to use JDK 17 or later when
compiling your code.
The Checker Framework can type-check any Java project, including
projects that compile to Java 8 or 11 bytecodes and run on JRE versions
8 or 11. That is, your code can run under any release of Java, from Java
8 onward.
The type qualifiers and utility libraries in
checker-qual.jar and checker-util.jar still
use Java 11 bytecode. Thus, they may be used in projects that run under
Java 11 or later.
Changes since version 3.0.0
Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600 issues. Thanks to everyone who contributed!
New checkers include:
- The Index
Checker warns about out-of-bounds accesses to arrays and
strings.
- The Initialized
Fields Checker warns if a constructor does not initialize a
field.
- The Resource
Leak Checker guarantees that every resource is closed rather than
leaked. Examples of resources are a channel, executor,
ExecutionControl, file, FileLock,
Formatter, reader, Scanner, socket, stream,
writer, etc.
- The SQL
Quotes Checker helps prevent SQL injection vulnerabilities.
New command-line arguments include:
-AskipFiles, -AonlyFiles-AassumeSideEffectFree,
-AassumeDeterministic, -AassumePure,
-AassumePureGetters-AuseConservativeDefaultsForUncheckedCode-AignoreRawTypeArguments-AwarnRedundantAnnotations-Ainfer=ajava, -AinferOutputDirectory,
-AinferOutputOriginal,
-AshowWpiFailedInferences-AshowSuppressWarningsStrings,
-AwarnUnneededSuppressionsExceptions-AshowPrefixInWarningMessages-AstubNoWarnIfNotFound, -AstubWarnNote,
-AmergeStubsWithSource-Aonelinemsg, -AdumpOnErrors,
-AexceptionLineSeparator-ApermitMissingJdk, -AparseAllJdk-AslowTypecheckingSeconds-Aversion, -AprintGitProperties- You can pass an option to only a particular checker (not all
checkers) by using an underscore prefix.
Other improvements include thousands of enhancements and bug fixes --
too many to list here.
Implementation details
All previously-deprecated methods and classes have been removed. If
your project builds upon the Checker Framework, we suggest that you
upgrade to version 3.55.1, resolve all the deprecation warnings, then
upgrade to version 4.0.0.
Changelog
Sourced from org.checkerframework:checker-qual's
changelog.
Version 4.0.0 (2026-04-07)
User-visible changes
To run the Checker Framework, you need to use a JDK 17 or later
version of
javac. That is, you need to use JDK 17 or later when compiling your
code.
The Checker Framework can type-check any Java project, including
projects that
compile to Java 8 or 11 bytecodes and run on JRE versions 8 or 11. That
is,
your code can run under any release of Java, from Java 8 onward.
The type qualifiers and utility libraries in
checker-qual.jar and
checker-util.jar still use Java 11 bytecode. Thus, they may
be used in
projects that run under Java 11 or later.
Changes since version 3.0.0
Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600
issues. Thanks to everyone who contributed!
New checkers include:
- The Index
Checker warns
about out-of-bounds accesses to arrays and strings.
- The Initialized
Fields
Checker
warns if a constructor does not initialize a field.
- The Resource
Leak
Checker
guarantees that every resource is closed rather than leaked. Examples of
resources are a channel, executor,
ExecutionControl, file,
FileLock,
Formatter, reader, Scanner, socket, stream,
writer, etc.
- The SQL
Quotes
Checker helps
prevent SQL injection vulnerabilities.
New command-line arguments include:
-AskipFiles, -AonlyFiles-AassumeSideEffectFree,
-AassumeDeterministic, -AassumePure,
-AassumePureGetters-AuseConservativeDefaultsForUncheckedCode-AignoreRawTypeArguments-AwarnRedundantAnnotations-Ainfer=ajava, -AinferOutputDirectory,
-AinferOutputOriginal,
-AshowWpiFailedInferences-AshowSuppressWarningsStrings,
-AwarnUnneededSuppressionsExceptions-AshowPrefixInWarningMessages-AstubNoWarnIfNotFound, -AstubWarnNote,
-AmergeStubsWithSource-Aonelinemsg, -AdumpOnErrors,
-AexceptionLineSeparator-ApermitMissingJdk, -AparseAllJdk-AslowTypecheckingSeconds
... (truncated)
Commits
479d087
new release 4.0.0bfff757
Put the manual in the right place.c532f6d
Put a copy of manual.pdf at top level of website as expected.5e53e6c
No closed issues.e67ae85
Prep for release.4192d0d
Remove file SKIP-REQUIRE-JAVADOC7d6d856
Remove or update references to JDK 8-16b1e3761
Remove all deprecated methodsa1b3064
Directly use Java 17 and below Javac APIs. (#7582)4efdbdb
Remove support for Java 8 from scripts and build scripts. (#7575)- Additional commits viewable in compare
view
Updates `org.checkerframework:checker` from 3.55.1 to 4.0.0
Release notes
Sourced from org.checkerframework:checker's
releases.
Release 4.0.0 of the Checker Framework
Version 4.0.0 (2026-04-07)
User-visible changes
To run the Checker Framework, you need to use a JDK 17 or later
version of javac. That is, you need to use JDK 17 or later when
compiling your code.
The Checker Framework can type-check any Java project, including
projects that compile to Java 8 or 11 bytecodes and run on JRE versions
8 or 11. That is, your code can run under any release of Java, from Java
8 onward.
The type qualifiers and utility libraries in
checker-qual.jar and checker-util.jar still
use Java 11 bytecode. Thus, they may be used in projects that run under
Java 11 or later.
Changes since version 3.0.0
Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600 issues. Thanks to everyone who contributed!
New checkers include:
- The Index
Checker warns about out-of-bounds accesses to arrays and
strings.
- The Initialized
Fields Checker warns if a constructor does not initialize a
field.
- The Resource
Leak Checker guarantees that every resource is closed rather than
leaked. Examples of resources are a channel, executor,
ExecutionControl, file, FileLock,
Formatter, reader, Scanner, socket, stream,
writer, etc.
- The SQL
Quotes Checker helps prevent SQL injection vulnerabilities.
New command-line arguments include:
-AskipFiles, -AonlyFiles-AassumeSideEffectFree,
-AassumeDeterministic, -AassumePure,
-AassumePureGetters-AuseConservativeDefaultsForUncheckedCode-AignoreRawTypeArguments-AwarnRedundantAnnotations-Ainfer=ajava, -AinferOutputDirectory,
-AinferOutputOriginal,
-AshowWpiFailedInferences-AshowSuppressWarningsStrings,
-AwarnUnneededSuppressionsExceptions-AshowPrefixInWarningMessages-AstubNoWarnIfNotFound, -AstubWarnNote,
-AmergeStubsWithSource-Aonelinemsg, -AdumpOnErrors,
-AexceptionLineSeparator-ApermitMissingJdk, -AparseAllJdk-AslowTypecheckingSeconds-Aversion, -AprintGitProperties- You can pass an option to only a particular checker (not all
checkers) by using an underscore prefix.
Other improvements include thousands of enhancements and bug fixes --
too many to list here.
Implementation details
All previously-deprecated methods and classes have been removed. If
your project builds upon the Checker Framework, we suggest that you
upgrade to version 3.55.1, resolve all the deprecation warnings, then
upgrade to version 4.0.0.
Changelog
Sourced from org.checkerframework:checker's
changelog.
Version 4.0.0 (2026-04-07)
User-visible changes
To run the Checker Framework, you need to use a JDK 17 or later
version of
javac. That is, you need to use JDK 17 or later when compiling your
code.
The Checker Framework can type-check any Java project, including
projects that
compile to Java 8 or 11 bytecodes and run on JRE versions 8 or 11. That
is,
your code can run under any release of Java, from Java 8 onward.
The type qualifiers and utility libraries in
checker-qual.jar and
checker-util.jar still use Java 11 bytecode. Thus, they may
be used in
projects that run under Java 11 or later.
Changes since version 3.0.0
Since version 3.0.0, 91 authors have made over 4500 commits and
closed over 600
issues. Thanks to everyone who contributed!
New checkers include:
- The Index
Checker warns
about out-of-bounds accesses to arrays and strings.
- The Initialized
Fields
Checker
warns if a constructor does not initialize a field.
- The Resource
Leak
Checker
guarantees that every resource is closed rather than leaked. Examples of
resources are a channel, executor,
ExecutionControl, file,
FileLock,
Formatter, reader, Scanner, socket, stream,
writer, etc.
- The SQL
Quotes
Checker helps
prevent SQL injection vulnerabilities.
New command-line arguments include:
-AskipFiles, -AonlyFiles-AassumeSideEffectFree,
-AassumeDeterministic, -AassumePure,
-AassumePureGetters-AuseConservativeDefaultsForUncheckedCode-AignoreRawTypeArguments-AwarnRedundantAnnotations-Ainfer=ajava, -AinferOutputDirectory,
-AinferOutputOriginal,
-AshowWpiFailedInferences-AshowSuppressWarningsStrings,
-AwarnUnneededSuppressionsExceptions-AshowPrefixInWarningMessages-AstubNoWarnIfNotFound, -AstubWarnNote,
-AmergeStubsWithSource-Aonelinemsg, -AdumpOnErrors,
-AexceptionLineSeparator-ApermitMissingJdk, -AparseAllJdk-AslowTypecheckingSeconds
... (truncated)
Commits
479d087
new release 4.0.0bfff757
Put the manual in the right place.c532f6d
Put a copy of manual.pdf at top level of website as expected.5e53e6c
No closed issues.e67ae85
Prep for release.4192d0d
Remove file SKIP-REQUIRE-JAVADOC7d6d856
Remove or update references to JDK 8-16b1e3761
Remove all deprecated methodsa1b3064
Directly use Java 17 and below Javac APIs. (#7582)4efdbdb
Remove support for Java 8 from scripts and build scripts. (#7575)- Additional commits viewable in compare
view
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index a388c90fee..0c5a00ded4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
10.23.0
true
2.42.0
- 3.55.1
+ 4.0.0
1.5.32
none
-Xdoclint:none
From 0f0a58433b46004ff9869a2512beded177340bca Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 06:17:22 +0200
Subject: [PATCH 061/120] MINOR: Bump io.grpc:grpc-bom from 1.79.0 to 1.80.0
(#1093)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.79.0
to 1.80.0.
Release notes
Sourced from io.grpc:grpc-bom's
releases.
V1.80.0
API Changes
- core: Added PickResult.copyWithSubchannel() and
PickResult.copyWithStreamTracerFactory() to simplify updating PickResult
while preserving metadata. Load balancing policies should now ensure
ForwardingSubchannel decorators are unwrapped before being returned in a
pick result. (#12658)
(eae16b251)
Bug Fixes
- core: Fixed the retry backoff jitter range to [0.8, 1.2] to align
with the gRPC A6 specification. Retries will now occur more consistently
around the calculated backoff interval. (#12639)
(024fdd0ea)
core: Fixed a race condition in RetriableStream where inFlightSubStreams
counting could become inconsistent during concurrent retry and deadline
events. This ensures that client calls (such as blockingUnaryCall) do
not hang indefinitely and correctly receive a close signal. (#12649)
(73abb4854)
Improvements
- api: Trigger R8's ServiceLoader optimization to reduce necessary
configuration when using R8 Full Mode (470219f9c). This allows gRPC to
avoid reflection, and the need to specify -keeps for various class’s
constructors.
Upgrade to protobuf 33.4 (#12615)
(50c18f183)
- cronet: Introduced CRONET_READ_BUFFER_SIZE_KEY to allow customizing
the read buffer size per-stream via CallOptions. Increasing the buffer
size from the 4KB default can significantly improve performance for
large messages by reducing JNI and context-switching overhead.
(31fdb6c22)
- api: Moved FlagResetRule to api/testFixtures and updated
ManagedChannelRegistry to honor the GRPC_ENABLE_RFC3986_URIS feature
flag. This ensures that target parsing is consistent across the library
when the new URI parser is enabled. (#12608)
- api: Updated NameResolverRegistry to natively support io.grpc.Uri.
This is a foundational change that allows gRPC's name resolution system
to handle URIs parsed with the new RFC 3986-compliant parser, ensuring
more robust target handling. (#12609)
(990348876)
- xds: Removed the GRPC_EXPERIMENTAL_XDS_SNI feature flag. SNI
determination via xDS is now always enabled and follows gRFC A101, where
SNI is derived from xDS configurations like auto_host_sni or
UpstreamTlsContext.sni. This ensures that no SNI is sent if not
explicitly configured, unless the legacy channel authority fallback is
enabled. (#12625)
(ac44e9681)
New Features
- core: pick_first shuffling now a weighted shuffle and observes
weights from EDS (34dd29042). This finishes the gRFC
A113 pick_first: Weighted Random Shuffling support
- netty: Added RFC 3986 support to the unix: name resolver. This
enables proper parsing of Unix domain socket URIs, including correct
handling of query and fragment components in both hierarchical (e.g.,
unix:///path) and opaque (e.g., unix:/path) formats. (#12659)
Thanks to
Commits
6c231b4
Bump version to 1.80.0daf7a6c
Update README etc to reference 1.80.0b7f9074
Revert "fix(xds): Allow and normalize trailing dot (FQDN) in
matchHostName (#...09a6e2e
Revert "netty: Preserve early server handshake failure cause in
logs"31fdb6c
Add CRONET_READ_BUFFER_SIZE_KEY API to
CronetClientStream470219f
Trigger R8's ServiceLoader optimization50ead96
netty: Preserve early server handshake failure cause in logseae16b2
unwrap ForwardingSubchannel during Picks (#12658)d9320ee
netty: Add RFC 3986 support to the 'unix:' name resolver.d5536b3
netty: factor out some duplicated code into a helper method- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 0c5a00ded4..738aea03b4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
2.0.17
33.6.0-jre
4.2.12.Final
- 1.79.0
+ 1.80.0
4.34.1
2.21.2
3.5.0
From e5482cd63d2043c0e418f1adc7bcd1e5192c5078 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?=
Date: Sun, 10 May 2026 08:15:56 +0200
Subject: [PATCH 062/120] MINOR: Fix Gandiva JNI build against Arrow C++ 24.0.0
(#1140)
Arrow C++ 24.0.0 introduced two breaking changes for the JNI build:
1. `arrow::decimal()` was removed; replaced with `arrow::decimal128()`
in the Gandiva JNI source.
2. xsimd >= 14.0.0 is now a required dependency. The Docker image's
vcpkg registry only ships xsimd 13.2.0, so the Linux JNI CMake
configuration was failing. Fixed by passing `xsimd_SOURCE=BUNDLED` to
the Arrow C++ CMake configure step so Arrow downloads and uses xsimd
14.0.0 directly, and by passing the vcpkg toolchain file to the Arrow
C++ configure step so other vcpkg-managed dependencies are still
resolved correctly.
---
.env | 2 +-
compose.yaml | 3 ++-
gandiva/src/main/cpp/jni_common.cc | 2 +-
3 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/.env b/.env
index 2bd7255476..51daa0406c 100644
--- a/.env
+++ b/.env
@@ -53,4 +53,4 @@ MAVEN=3.9.9
# Versions for various dependencies used to build artifacts
# Keep in sync with apache/arrow
ARROW_REPO_ROOT=./arrow
-VCPKG="4334d8b4c8916018600212ab4dd4bbdc343065d1" # 2025.09.17 Release
+VCPKG="66c0373dc7fca549e5803087b9487edfe3aca0a1" # 2026.01.16 Release
diff --git a/compose.yaml b/compose.yaml
index fb290b22fe..4fd825e5a5 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -109,5 +109,6 @@ services:
ARROW_JAVA_CDATA: "ON"
CCACHE_DIR: "/ccache"
command:
- ["git config --global --add safe.directory /arrow-java && \
+ ["/bin/bash", "-c",
+ "git config --global --add safe.directory /arrow-java &&
/arrow-java/ci/scripts/jni_manylinux_build.sh /arrow-java /arrow /build/java /arrow-java/jni"]
diff --git a/gandiva/src/main/cpp/jni_common.cc b/gandiva/src/main/cpp/jni_common.cc
index 2851250072..ec4888a512 100644
--- a/gandiva/src/main/cpp/jni_common.cc
+++ b/gandiva/src/main/cpp/jni_common.cc
@@ -221,7 +221,7 @@ DataTypePtr ProtoTypeToDataType(const gandiva::types::ExtGandivaType& ext_type)
return arrow::date64();
case gandiva::types::DECIMAL:
// TODO: error handling
- return arrow::decimal(ext_type.precision(), ext_type.scale());
+ return arrow::decimal128(ext_type.precision(), ext_type.scale());
case gandiva::types::TIME32:
return ProtoTypeToTime32(ext_type);
case gandiva::types::TIME64:
From 138e8521b17a2b83814b8714c7d8e0f94fe13656 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 05:20:41 +0200
Subject: [PATCH 063/120] MINOR: Bump com.fasterxml.jackson:jackson-bom from
2.21.2 to 2.21.3 (#1133)
Bumps
[com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom)
from 2.21.2 to 2.21.3.
Commits
374fbd0
[maven-release-plugin] prepare release jackson-bom-2.21.37059df7
Prep for 2.21.3 release2fd60bd
Merge branch '2.20' into 2.21b82a364
Merge branch '2.19' into 2.20ef4e013
Merge branch '2.18' into 2.19536ae51
Post-release dep version bump536c533
[maven-release-plugin] prepare for next development iteration426b778
[maven-release-plugin] prepare release jackson-bom-2.18.7a73cda9
Prep for 2.18.7 release76b4a05
Post-release dep version bump- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 738aea03b4..a5058a6336 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,7 +101,7 @@ under the License.
4.2.12.Final
1.80.0
4.34.1
- 2.21.2
+ 2.21.3
3.5.0
25.2.10
1.12.1
From 5dc3ea699a4b7f8e4799c8ee318b96c9a9cc4f31 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 07:58:24 +0200
Subject: [PATCH 064/120] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-7 to
1.5.7-8 (#1132)
Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-7 to 1.5.7-8.
Commits
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
compression/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/compression/pom.xml b/compression/pom.xml
index 9014b6913a..f3de6fc248 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
com.github.luben
zstd-jni
- 1.5.7-7
+ 1.5.7-8
From 5e2fb636514c708cf27bd367c8f452d72ab5fdef Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:45:59 +0200
Subject: [PATCH 065/120] MINOR: Bump
com.google.api.grpc:proto-google-common-protos from 2.70.0 to 2.71.0 (#1144)
Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.70.0 to 2.71.0.
Commits
6473668
chore(main): release 2.63.0 (#3927)8015e7e
chore: update googleapis commit at Fri Oct 3 02:28:22 UTC 2025 (#3923)48075a8
chore: Upper bound file deps change has chore type (#3949)1d74663
deps: update google auth library dependencies to v1.40.0 (#3945)7fb4f15
deps: Upgrade Google Http Java Client to v2.0.2 (#3946)feabef3
feat(librariangen): add bazel package (#3940)8d6c1f9
deps: Bump Guava to v33.5.0 (#3943)180b9a0
build(deps): update dependency
com.google.cloud:google-cloud-shared-config to...3f548fb
deps: update upper bound dependencies file (#3947)a1b5ba3
chore: Manage errorprone and j2objc versions in pom-parent (#3948)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index d199f70da4..15b870905d 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
com.google.api.grpc
proto-google-common-protos
- 2.70.0
+ 2.71.0
test
From 30d528fa9992c9ed16a01853a2ed285f0efcbd21 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:52:35 +0200
Subject: [PATCH 066/120] MINOR: Bump checker.framework.version from 4.0.0 to
4.1.0 (#1131)
Bumps `checker.framework.version` from 4.0.0 to 4.1.0.
Updates `org.checkerframework:checker-qual` from 4.0.0 to 4.1.0
Release notes
Sourced from org.checkerframework:checker-qual's
releases.
Checker Framework 4.1.0
Version 4.1.0 (2026-05-01)
User-visible changes
Removed deprecated script checker/bin-devel/build.sh;
use ./gradlew assemble instead.
Removed deprecated names "builder",
"object.construction", and "objectconstruction" for
the Called Methods Checker.
Implementation details
New method annotation @DoesNotUnrefineReceiver.
In AnnotatedTypeFactory:
- new method
hasDoesNotUnrefineReceiver().
isAliasedTypeAnnotation() is now protected rather than
public.
Closed issues
#6890,
#7364,
#7488.
Changelog
Sourced from org.checkerframework:checker-qual's
changelog.
Version 4.1.0 (2026-05-01)
User-visible changes
Removed deprecated script checker/bin-devel/build.sh;
use ./gradlew assemble
instead.
Removed deprecated names "builder",
"object.construction", and
"objectconstruction" for the Called Methods Checker.
Implementation details
New method annotation @DoesNotUnrefineReceiver.
In AnnotatedTypeFactory:
- new method
hasDoesNotUnrefineReceiver().
isAliasedTypeAnnotation() is now protected rather than
public.
Closed issues
#6890,
#7364,
#7488.
Commits
Updates `org.checkerframework:checker` from 4.0.0 to 4.1.0
Release notes
Sourced from org.checkerframework:checker's
releases.
Checker Framework 4.1.0
Version 4.1.0 (2026-05-01)
User-visible changes
Removed deprecated script checker/bin-devel/build.sh;
use ./gradlew assemble instead.
Removed deprecated names "builder",
"object.construction", and "objectconstruction" for
the Called Methods Checker.
Implementation details
New method annotation @DoesNotUnrefineReceiver.
In AnnotatedTypeFactory:
- new method
hasDoesNotUnrefineReceiver().
isAliasedTypeAnnotation() is now protected rather than
public.
Closed issues
#6890,
#7364,
#7488.
Changelog
Sourced from org.checkerframework:checker's
changelog.
Version 4.1.0 (2026-05-01)
User-visible changes
Removed deprecated script checker/bin-devel/build.sh;
use ./gradlew assemble
instead.
Removed deprecated names "builder",
"object.construction", and
"objectconstruction" for the Called Methods Checker.
Implementation details
New method annotation @DoesNotUnrefineReceiver.
In AnnotatedTypeFactory:
- new method
hasDoesNotUnrefineReceiver().
isAliasedTypeAnnotation() is now protected rather than
public.
Closed issues
#6890,
#7364,
#7488.
Commits
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index a5058a6336..e0754f7789 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
10.23.0
true
2.42.0
- 4.0.0
+ 4.1.0
1.5.32
none
-Xdoclint:none
From b068e28343d54604b1966e916a376ea4c1491f48 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:52:55 +0200
Subject: [PATCH 067/120] MINOR: Bump com.github.ben-manes.caffeine:caffeine
from 3.2.3 to 3.2.4 (#1130)
Bumps
[com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine)
from 3.2.3 to 3.2.4.
Release notes
Sourced from com.github.ben-manes.caffeine:caffeine's
releases.
3.2.4
- Improved access expiration's read performance by avoiding false
sharing effects caused by the timestamp update
- Fixed head-of-line blocking of expiration queues caused by in-flight
async entries (#1954)
- Fixed various minor issues found using AI audits
- Added ObjectInputFilter
support to JCache
Commits
836b65c
use a consistent expiration tolerance calculation0dc7daf
resurrect in-flight async entries on expiration0bac8b5
handle head-of-line blocking of expiration queues (fixes #1954)ff25836
test polishf3a6176
Fix JCache close/createCache races and recursive teardown622fbe7
Fix removal in identity views and widen hill-climber counters8da5a7a
defer weighing the entry until after the putIfAbsent hit fast-path94ad0ff
Record eviction stats before notifying the removal listener
consistentlyf94c011
Auto-assert eviction stats alongside
notifications.withCause.exclusively2e945e0
Skip timestamp writes within tolerance on the read path.- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 1f9bc3e00e..a813b2e168 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -176,7 +176,7 @@ under the License.
com.github.ben-manes.caffeine
caffeine
- 3.2.3
+ 3.2.4
From e6d9248447ef90d2d9a1412bfdee7019377e0603 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:53:10 +0200
Subject: [PATCH 068/120] MINOR: Bump
com.gradle:common-custom-user-data-maven-extension from 2.1.0 to 2.2.0
(#1128)
Bumps
[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)
from 2.1.0 to 2.2.0.
Release notes
Sourced from com.gradle:common-custom-user-data-maven-extension's
releases.
2.2.0
- [NEW] Add AI tag to the Build Scan when invoked by an AI Agent
- [NEW] Add custom value to the Build Scan indicating which AI Agent
invoked the build
- [NEW] Add link in Build Scan to GitHub PR
- [NEW] For GitHub PRs, capture
GITHUB_BASE_REF as the
value PR base branch
Commits
d594c60
[maven-release-plugin] prepare release v2.2.00a48e7a
Merge pull request #375
from gradle/cj/github-pr-base-branch02f6001
Capture GITHUB_BASE_REF as 'PR base branch' for GitHub PR buildsfc03fa9
Add recent feature additions to changes.md1501555
Merge pull request #370
from gradle/add-ai-agent-metadatade773ae
[Renovate Bot] Update dependency org.apache.maven:maven-core to v3.9.15
(#374)074832a
[Renovate Bot] Update dependency maven to v3.9.15 (#373)9de6cf1
Merge pull request #372
from gradle/renovate/github-actionsea1e3fc
[Renovate Bot] Update actions/upload-artifact digest to 043fb464384849
Match AI tags/values to CCUD Gradle- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.mvn/extensions.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index f52dfafb4a..e909f05105 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -28,6 +28,6 @@
com.gradle
common-custom-user-data-maven-extension
- 2.1.0
+ 2.2.0
From 331e9ee0968ab92499ed362ed276fa85e60b870d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 11 May 2026 15:53:29 +0200
Subject: [PATCH 069/120] MINOR: Bump commons-codec:commons-codec from 1.21.0
to 1.22.0 (#1127)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[commons-codec:commons-codec](https://github.com/apache/commons-codec)
from 1.21.0 to 1.22.0.
Changelog
Sourced from commons-codec:commons-codec's
changelog.
Apache Commons Codec 1.22.0 Release Notes
The Apache Commons Codec team is pleased to announce the release of
Apache Commons Codec 1.22.0.
The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In
addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
This is a feature and maintenance release. Java 8 or later is
required.
New features
Fixed Bugs
Changes
For complete information on Apache Commons Codec, including
instructions on how to submit bug reports,
patches, or suggestions for improvement, see the Apache Commons Codec
website:
https://commons.apache.org/proper/commons-codec/
Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi
Commits
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
vector/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/vector/pom.xml b/vector/pom.xml
index 4d247961c9..9b40e8820c 100644
--- a/vector/pom.xml
+++ b/vector/pom.xml
@@ -60,7 +60,7 @@ under the License.
commons-codec
commons-codec
- 1.21.0
+ 1.22.0
org.apache.arrow
From 0f7665f2b78a5f6bcfb37924fbee05a45adfb5f8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 12 May 2026 09:31:15 +0200
Subject: [PATCH 070/120] MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.37
to 11.37.1 (#1143)
Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.37 to 11.37.1.
Changelog
Sourced from com.nimbusds:oauth2-oidc-sdk's
changelog.
version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.
version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.
version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.
version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).
version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.
version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.
version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.
version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.
version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.
version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.
version 2.9 (2013-09-17)
... (truncated)
Commits
2a0f271
[maven-release-plugin] prepare for next development iterationfac7277
Bumps Nimbus JOSE+JWT, BouncyCastle517deb7
[maven-release-plugin] prepare release 11.37.1- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index a813b2e168..ea33091101 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -182,7 +182,7 @@ under the License.
com.nimbusds
oauth2-oidc-sdk
- 11.37
+ 11.37.1
From 3bc34b041761081ac32a7cd3b167f9ab8b628677 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 13 May 2026 13:51:48 +0200
Subject: [PATCH 071/120] MINOR: Bump commons-io:commons-io from 2.21.0 to
2.22.0 (#1126)
Bumps commons-io:commons-io from 2.21.0 to 2.22.0.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
dataset/pom.xml | 2 +-
flight/flight-sql-jdbc-core/pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/dataset/pom.xml b/dataset/pom.xml
index 7a0210ce95..cb889ecd7d 100644
--- a/dataset/pom.xml
+++ b/dataset/pom.xml
@@ -156,7 +156,7 @@ under the License.
commons-io
commons-io
- 2.21.0
+ 2.22.0
test
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index ea33091101..237b25d0e5 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -105,7 +105,7 @@ under the License.
commons-io
commons-io
- 2.21.0
+ 2.22.0
test
From af86cd3a7c17237368ea8411ed32e21b262c5b7b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 15:22:37 +0200
Subject: [PATCH 072/120] MINOR: Bump org.apache.calcite.avatica:avatica from
1.26.0 to 1.27.0 (#986)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[org.apache.calcite.avatica:avatica](https://github.com/apache/calcite-avatica)
from 1.26.0 to 1.27.0.
Commits
7754d94
[CALCITE-7200] Release Avatica 1.27.01e05be2
[CALCITE-7171] Update Jackson from 2.15.4 to 2.18.4.1 and switch to
using jac...9698a96
[CALCITE-7177] Update Guava from 33.4.0-jre to 33.4.8-jre in
Avatica0aec625
Bump rexml from 3.4.1 to 3.4.2 in /site5954d1a
[CALCITE-7165] Update OWASP plugin version to 12.1.3 for JDKs >=
117b6f14c
[CALCITE-7172] Update chekstyle version from 10.19.0 to 10.26.1 in
Avatica3ee1fd7
[CALCITE-7169] Update protobuf from 3.25.5 to 3.25.8 in Avatica927dc10
[CALCITE-7168] Update httpcore5 from 5.3.1 to 5.3.5 in Avatica458189f
[CALCITE-7167] Upgrade Jetty from 9.4.56.v20240826 to 9.4.58.v20250814
in Ava...592a39e
[CALCITE-7166] Update Gradle from 8.7 to 8.14.3 in Avatica- Additional commits viewable in compare
view
> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.
---------
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
...owFlightJdbcVectorSchemaRootResultSet.java | 2 +-
.../accessor/ArrowFlightJdbcAccessor.java | 24 +++++++++++++++++++
flight/flight-sql-jdbc-driver/pom.xml | 1 +
4 files changed, 27 insertions(+), 2 deletions(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 237b25d0e5..96a11f2b9a 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -159,7 +159,7 @@ under the License.
org.apache.calcite.avatica
avatica
- 1.26.0
+ 1.27.0
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
index 49334951de..5d02d6e843 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
@@ -128,7 +128,7 @@ public Object getObject(int columnIndex) throws SQLException {
if (metaData.type.id == Types.TIMESTAMP_WITH_TIMEZONE) {
return accessor.getTimestamp(localCalendar);
} else {
- return AvaticaSite.get(accessor, metaData.type.id, localCalendar);
+ return AvaticaSite.get(accessor, metaData.type.id, true, localCalendar);
}
}
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java
index f0fa55fa82..cd762fb1ac 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/accessor/ArrowFlightJdbcAccessor.java
@@ -36,6 +36,10 @@
import java.util.Calendar;
import java.util.Map;
import java.util.function.IntSupplier;
+import org.joou.UByte;
+import org.joou.UInteger;
+import org.joou.ULong;
+import org.joou.UShort;
/** Base Jdbc Accessor. */
public abstract class ArrowFlightJdbcAccessor implements Accessor {
@@ -99,6 +103,26 @@ public long getLong() throws SQLException {
throw getOperationNotSupported(this.getClass());
}
+ @Override
+ public UByte getUByte() throws SQLException {
+ throw getOperationNotSupported(this.getClass());
+ }
+
+ @Override
+ public UShort getUShort() throws SQLException {
+ throw getOperationNotSupported(this.getClass());
+ }
+
+ @Override
+ public UInteger getUInt() throws SQLException {
+ throw getOperationNotSupported(this.getClass());
+ }
+
+ @Override
+ public ULong getULong() throws SQLException {
+ throw getOperationNotSupported(this.getClass());
+ }
+
@Override
public float getFloat() throws SQLException {
throw getOperationNotSupported(this.getClass());
diff --git a/flight/flight-sql-jdbc-driver/pom.xml b/flight/flight-sql-jdbc-driver/pom.xml
index ff5763702b..801089d090 100644
--- a/flight/flight-sql-jdbc-driver/pom.xml
+++ b/flight/flight-sql-jdbc-driver/pom.xml
@@ -159,6 +159,7 @@ under the License.
org.apache.calcite.avatica:*
META-INF/services/java.sql.Driver
+ META-INF/README.txt
From 8c36d02205974c0cb912b11383e26f141ee2971e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 17:45:09 +0200
Subject: [PATCH 073/120] MINOR: Bump org.apache:apache from 37 to 38 (#1156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [org.apache:apache](https://github.com/apache/maven-apache-parent)
from 37 to 38.
Release notes
Sourced from org.apache:apache's
releases.
Apache Parent POM version 38
👻 Maintenance
📦 Dependency updates
- Bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to
3.10.1 (#578)
@dependabot[bot]
- Bump org.apache.maven.plugins:maven-invoker-plugin from 3.9.1 to
3.10.0 (#575)
@dependabot[bot]
- Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to
3.5.0 (#572)
@dependabot[bot]
- Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2
(#573)
@dependabot[bot]
- Bump
org.apache.apache.resources:apache-source-release-assembly-descriptor
from 1.7 to 1.8 (#571)
@dependabot[bot]
- Bump version.maven-surefire from 3.5.4 to 3.5.5 (#570)
@dependabot[bot]
- Bump org.apache.maven.plugins:maven-dependency-plugin from 3.9.0 to
3.10.0 (#568)
@dependabot[bot]
- Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to
3.15.0 (#567)
@dependabot[bot]
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
bom/pom.xml | 2 +-
pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/bom/pom.xml b/bom/pom.xml
index d97cc291c2..083ee1e0de 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache
apache
- 37
+ 38
diff --git a/pom.xml b/pom.xml
index e0754f7789..d6d36e5607 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@ under the License.
org.apache
apache
- 37
+ 38
org.apache.arrow
From c49d97625524a9ba3cb72380f88a2ee12f435695 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 17:45:26 +0200
Subject: [PATCH 074/120] MINOR: Bump org.immutables:value-annotations from
2.12.1 to 2.12.2 (#1157)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[org.immutables:value-annotations](https://github.com/immutables/immutables)
from 2.12.1 to 2.12.2.
Release notes
Sourced from org.immutables:value-annotations's
releases.
2.12.2
Maintenance release
What's Changed
New Contributors
Full Changelog: https://github.com/immutables/immutables/compare/2.12.1...2.12.2
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index d6d36e5607..dabb02594a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -183,7 +183,7 @@ under the License.
org.immutables
value-annotations
- 2.12.1
+ 2.12.2
provided
From d88adb33b00e8a7c3b743312b11c05ed36d2bd37 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 18:42:53 +0200
Subject: [PATCH 075/120] MINOR: Bump io.netty:netty-bom from 4.2.12.Final to
4.2.13.Final (#1155)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.12.Final to 4.2.13.Final.
Release notes
Sourced from io.netty:netty-bom's
releases.
netty-4.2.13.Final
CVEs Fixed
What's Changed
... (truncated)
Commits
b3844c8
[maven-release-plugin] prepare release netty-4.2.13.Final82f47fa
Merge commit from forkada0999
Merge commit from forkb4051e2
Fix BrotliDecoder not forwarding all decompressed chunks67207c1
Merge commit from fork541ca7c
Merge commit from fork943edb3
Fix codec-dns tests6459a28
Merge commit from forkb4ba61b
Fix checkstyle in HttpObjectDecoder977661f
Merge commit from fork- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index dabb02594a..df387a067d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
5.12.2
2.0.17
33.6.0-jre
- 4.2.12.Final
+ 4.2.13.Final
1.80.0
4.34.1
2.21.3
From 28367478a6ae695e409368b6f68b9ea22730fd9c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 19 May 2026 15:47:49 +0200
Subject: [PATCH 076/120] MINOR: Bump io.grpc:grpc-bom from 1.80.0 to 1.81.0
(#1154)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.80.0
to 1.81.0.
Release notes
Sourced from io.grpc:grpc-bom's
releases.
V1.81.0
In this release we drop support for Android API level 22 or lower
(Lollipop or earlier), following Google Play Service’s discontinued
updates for Lollipop (API levels 21 & 22) and now requires a
minimum of API level 23 (Android 6.0 Marshmallow).
API Changes
- api: Deprecate LoadBalancer.handleResolvedAddresses(). Developers
maintaining custom LoadBalancer implementations should transition to
using LoadBalancer.acceptResolvedAddresses(). Unlike the deprecated
method, acceptResolvedAddresses() returns a Status object, allowing the
load balancer to explicitly report success or reject the update if the
provided addresses or configuration are invalid. (#11623)
Behavior Changes
- core: Enable dns "caching" on Android for 30 seconds to
reduce CPU impact of a refresh loop with an LB policy (0675f70af).
DnsNameResolver ignores re-resolution requests on OpenJDK-like platforms
if it has been too soon since the last DNS query because
InetAddress.getAllByName() has a cache with a fixed entry lifetime, but
this logic was disabled for Android which does not have that style of
cache. Android’s cache uses the result TTL, which will rarely be less
than 30 seconds. This change would probably be most noticeable when 1)
changing to a different network (e.g., from wifi to mobile), 2) the
server has different addresses for different networks, and 3) the app is
not using AndroidChannelBuilder with an
android.context.Context. For reference, it seems Chrome
caches for 1 minute
Bug Fixes
- opentelemetry: Fix baggage propagation, the baggage propagation for
opentelemetry introduced in #12389
was broken. The context is decided once and used for all recording for
the call, thus guaranteeing all record()s have consistent
information.
- core: Address a race condition where
ManagedChannelOrphanWrapper could incorrectly log a
"not shutdown properly" warning during garbage collection when
using directExecutor(). (#12705)
(d459338d9)
- xds: Fix xDS HTTP CONNECT's transport socket name bug which is now
corrected to use
typeUrl. (#12740)
(eac9fe961)
- xds: Fix an issue where subchannel metrics were dropping their
association with the
backend_service. This ensures xDS load
balancing metrics are reported accurately. (#12735)
New Features
- netty: Add tcp metrics, by implementing a few of the metrics defined
in A80.
- api: Add a CallOption for a custom label on per-RPC metrics
(0e39b2967). This CallOption is copied by grpc-opentelemetry to the
grpc.client.call.custom label as defined by gRFC
A108. See also the gRPC
OpenTelemetry Metrics guide (update in-progress)
- xds: Add support for Weighted Round Robin (WRR) load balancing
driven by custom backend metrics, implementing the behavior defined in
gRFC A114. (#12645)
- utils: Update
AdvancedTlsX509KeyManager so that
developers can now preserve and use key aliases when dynamically
reloading TLS certificates. (#12686)
Documentation
- Update the "Outgoing Flow Control" section in the Manual
Flow Control example to say onNext() does not block, but rather queues
the messages in memory and advises developers to use
CallStreamObserver.isReady() to prevent this memory exhaustion (#12700)
(a3a9ffcbe) (#12726)
(65ae2efda)
- examples: Clean up Health example, and document need for
grpc-services (3ed732fc0)
Dependencies
- Upgrade Dependencies (#12719)
(16e17abba). Google-auth-library: 1.42.1, animal-sniffer: 1.27,
assertj-core:3.27.7, error_prone_annotations:2.48.0,
proto-google-common-protos:2.64.1, google-cloud-logging:3.23.10,
jetty-http2-server:12.1.7, jetty-ee10-servlet:12.1.7, lincheck:3.4,
opentelemetry-api:1.60.1,
opentelemetry-exporter-prometheus:1.60.1-alpha,
opentelemetry-gcp-resources:1.54.0-alpha,
opentelemetry-sdk-extension-autoconfigure:1.60.1,
opentelemetry-sdk-testing:1.60.1, robolectric:4.16.1,
tomcat-embed-core:10.1.52, tomcat-embed-core9: 9.0.115,
- Upgrade Netty to 4.1.132 and netty-tcnative to 2.0.75
(1528f809c)
Thanks to
Commits
6951542
Bump version to 1.81.0e94188e
Update README etc to reference 1.81.04813c6d
core,xds: Fix backend_service plumbing for subchannel metrics (#12735)6737eb5
Revert "Replace javax ThreadSafe annotation with errorprone
ThreadSafe (#1274...ef35313
Replace javax ThreadSafe annotation with errorprone ThreadSafe (#12742)3ed732f
examples: Clean up Health, and document need for grpc-serviceseac9fe9
xds: fix xDS HTTP CONNECT's transport socket name bug (#12740)1528f80
Upgrade Netty to 4.1.132 and netty-tcnative to 2.0.75d057a7e
[xds] Implement A114: WRR support for custom backend metrics (#12645)842636f
xds: Add configuration objects for ExtAuthz, GrpcService and Bootstrap
change...- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index df387a067d..a28d7167e1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
2.0.17
33.6.0-jre
4.2.13.Final
- 1.80.0
+ 1.81.0
4.34.1
2.21.3
3.5.0
From 4899492a26f941d955f5567797aa697262e747dd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 19 May 2026 15:48:10 +0200
Subject: [PATCH 077/120] MINOR: Bump parquet.version from 1.17.0 to 1.17.1
(#1152)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps `parquet.version` from 1.17.0 to 1.17.1.
Updates `org.apache.parquet:parquet-avro` from 1.17.0 to 1.17.1
Release notes
Sourced from org.apache.parquet:parquet-avro's
releases.
Apache Parquet Java 1.17.1
What's Changed
Full Changelog: https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1
Apache Parquet Java 1.17.1 RC0
What's Changed
Full Changelog: https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0
Commits
Updates `org.apache.parquet:parquet-hadoop` from 1.17.0 to 1.17.1
Release notes
Sourced from org.apache.parquet:parquet-hadoop's
releases.
Apache Parquet Java 1.17.1
What's Changed
Full Changelog: https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1
Apache Parquet Java 1.17.1 RC0
What's Changed
Full Changelog: https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
dataset/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/dataset/pom.xml b/dataset/pom.xml
index cb889ecd7d..5acc837860 100644
--- a/dataset/pom.xml
+++ b/dataset/pom.xml
@@ -32,7 +32,7 @@ under the License.
../../../cpp/release-build/
- 1.17.0
+ 1.17.1
1.12.1
From ef359de2cf33f3020eb7c41cd4a5eee564b99bf6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 08:27:25 +0200
Subject: [PATCH 078/120] MINOR: Bump dep.slf4j.version from 2.0.17 to 2.0.18
(#1151)
Bumps `dep.slf4j.version` from 2.0.17 to 2.0.18.
Updates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.18
Updates `org.slf4j:slf4j-jdk14` from 2.0.17 to 2.0.18
Updates `org.slf4j:jul-to-slf4j` from 2.0.17 to 2.0.18
Updates `org.slf4j:jcl-over-slf4j` from 2.0.17 to 2.0.18
Updates `org.slf4j:log4j-over-slf4j` from 2.0.17 to 2.0.18
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index a28d7167e1..2f55d591fd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -96,7 +96,7 @@ under the License.
${project.build.directory}/generated-sources
1.9.0
5.12.2
- 2.0.17
+ 2.0.18
33.6.0-jre
4.2.13.Final
1.81.0
From 4ecc92f817fc71fcf94e0df87d2c6c1bc9877847 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 11:32:03 +0200
Subject: [PATCH 079/120] MINOR: Bump org.apache.parquet:parquet-variant from
1.17.0 to 1.17.1 (#1150)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[org.apache.parquet:parquet-variant](https://github.com/apache/parquet-mr)
from 1.17.0 to 1.17.1.
Release notes
Sourced from org.apache.parquet:parquet-variant's
releases.
Apache Parquet Java 1.17.1
What's Changed
Full Changelog: https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1
Apache Parquet Java 1.17.1 RC0
What's Changed
Full Changelog: https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 2f55d591fd..0ce71f74cc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,7 +105,7 @@ under the License.
3.5.0
25.2.10
1.12.1
- 1.17.0
+ 1.17.1
5.23.0
2
From 755ce550c4dfc1771c2b350a0159b5e7f903debb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 10:32:04 +0200
Subject: [PATCH 080/120] MINOR: Bump org.immutables:value from 2.12.1 to
2.12.2 (#1168)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [org.immutables:value](https://github.com/immutables/immutables)
from 2.12.1 to 2.12.2.
Release notes
Sourced from org.immutables:value's
releases.
2.12.2
Maintenance release
What's Changed
New Contributors
Full Changelog: https://github.com/immutables/immutables/compare/2.12.1...2.12.2
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 0ce71f74cc..e69357c6af 100644
--- a/pom.xml
+++ b/pom.xml
@@ -314,7 +314,7 @@ under the License.
org.immutables
value
- 2.12.1
+ 2.12.2
From b58ce11516afd0aa2959673dac74ca0258ca2166 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 10:54:46 +0200
Subject: [PATCH 081/120] MINOR: Bump com.google.protobuf:protobuf-bom from
4.34.1 to 4.35.0 (#1167)
Bumps
[com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf)
from 4.34.1 to 4.35.0.
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index e69357c6af..2b629673ef 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,7 +100,7 @@ under the License.
33.6.0-jre
4.2.13.Final
1.81.0
- 4.34.1
+ 4.35.0
2.21.3
3.5.0
25.2.10
From 7fc14a532492f00e0744d8316fa8fb2f6970d31e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 11:15:13 +0200
Subject: [PATCH 082/120] MINOR: Bump io.netty:netty-bom from 4.2.13.Final to
4.2.14.Final (#1166)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.13.Final to 4.2.14.Final.
Release notes
Sourced from io.netty:netty-bom's
releases.
netty-4.2.14.Final
What's Changed
New Contributors
Full Changelog: https://github.com/netty/netty/compare/netty-4.2.13.Final...netty-4.2.14.Final
Commits
0a60b75
[maven-release-plugin] prepare release netty-4.2.14.Final72df658
Fix MQTT decoder size check after variable header replay (#16787)7125dba
MQTT: Allow MQTT 5 CONNECT with password only (#16833)9e19320
IoUring: Stop generic FileRegion drain loop when transferred() reaches
count(...4ce9f17
Route synchronous onLookupComplete exceptions via fireExceptionCaught
(#16794)f7b1b7d
Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without
Unsafe...0ccb265
IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6
rules ...a6aeb6d
Resolve all localhost addresses without querying DNS servers (#16749)c328ba2
Fix ResumptionController wrapping (#16815)bc5862b
HTTP2: Use 100 as default max concurrent streams setting (#16804)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 2b629673ef..322e35f8b4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
5.12.2
2.0.18
33.6.0-jre
- 4.2.13.Final
+ 4.2.14.Final
1.81.0
4.35.0
2.21.3
From 96339f6c2f35c3e6676e62fded200c0934f9d8d3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 11:22:01 +0200
Subject: [PATCH 083/120] MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.37.1
to 11.37.2 (#1164)
Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.37.1 to 11.37.2.
Changelog
Sourced from com.nimbusds:oauth2-oidc-sdk's
changelog.
version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.
version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.
version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.
version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).
version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.
version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.
version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.
version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.
version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.
version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.
version 2.9 (2013-09-17)
... (truncated)
Commits
fedf633
[maven-release-plugin] prepare for next development iteration29b77a0
Updates to JSON Smart 2.6.06e53206
[maven-release-plugin] prepare release 11.37.2- See full diff in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 96a11f2b9a..3741ee083c 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -182,7 +182,7 @@ under the License.
com.nimbusds
oauth2-oidc-sdk
- 11.37.1
+ 11.37.2
From 6a6b8c1c8f3364da125df743c4b00a212d91c449 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 13:15:12 +0200
Subject: [PATCH 084/120] MINOR: Bump com.gradle:develocity-maven-extension
from 2.4.0 to 2.4.1 (#1161)
Bumps com.gradle:develocity-maven-extension from 2.4.0 to 2.4.1.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.mvn/extensions.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index e909f05105..38b3c807b7 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -23,7 +23,7 @@
com.gradle
develocity-maven-extension
- 2.4.0
+ 2.4.1
com.gradle
From 315fd710cdf2a418e21cb567bedc8d7473e17ec7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 28 May 2026 11:20:28 +0200
Subject: [PATCH 085/120] MINOR: [CI] Bump docker/login-action from 4.1.0 to
4.2.0 (#1160)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [docker/login-action](https://github.com/docker/login-action) from
4.1.0 to 4.2.0.
Release notes
Sourced from docker/login-action's
releases.
v4.2.0
Full Changelog: https://github.com/docker/login-action/compare/v4.1.0...v4.2.0
Commits
650006c
Merge pull request #960
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...99df1a3
chore: update generated content3ab375f
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...39d8580
Merge pull request #970
from docker/dependabot/npm_and_yarn/docker/actions-to...4eefcd3
chore: update generated content56d092c
build(deps): bump @docker/actions-toolkit from 0.86.0 to
0.90.0e2e31ca
Merge pull request #976
from docker/dependabot/npm_and_yarn/actions/core-3.0.10bced94
chore: update generated content3e75a0f
build(deps): bump @actions/core from 3.0.0 to 3.0.1365bebd
Merge pull request #984
from docker/dependabot/github_actions/aws-actions/con...- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/rc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 2658f1da00..f0e99f1219 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
with:
repository: apache/parquet-testing
path: arrow/cpp/submodules/parquet-testing
- - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+ - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ghcr.io
username: ${{ github.actor }}
From da97828bfe2818e1233ef8c421e89e238fff8340 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:43:15 +0200
Subject: [PATCH 086/120] MINOR: Bump checker.framework.version from 4.1.0 to
4.2.0 (#1170)
Bumps `checker.framework.version` from 4.1.0 to 4.2.0.
Updates `org.checkerframework:checker-qual` from 4.1.0 to 4.2.0
Release notes
Sourced from org.checkerframework:checker-qual's
releases.
Checker Framework 4.2.0
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key
"createsmustcallfor.target.unparseable" to
"createsmustcallfor.target.unparsable".
Implementation details
In AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror,
TypeMirror).
In TypeHierarchy:
- new methods
equalsShallowEffective().
Closed issues
#7676,
#7679,
#7680,
#7695,
#7697,
#7699,
#7700,
#7727.
Changelog
Sourced from org.checkerframework:checker-qual's
changelog.
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key
"createsmustcallfor.target.unparseable" to
"createsmustcallfor.target.unparsable".
Implementation details
In AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror,
TypeMirror).
In TypeHierarchy:
- new methods
equalsShallowEffective().
Closed issues
#7676,
#7679,
#7680,
#7695,
#7697,
#7699,
#7700,
#7727.
Commits
Updates `org.checkerframework:checker` from 4.1.0 to 4.2.0
Release notes
Sourced from org.checkerframework:checker's
releases.
Checker Framework 4.2.0
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key
"createsmustcallfor.target.unparseable" to
"createsmustcallfor.target.unparsable".
Implementation details
In AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror,
TypeMirror).
In TypeHierarchy:
- new methods
equalsShallowEffective().
Closed issues
#7676,
#7679,
#7680,
#7695,
#7697,
#7699,
#7700,
#7727.
Changelog
Sourced from org.checkerframework:checker's
changelog.
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key
"createsmustcallfor.target.unparseable" to
"createsmustcallfor.target.unparsable".
Implementation details
In AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror,
TypeMirror).
In TypeHierarchy:
- new methods
equalsShallowEffective().
Closed issues
#7676,
#7679,
#7680,
#7695,
#7697,
#7699,
#7700,
#7727.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 322e35f8b4..81da2a2866 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
10.23.0
true
2.42.0
- 4.1.0
+ 4.2.0
1.5.32
none
-Xdoclint:none
From 035d96b256cc5eb687add6af2f5326ac5523f272 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:57:55 +0200
Subject: [PATCH 087/120] MINOR: Bump dep.junit.jupiter.version from 5.12.2 to
6.1.0 (#1162)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps `dep.junit.jupiter.version` from 5.12.2 to 6.1.0.
Updates `org.junit.jupiter:junit-jupiter-engine` from 5.12.2 to 6.1.0
Release notes
Sourced from org.junit.jupiter:junit-jupiter-engine's
releases.
JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0
JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage
6.1.0-RC1
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1
JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage
6.1.0-M1
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1
JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3
See Release
Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3
JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2
See Release
Notes.
... (truncated)
Commits
Updates `org.junit.jupiter:junit-jupiter-api` from 5.12.2 to 6.1.0
Release notes
Sourced from org.junit.jupiter:junit-jupiter-api's
releases.
JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0
JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage
6.1.0-RC1
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1
JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage
6.1.0-M1
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1
JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3
See Release
Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3
JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2
See Release
Notes.
... (truncated)
Commits
Updates `org.junit.jupiter:junit-jupiter-params` from 5.12.2 to 6.1.0
Release notes
Sourced from org.junit.jupiter:junit-jupiter-params's
releases.
JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0
JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage
6.1.0-RC1
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1
JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage
6.1.0-M1
See Release
Notes.
New Contributors
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1
JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3
See Release
Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3
JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2
See Release
Notes.
... (truncated)
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 81da2a2866..2e9b793562 100644
--- a/pom.xml
+++ b/pom.xml
@@ -95,7 +95,7 @@ under the License.
1773644827
${project.build.directory}/generated-sources
1.9.0
- 5.12.2
+ 6.1.0
2.0.18
33.6.0-jre
4.2.14.Final
From a993bf1727098cd21cd4973d6bcff2b20e5ebfd0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 9 Jun 2026 09:19:57 +0200
Subject: [PATCH 088/120] MINOR: Bump
com.google.api.grpc:proto-google-common-protos from 2.71.0 to 2.72.0 (#1178)
Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.71.0 to 2.72.0.
Commits
6e1c179
chore(main): release 2.64.0 (#3954)7a2f0b0
chore: update upper bound dependencies file (#3966)1e4a7e5
chore: update googleapis commit at Fri Oct 17 02:31:11 UTC 2025 (#3951)ffb557c
deps: Bump grpc-java to v1.76.0 (#3942)9ad8a4d
chore: remove internal/librariangen following migration to librarian
repo (#3...0a1bbea
chore(librariangen): Generate to use languagecontainer.Run (#3968)452d703
feat(librariangen): generate grpc stubs and resource helpers (#3967)85057e8
ci: remove librarian skipping on matrix builds (#3969)a26a6d9
chore(librariangen): languagecontainer package to parse release-init
request ...c86b4ea
ci: exclude internal/librariangen/** using dorny/paths-filter (#3961)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-core/pom.xml b/flight/flight-core/pom.xml
index 15b870905d..9ae402cdc4 100644
--- a/flight/flight-core/pom.xml
+++ b/flight/flight-core/pom.xml
@@ -134,7 +134,7 @@ under the License.
com.google.api.grpc
proto-google-common-protos
- 2.71.0
+ 2.72.0
test
From 485f813d0cec4987f5b597f6cd448d40f074ccce Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 9 Jun 2026 13:14:21 +0200
Subject: [PATCH 089/120] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-8 to
1.5.7-10 (#1177)
Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-8 to 1.5.7-10.
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
compression/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/compression/pom.xml b/compression/pom.xml
index f3de6fc248..41cdb03796 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
com.github.luben
zstd-jni
- 1.5.7-8
+ 1.5.7-10
From c836fad712c8a2ca14ac3a4b5f117a3e9fbefdc7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 09:43:35 +0200
Subject: [PATCH 090/120] MINOR: Bump com.fasterxml.jackson:jackson-bom from
2.21.3 to 2.22.0 (#1173)
Bumps
[com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom)
from 2.21.3 to 2.22.0.
Commits
112e859
[maven-release-plugin] prepare release jackson-bom-2.22.02cae2ce
Prep for 2.22.0 release7955d21
Merge branch '2.21' into 2.x8922a05
Post-release dep version bump1fa9943
[maven-release-plugin] prepare for next development iterationd1abd31
[maven-release-plugin] prepare release jackson-bom-2.21.42aaea43
Prep for 2.21.4 release902ec69
Update Woodstox/stax2-api (to 7.2.0/4.3.0)2570647
Merge branch '2.21' into 2.x9d3a9d5
Post-release dep version bump- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 2e9b793562..a5ed136e95 100644
--- a/pom.xml
+++ b/pom.xml
@@ -101,7 +101,7 @@ under the License.
4.2.14.Final
1.81.0
4.35.0
- 2.21.3
+ 2.22.0
3.5.0
25.2.10
1.12.1
From e525fbfe7f94301ea6b9725472a91206be0c7bd2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 14:31:56 +0200
Subject: [PATCH 091/120] MINOR: Bump
com.diffplug.spotless:spotless-maven-plugin from 3.4.0 to 3.6.0 (#1172)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 3.4.0 to 3.6.0.
Release notes
Sourced from com.diffplug.spotless:spotless-maven-plugin's
releases.
Maven Plugin v3.6.0
Added
- Add
<cacheDirectory> to
<eclipse>, <greclipse>, and
<eclipseCdt> for the Equo/Solstice P2 cache. (#2944)
EclipseJdtFormtterStep now can conditionally set
compiler source/compliance options. Allows for better parsing of AST
Node for newer language features and more correct sorting; e.g. records
or seal classes. (#2942)
Fixed
<versionCatalog> no longer splits long inline
tables across multiple lines — Gradle's TOML 1.0 parser cannot read
multi-line inline tables. The maxLineLength option has been
removed. (#2948)spotless:apply no longer aborts on the first file with
lints; it now formats all files and reports a single aggregated lint
failure across every file, matching the Gradle plugin's behavior. (#2937)<greclipse> and <eclipseCdt>
now default P2 data to the Maven local repository. (#2944)forbidWildcardImports and
forbidModuleImports now detect imports that have leading
whitespace (indentation/tabs). (#2939)
Changes
- Improved formatting performance by eliminating redundant per-step
line-ending normalization in the core formatter loop. (#2934)
Maven Plugin v3.5.1
Fixed
<licenseHeader> with
<yearMode>SET_FROM_GIT</yearMode> no longer
runs git log through a shell, eliminating a shell-injection
vector when formatting files whose names contain shell
metacharacters.- Bump transitive
plexus-utils 4.0.2 ->
4.0.3 to address CVE-2025-67030.
(#2919)
Maven Plugin v3.5.0
Added
<scalafmt> now reads the version from the
version field in the scalafmt config file when no
<version> is explicitly set, falling back to the
built-in default only if neither is available. (#2922)- Add
<toml> format type with
<versionCatalog> step for formatting and sorting
Gradle version catalog files. (#2916)
- Add
<javaparserVersion> option to
<cleanthat>, allowing users to override the
JavaParser version pulled in transitively by Cleanthat. (#2903)
- Add a
expandWildcardImports API for java (#2829)
Fixed
- Preserve case of JDBI named bind params that collide with SQL
keywords (e.g.
:limit, :offset) in the DBeaver
SQL formatter. (#2899)
- The
-Dspotless.ratchetFrom=... user property now takes
priority over <ratchetFrom> configured in the plugin
or in individual formatters, instead of being overridden by them. (#2896,
fixes #2842)
- Fix non-idempotent formatting when
importOrder() is
combined with greclipse(): a single catch-all group no
longer strips blank lines that greclipse() independently
inserted between import groups. (#2914)
Changes
- Fix
expandWildcardImports failing on JDK XML types such
as org.xml.sax.InputSource. (#2921)
- Use Eclipse JDT's collator-based comparison when sorting Java
members to better match Eclipse save actions. (#2920)
- Bump default
cleanthat version 2.24 ->
2.25. (#2903)
- Bump default
eclipse-jdt version from 4.35
to 4.39. (#2912)
Commits
71a433c
Published maven/3.6.03a0f101
Published gradle/8.6.0007e9d8
Published lib/4.6.2a074d53
Allow setting the local P2 cache dir in the Spotless Gradle plugin (#2944)a266fc2
Merge branch 'main' into add-cache-directory-dsle0d466e
Fix: sort members treats record declarations as types (#2942)3936b6f
Merge branch 'main' into main278765f
fix: expandWildcardImports support pom type dependency, fix #2839
(#2935)a18ddec
Remove maxLineLength from versionCatalog step (#2949)b91ad87
Add changelog entries for versionCatalog maxLineLength removal- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
bom/pom.xml | 2 +-
pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/bom/pom.xml b/bom/pom.xml
index 083ee1e0de..3201761e81 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -208,7 +208,7 @@ under the License.
com.diffplug.spotless
spotless-maven-plugin
- 3.4.0
+ 3.6.0
org.codehaus.mojo
diff --git a/pom.xml b/pom.xml
index a5ed136e95..63128589a9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -492,7 +492,7 @@ under the License.
com.diffplug.spotless
spotless-maven-plugin
- 3.4.0
+ 3.6.0
org.codehaus.mojo
From cb24576e895c0bf8e1d062e2fc82f2b53bfa2eb8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 11 Jun 2026 10:07:43 +0200
Subject: [PATCH 092/120] MINOR: Bump io.netty:netty-bom from 4.2.14.Final to
4.2.15.Final (#1175)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.14.Final to 4.2.15.Final.
Release notes
Sourced from io.netty:netty-bom's
releases.
netty-4.2.15.Final
Security fixes
- CVE-2026-48059:
memory exhaustion in
io.netty:netty-codec-haproxy
(high).
- CVE-2026-47691:
DNS cache poisoning in
io.netty:netty-resolver-dns
(high).
- CVE-2026-50560:
DDoS in
io.netty:netty-codec-http2.
- CVE-2026-50011:
memory exhaustion in
io.netty:netty-codec-redis
(high).
- CVE-2026-44250:
memory exhaustion in
io.netty:netty-codec-redis
(high).
- CVE-2026-44890:
memory exhaustion in
io.netty:netty-codec-redis
(high).
- CVE-2026-50009:
information disclosure and denial of service in
io.netty:netty-codec-classes-quic.
- CVE-2026-44249:
IPv6 subnet filter bypass in
io.netty:netty-handler
(high).
- CVE-2026-50020:
request smuggling in
io.netty:netty-codec-http.
- CVE-2026-44892:
memory exhaustion in
io.netty:netty-codec-http3
(high).
- CVE-2026-44893:
memory leak in
io.netty:netty-codec-haproxy (high).
- CVE-2026-44894:
traffic amplification in
io.netty:netty-codec-classes-quic
(high).
- CVE-2026-50010:
TLS hostname verification accidentally disabled in
io.netty:netty-handler (high).
- CVE-2026-45673:
DNS cache poisoning in
io.netty:netty-resolver-dns.
- CVE-2026-45416:
excessive memory usage from SNIHandler in
io.netty:netty-handler (high).
- CVE-2026-45536:
file descriptor leak in
io.netty:netty-transport-native-epoll and
io.netty:netty-transport-native-kqueue.
- CVE-2026-45674:
DNS cache poisoning in
io.netty:netty-resolver-dns
(high).
- CVE-2026-46340:
memory exhaustion in
io.netty:netty-transport-sctp
(high).
- CVE-2026-47244:
denial of service in
io.netty:netty-codec-http2.
- CVE-2026-48006:
memory exhaustion in
io.netty:netty-codec-redis
(high).
- CVE-2026-48748:
memory exhaustion in
io.netty:netty-codec-http3
(high).
- CVE-2026-48043:
memory exhaustion in
io.netty:netty-codec-http2.
What's Changed
New Contributors
Full Changelog: https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final
Commits
a41f7b2
[maven-release-plugin] prepare release netty-4.2.15.Final2394530
Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero
Remain...0bd1657
Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)76291f5
Fix SCTP and Redis tests (#16893)e067b6e
Fix revapi warnings (#16885)5a52600
Pass maxAllocation to Brotli and Zstd decoders (#16844)541add0
Merge commit from fork270800e
Merge commit from fork3d45a1e
Merge commit from fork75127ca
Merge commit from fork- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 63128589a9..877a355860 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@ under the License.
6.1.0
2.0.18
33.6.0-jre
- 4.2.14.Final
+ 4.2.15.Final
1.81.0
4.35.0
2.22.0
From 5540c4d6358cd653fcc7e463e60aa3f21f3288ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:01:08 +0200
Subject: [PATCH 093/120] MINOR: Bump
com.squareup.okhttp3:mockwebserver3-junit5 from 5.3.2 to 5.4.0 (#1185)
Bumps
[com.squareup.okhttp3:mockwebserver3-junit5](https://github.com/square/okhttp)
from 5.3.2 to 5.4.0.
Changelog
Sourced from com.squareup.okhttp3:mockwebserver3-junit5's
changelog.
Version 5.4.0
2026-06-08
- New: Add superpowers to interceptors. Interceptors can now override
anything settable on
OkHttpClient.Builder, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom Call.Factory wrappers.
- Fix: Limit each HTTP/2 response to 256 KiB of total headers.
- Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
okhttp-coroutines artifact.
- Upgrade: [GraalVM 25.0.3][graalvm_25].
- Upgrade: [Okio 3.17.0][okio_3_17_0].
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 3741ee083c..9a8406cf31 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -129,7 +129,7 @@ under the License.
com.squareup.okhttp3
mockwebserver3-junit5
- 5.3.2
+ 5.4.0
test
From 6e0b5f7905c436ef847eaba4a703564ee6faae7e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 18:01:26 +0200
Subject: [PATCH 094/120] MINOR: Bump org.jacoco:jacoco-maven-plugin from
0.8.14 to 0.8.15 (#1176)
Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco)
from 0.8.14 to 0.8.15.
Release notes
Sourced from org.jacoco:jacoco-maven-plugin's
releases.
0.8.15
New Features
- JaCoCo now officially supports Java 26 (GitHub #2076).
- Experimental support for Java 27 class files (GitHub #2004).
- Compatibility methods generated by Kotlin compiler for functions
defined in interfaces are filtered out during generation of report
(GitHub #1905).
- Compatibility methods generated by Kotlin compiler for exposed boxed
inline value classes (JvmExposeBoxed annotation) are filtered out during
generation of report (GitHub #1944).
- Methods generated by the Kotlin compiler for functions with
JvmStatic annotation are filtered out during generation of report
(GitHub #2097).
- Improved filtering of bytecode generated by Kotlin compiler for when
expressions and statements with kotlin.String subject where first branch
condition contains string with largest hash (GitHub #2098).
- Part of bytecode that javac versions from 24 to 26 generate for
switch statements and expressions with selector expression of type
java.lang.String inside lambdas is filtered out during generation of
report (GitHub #2023).
- Improved performance of Kotlin files analysis by parsing SMAPs only
once per class (GitHub #2114).
- For better performance agent output methods tcpclient and tcpserver
use BufferedOutputStream to write execution data to socket. Maven
plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use
BufferedInputStream to read execution data from socket. Third-party
integrations should do the same to benefit from this change in agent
(GitHub #2089).
Fixed bugs
- Fixed processing of Kotlin SMAP in synthetic classes (GitHub #1985).
- Multiple JaCoCo runtimes within one JVM writing to the same output
file should not cause data corruption when running on JDK versions from
6 to 10 affected by JDK-8166253
(GitHub #2065,
#2074).
- For better performance agent writes to output file via
BufferedOutputStream, this fixes regression introduced in version 0.6.2
(GitHub #2073).
- Fixed NullPointerException when JaCoCo agent is loaded by non system
class loader, for example when loaded by JBoss Modules (GitHub #1651).
Non-functional Changes
- JaCoCo now depends on ASM 9.10.1 (GitHub #2134).
Commits
6c5260a
Prepare release v0.8.155c05141
Transfer of execution data through socket should use buffered stream (#2089)ab5efa9
Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (#2148)5f6ea38
Use Windows 2025 image in GitHub Actions (#2130)35a8af2
Use Renovate instead of Dependabot for updates of ASM (#2137)85b8ddf
Upgrade ASM to 9.10.1 (#2134)2988647
AgentModule should use ClassLoader of agent instead of SystemClassLoader
(#1651)75a4e31
Add filter for Kotlin @JvmExposeBoxed (#1944)691fa1d
Use Renovate instead of Dependabot for updates of GitHub Actions (#2132)3e18f17
Require at least JDK 21 for build (#2128)- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 877a355860..326b26ee97 100644
--- a/pom.xml
+++ b/pom.xml
@@ -352,7 +352,7 @@ under the License.
org.jacoco
jacoco-maven-plugin
- 0.8.14
+ 0.8.15
... (truncated)
Commits
7b5e9ff
Bump version to 1.82.120768f1
Update README etc to reference 1.82.15ab5eba
kokoro: Remove extra / in architecture replacement6726caf
buildscripts: add regional td config for psm-interop (v1.82.x backport)
(#12864)022256f
Bump version to 1.82.1-SNAPSHOT78fb519
Bump version to 1.82.0b62b0fc
Update README etc to reference 1.82.08802dc3
build: downgrade multiarch to Ubuntu 20.04 and consolidate images (#12830)be300bd
kokoro: Avoid brew on Mac OS4111f6f
core: throw IOException when ProxySelector returns null or empty list
(#12793)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 326b26ee97..3aa3867b90 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,7 +99,7 @@ under the License.
2.0.18
33.6.0-jre
4.2.15.Final
- 1.81.0
+ 1.82.1
4.35.0
2.22.0
3.5.0
From 2812cfaa4d455f202c9e11a1facdd83acb82530b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 09:54:40 +0200
Subject: [PATCH 096/120] MINOR: Bump dep.junit.jupiter.version from 6.1.0 to
6.1.1 (#1200)
Bumps `dep.junit.jupiter.version` from 6.1.0 to 6.1.1.
Updates `org.junit.jupiter:junit-jupiter-engine` from 6.1.0 to 6.1.1
Release notes
Sourced from org.junit.jupiter:junit-jupiter-engine's
releases.
JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1
See Release
Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1
Commits
0d85889
Release 6.1.10363eee
Finalize 6.1.1 release notesa6d540a
Move entry to 6.1.1 release notes69339d5
Only pass timeout when publishing to avoid failure in nmcp plugindec2eb9
Allow excluding engines from memory cleanup mode (#5786)a5f4270
Publish sha256/sha512 checksums again but filter out signature ones (#5796)8213012
Update plugin nmcp-settings to v1.6.0 (#5787)d1bf847
Generate Javadoc for aggregator modulesd721de5
Pass --no-fonts to javadoc conventiond289ec6
Restore original SetSystemProperty values in a ParameterizedTest (#5720)- Additional commits viewable in compare
view
Updates `org.junit.jupiter:junit-jupiter-api` from 6.1.0 to 6.1.1
Release notes
Sourced from org.junit.jupiter:junit-jupiter-api's
releases.
JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1
See Release
Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1
Commits
0d85889
Release 6.1.10363eee
Finalize 6.1.1 release notesa6d540a
Move entry to 6.1.1 release notes69339d5
Only pass timeout when publishing to avoid failure in nmcp plugindec2eb9
Allow excluding engines from memory cleanup mode (#5786)a5f4270
Publish sha256/sha512 checksums again but filter out signature ones (#5796)8213012
Update plugin nmcp-settings to v1.6.0 (#5787)d1bf847
Generate Javadoc for aggregator modulesd721de5
Pass --no-fonts to javadoc conventiond289ec6
Restore original SetSystemProperty values in a ParameterizedTest (#5720)- Additional commits viewable in compare
view
Updates `org.junit.jupiter:junit-jupiter-params` from 6.1.0 to 6.1.1
Release notes
Sourced from org.junit.jupiter:junit-jupiter-params's
releases.
JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1
See Release
Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1
Commits
0d85889
Release 6.1.10363eee
Finalize 6.1.1 release notesa6d540a
Move entry to 6.1.1 release notes69339d5
Only pass timeout when publishing to avoid failure in nmcp plugindec2eb9
Allow excluding engines from memory cleanup mode (#5786)a5f4270
Publish sha256/sha512 checksums again but filter out signature ones (#5796)8213012
Update plugin nmcp-settings to v1.6.0 (#5787)d1bf847
Generate Javadoc for aggregator modulesd721de5
Pass --no-fonts to javadoc conventiond289ec6
Restore original SetSystemProperty values in a ParameterizedTest (#5720)- Additional commits viewable in compare
view
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 3aa3867b90..fa493e066d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -95,7 +95,7 @@ under the License.
1773644827
${project.build.directory}/generated-sources
1.9.0
- 6.1.0
+ 6.1.1
2.0.18
33.6.0-jre
4.2.15.Final
From bf0b3445c5cac4f964665a5f28b4a80c4ad8d640 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:57:05 +0900
Subject: [PATCH 097/120] MINOR: [CI] Bump actions/cache from 5 to 6 (#1197)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
Release notes
Sourced from actions/cache's
releases.
v6.0.0
What's Changed
Full Changelog: https://github.com/actions/cache/compare/v5...v6.0.0
v5.1.0
What's Changed
Full Changelog: https://github.com/actions/cache/compare/v5...v5.1.0
v5.0.5
What's Changed
Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.5
v5.0.4
What's Changed
New Contributors
Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.4
v5.0.3
What's Changed
Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.3
v.5.0.2
v5.0.2
What's Changed
... (truncated)
Commits
55cc834
Merge pull request #1768
from jasongin/readonly-cached8cd72f
Bump @actions/cache to v6.1.0 - handle cache write error
due to RO token2c8a9bd
Merge pull request #1760
from actions/samirat/esm_migration_and_package_updatee9b91fd
Prettier fixese4884b8
Rebuild dist10baf01
Fixed licensese39b386
Fix test mock return orderb692820
PR feedback6074912
Rebuild dist bundles as ESM to match type:module5a912e8
Fix lint and jest issues- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/dev.yml | 2 +-
.github/workflows/rc.yml | 8 ++++----
.github/workflows/test.yml | 4 ++--
3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 2111f47254..f23c4e5e2f 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -42,7 +42,7 @@ jobs:
with:
python-version: '3.x'
- name: pre-commit (cache)
- uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.cache/pre-commit
key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index f0e99f1219..79c4476345 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -133,7 +133,7 @@ jobs:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Cache
- uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .docker
key: jni-linux-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -264,7 +264,7 @@ jobs:
run: |
echo "CCACHE_DIR=${PWD}/ccache" >> ${GITHUB_ENV}
- name: Cache ccache
- uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ccache
key: jni-macos-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -340,7 +340,7 @@ jobs:
run: |
echo "CCACHE_DIR=${PWD}/ccache" >> ${GITHUB_ENV}
- name: Cache ccache
- uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ccache
key: jni-windows-${{ matrix.platform.arch }}-${{ hashFiles('arrow/cpp/**') }}
@@ -414,7 +414,7 @@ jobs:
repository: apache/arrow-testing
path: testing
- name: Cache ~/.m2
- uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.m2
key: binaries-build-${{ hashFiles('**/*.java', '**/pom.xml') }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8c437a056d..1e4664237b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,7 +63,7 @@ jobs:
fetch-depth: 0
submodules: recursive
- name: Cache Docker Volumes
- uses: actions/cache@v5
+ uses: actions/cache@v6
with:
path: .docker
key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml', '**/*.java') }}
@@ -190,7 +190,7 @@ jobs:
run: |
ci/scripts/util_free_space.sh
- name: Cache Docker Volumes
- uses: actions/cache@v5
+ uses: actions/cache@v6
with:
path: .docker
key: integration-conda-${{ hashFiles('cpp/**') }}
From 365a5f46d1fe437d2337d705dd6a0043f2ac1703 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:45:32 +0200
Subject: [PATCH 098/120] MINOR: [CI] Bump actions/checkout from 6 to 7 (#1193)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to
7.
Release notes
Sourced from actions/checkout's
releases.
v7.0.0
What's Changed
New Contributors
Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0
v6.0.3
What's Changed
New Contributors
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
v6.0.2
What's Changed
Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2
v6.0.1
What's Changed
Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1
Changelog
Sourced from actions/checkout's
changelog.
Changelog
v7.0.0
v6.0.3
v6.0.2
v6.0.1
v6.0.0
v5.0.1
v5.0.0
v4.3.1
v4.3.0
v4.2.2
v4.2.1
... (truncated)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/dev.yml | 2 +-
.github/workflows/dev_pr.yml | 2 +-
.github/workflows/rc.yml | 20 ++++++++++----------
.github/workflows/release.yml | 2 +-
.github/workflows/test.yml | 20 ++++++++++----------
5 files changed, 23 insertions(+), 23 deletions(-)
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index f23c4e5e2f..25b08700fd 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -33,7 +33,7 @@ jobs:
name: "pre-commit"
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7
with:
fetch-depth: 0
persist-credentials: false
diff --git a/.github/workflows/dev_pr.yml b/.github/workflows/dev_pr.yml
index 20946c8185..ad000df88e 100644
--- a/.github/workflows/dev_pr.yml
+++ b/.github/workflows/dev_pr.yml
@@ -43,7 +43,7 @@ jobs:
name: "Ensure PR format"
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@v7
with:
fetch-depth: 0
persist-credentials: false
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 79c4476345..fdfcd1cce3 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -38,7 +38,7 @@ jobs:
timeout-minutes: 5
steps:
- name: Checkout
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
submodules: recursive
- name: Prepare for tag
@@ -113,17 +113,17 @@ jobs:
ci/scripts/download_cpp.sh
- name: Checkout Apache Arrow C++
if: github.event_name == 'schedule'
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow
path: arrow
- name: Checkout apache/arrow-testing
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-testing
path: arrow/testing
- name: Checkout apache/parquet-testing
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/parquet-testing
path: arrow/cpp/submodules/parquet-testing
@@ -180,17 +180,17 @@ jobs:
ci/scripts/download_cpp.sh
- name: Checkout Apache Arrow C++
if: github.event_name == 'schedule'
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow
path: arrow
- name: Checkout apache/arrow-testing
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-testing
path: arrow/testing
- name: Checkout apache/parquet-testing
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/parquet-testing
path: arrow/cpp/submodules/parquet-testing
@@ -310,7 +310,7 @@ jobs:
ci/scripts/download_cpp.sh
- name: Checkout Apache Arrow C++
if: github.event_name == 'schedule'
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow
path: arrow
@@ -409,7 +409,7 @@ jobs:
test -f jni/arrow_dataset_jni/x86_64/arrow_dataset_jni.dll
test -f jni/arrow_orc_jni/x86_64/arrow_orc_jni.dll
- name: Checkout apache/arrow-testing
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-testing
path: testing
@@ -497,7 +497,7 @@ jobs:
contents: write
steps:
- name: Checkout
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
path: site
- name: Prepare branch
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a2c5a55544..7692eb6cbe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,7 +65,7 @@ jobs:
$artifact
done
- name: Checkout for publishing docs
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
path: site
- name: Publish docs
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1e4664237b..ac8080d075 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -58,7 +58,7 @@ jobs:
MAVEN: ${{ matrix.maven }}
steps:
- name: Checkout Arrow
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
@@ -100,7 +100,7 @@ jobs:
distribution: 'temurin'
java-version: ${{ matrix.jdk }}
- name: Checkout Arrow
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
@@ -131,7 +131,7 @@ jobs:
java-version: ${{ matrix.jdk }}
distribution: 'temurin'
- name: Checkout Arrow
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
@@ -152,37 +152,37 @@ jobs:
timeout-minutes: 60
steps:
- name: Checkout Arrow
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
fetch-depth: 0
repository: apache/arrow
submodules: recursive
- name: Checkout Arrow Rust
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-rs
path: rust
- name: Checkout Arrow nanoarrow
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-nanoarrow
path: nanoarrow
- name: Checkout Arrow .NET
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-dotnet
path: dotnet
- name: Checkout Arrow Go
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-go
path: go
- name: Checkout Arrow Java
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
path: java
- name: Checkout Arrow JavaScript
- uses: actions/checkout@v6
+ uses: actions/checkout@v7
with:
repository: apache/arrow-js
path: js
From 9122af2ad87c6f51d8ed9082ba2f0a122980ea2a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 18:45:52 +0200
Subject: [PATCH 099/120] MINOR: Bump com.google.protobuf:protobuf-bom from
4.35.0 to 4.35.1 (#1186)
Bumps
[com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf)
from 4.35.0 to 4.35.1.
Commits
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index fa493e066d..c39eafc209 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,7 +100,7 @@ under the License.
33.6.0-jre
4.2.15.Final
1.82.1
- 4.35.0
+ 4.35.1
2.22.0
3.5.0
25.2.10
From b0e51af855ef5befac903b1a6de3f535258ccd1b Mon Sep 17 00:00:00 2001
From: YangJie
Date: Tue, 30 Jun 2026 12:40:01 +0800
Subject: [PATCH 100/120] GH-1116: [Java] Fix compressed buffer prefix write
and ZSTD dstCapacity (#1119)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
## What
Two fixes in the compression codec:
1. **`AbstractCompressionCodec.compress()`: capture `writerIndex()`
once**
The previous code read `uncompressedBuffer.writerIndex()` at multiple
sites — for the size comparison and again after `doCompress()` to
populate the 8-byte uncompressed-length prefix. Capture the value once
at the top of `compress()` and reuse it for the empty-buffer check, the
size comparison, and the prefix, so all three consumers see the same
value.
2. **`ZstdCompressionCodec.doCompress()`: `dstCapacity` overstated by 8
bytes**
`Zstd.compressUnsafe(dst, dstSize, ...)` expects `dstSize` to be the
available space from `dst`. The code offsets `dst` by 8 bytes past the
prefix but passed `8 + maxSize` instead of `maxSize`. The
`compressBound()` headroom hides this in practice, but the parameter was
semantically wrong. Pass `maxSize`.
## Tests
Covered by the existing round-trip tests (`testEmptyBuffer`,
`testReadWriteStream`, `testReadWriteFile`, etc.). I was not able to
construct a minimal reproducer for the original `declaredUncompressed=0`
symptom on the unfixed code, so both fixes are conservative correctness
improvements derived from code inspection rather than failing-then-green
regression tests.
---
.../org/apache/arrow/compression/ZstdCompressionCodec.java | 2 +-
.../arrow/vector/compression/AbstractCompressionCodec.java | 7 +++++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java b/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
index 290723608d..ed46fe81b4 100644
--- a/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
+++ b/compression/src/main/java/org/apache/arrow/compression/ZstdCompressionCodec.java
@@ -44,7 +44,7 @@ protected ArrowBuf doCompress(BufferAllocator allocator, ArrowBuf uncompressedBu
long bytesWritten =
Zstd.compressUnsafe(
compressedBuffer.memoryAddress() + CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH,
- dstSize,
+ maxSize,
/*src*/ uncompressedBuffer.memoryAddress(),
/* srcSize= */ uncompressedBuffer.writerIndex(),
/* level= */ this.compressionLevel);
diff --git a/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java b/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
index 58d9e4db9b..b108173c82 100644
--- a/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
+++ b/vector/src/main/java/org/apache/arrow/vector/compression/AbstractCompressionCodec.java
@@ -29,7 +29,11 @@ public abstract class AbstractCompressionCodec implements CompressionCodec {
@Override
public ArrowBuf compress(BufferAllocator allocator, ArrowBuf uncompressedBuffer) {
- if (uncompressedBuffer.writerIndex() == 0L) {
+ // GH-1116: capture writerIndex() once so the empty-buffer check, size
+ // comparison, and uncompressed-length prefix all see the same value.
+ long uncompressedLength = uncompressedBuffer.writerIndex();
+
+ if (uncompressedLength == 0L) {
// shortcut for empty buffer
ArrowBuf compressedBuffer = allocator.buffer(CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH);
compressedBuffer.setLong(0, 0);
@@ -41,7 +45,6 @@ public ArrowBuf compress(BufferAllocator allocator, ArrowBuf uncompressedBuffer)
ArrowBuf compressedBuffer = doCompress(allocator, uncompressedBuffer);
long compressedLength =
compressedBuffer.writerIndex() - CompressionUtil.SIZE_OF_UNCOMPRESSED_LENGTH;
- long uncompressedLength = uncompressedBuffer.writerIndex();
if (compressedLength > uncompressedLength) {
// compressed buffer is larger, send the raw buffer
From 301d3d8f889d3e4d1f45fc6e1707460ae5baaeb4 Mon Sep 17 00:00:00 2001
From: Pedro Matias
Date: Tue, 30 Jun 2026 05:41:30 +0100
Subject: [PATCH 101/120] GH-1063: Add is_update field to
ActionCreatePreparedStatementResult (#1064)
## What's Changed
A new field, `optional bool is_update = 4;`, was added to `message
ActionCreatePreparedStatementResult`. When this field is sent by the
server, its value indicates whether the proper network flow to execute
the query that the driver should follow uses
`CommandPreparedStatementQuery` or `CommandPreparedStatementUpdate`.
For outdated servers that don't send the field, the driver maintains its
current behavior of using `CommandPreparedStatementQuery` when the
`dataset_schema` is not empty, thus ensuring the backward compatibility
of the new driver with old servers.
This change was created with AI assistance (Augment Code and Claude
code). All lines were manually reviewed by a human. The output is not
copyrightable subject matter.
- Closes #1063
---------
Co-authored-by: David Li
---
arrow-format/FlightSql.proto | 5 ++
.../ArrowFlightJdbcFlightStreamResultSet.java | 2 +-
...owFlightJdbcVectorSchemaRootResultSet.java | 2 +-
.../driver/jdbc/ArrowFlightMetaImpl.java | 23 +++++--
.../client/ArrowFlightSqlClientHandler.java | 19 ++++++
.../ArrowFlightPreparedStatementTest.java | 48 ++++++++++++++
.../jdbc/ArrowFlightStatementExecuteTest.java | 66 +++++++++++++++++++
.../jdbc/utils/MockFlightSqlProducer.java | 42 ++++++++++++
.../arrow/flight/sql/FlightSqlClient.java | 13 ++++
9 files changed, 212 insertions(+), 8 deletions(-)
diff --git a/arrow-format/FlightSql.proto b/arrow-format/FlightSql.proto
index 566230c2a6..b1dc57b33b 100644
--- a/arrow-format/FlightSql.proto
+++ b/arrow-format/FlightSql.proto
@@ -1550,6 +1550,11 @@ message ActionCreatePreparedStatementResult {
// If the query provided contained parameters, parameter_schema contains the
// schema of the expected parameters. It should be an IPC-encapsulated Schema, as described in Schema.fbs.
bytes parameter_schema = 3;
+
+ // When set to true, the query should be executed with CommandPreparedStatementUpdate,
+ // when set to false, the query should be executed with CommandPreparedStatementQuery.
+ // If not set, the client can choose how to execute the query.
+ optional bool is_update = 4;
}
/*
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
index 2885f7895b..376e5b11e7 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcFlightStreamResultSet.java
@@ -106,7 +106,7 @@ static ArrowFlightJdbcFlightStreamResultSet fromFlightInfo(
final TimeZone timeZone = TimeZone.getDefault();
final QueryState state = new QueryState();
- final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null);
+ final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null, null);
final AvaticaResultSetMetaData resultSetMetaData =
new AvaticaResultSetMetaData(null, null, signature);
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
index 5d02d6e843..ad6670a001 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightJdbcVectorSchemaRootResultSet.java
@@ -73,7 +73,7 @@ public static ArrowFlightJdbcVectorSchemaRootResultSet fromVectorSchemaRoot(
final TimeZone timeZone = TimeZone.getDefault();
final QueryState state = new QueryState();
- final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null);
+ final Meta.Signature signature = ArrowFlightMetaImpl.newSignature(null, null, null, null);
final AvaticaResultSetMetaData resultSetMetaData =
new AvaticaResultSetMetaData(null, null, signature);
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
index 64529b50c8..0d85b5eddb 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/ArrowFlightMetaImpl.java
@@ -53,7 +53,8 @@ public ArrowFlightMetaImpl(final AvaticaConnection connection) {
}
/** Construct a signature. */
- static Signature newSignature(final String sql, Schema resultSetSchema, Schema parameterSchema) {
+ static Signature newSignature(
+ final String sql, Schema resultSetSchema, Schema parameterSchema, Boolean isUpdate) {
List columnMetaData =
resultSetSchema == null
? new ArrayList<>()
@@ -62,10 +63,17 @@ static Signature newSignature(final String sql, Schema resultSetSchema, Schema p
parameterSchema == null
? new ArrayList<>()
: ConvertUtils.convertArrowFieldsToAvaticaParameters(parameterSchema.getFields());
- StatementType statementType =
- resultSetSchema == null || resultSetSchema.getFields().isEmpty()
- ? StatementType.IS_DML
- : StatementType.SELECT;
+ // If the server provided the is_update field, use it to determine the statement type
+ StatementType statementType;
+ if (isUpdate != null) {
+ statementType = isUpdate ? StatementType.IS_DML : StatementType.SELECT;
+ } else {
+ // Fall back to the legacy logic: check if the result set schema is empty
+ statementType =
+ resultSetSchema == null || resultSetSchema.getFields().isEmpty()
+ ? StatementType.IS_DML
+ : StatementType.SELECT;
+ }
return new Signature(
columnMetaData,
sql,
@@ -178,7 +186,10 @@ private PreparedStatement prepareForHandle(final String query, StatementHandle h
((ArrowFlightConnection) connection).getClientHandler().prepare(query);
handle.signature =
newSignature(
- query, preparedStatement.getDataSetSchema(), preparedStatement.getParameterSchema());
+ query,
+ preparedStatement.getDataSetSchema(),
+ preparedStatement.getParameterSchema(),
+ preparedStatement.isUpdate());
statementHandlePreparedStatementMap.put(new StatementHandleKey(handle), preparedStatement);
return preparedStatement;
}
diff --git a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
index f0ea284239..719cc38a2b 100644
--- a/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
+++ b/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/ArrowFlightSqlClientHandler.java
@@ -388,6 +388,14 @@ public interface PreparedStatement extends AutoCloseable {
*/
Schema getParameterSchema();
+ /**
+ * Gets whether this {@link PreparedStatement} is an update statement.
+ *
+ * @return {@code true} if this is an update statement, {@code false} if it's a query, or {@code
+ * null} if the server did not provide this information.
+ */
+ @Nullable Boolean isUpdate();
+
void setParameters(VectorSchemaRoot parameters);
@Override
@@ -456,6 +464,12 @@ public long executeUpdate() {
@Override
public StatementType getType() {
+ // If the server provided the is_update field, use it to determine the statement type
+ final Boolean isUpdate = preparedStatement.isUpdate();
+ if (isUpdate != null) {
+ return isUpdate ? StatementType.UPDATE : StatementType.SELECT;
+ }
+ // Fall back to the legacy logic: check if the result set schema is empty
final Schema schema = preparedStatement.getResultSetSchema();
return schema.getFields().isEmpty() ? StatementType.UPDATE : StatementType.SELECT;
}
@@ -475,6 +489,11 @@ public void setParameters(VectorSchemaRoot parameters) {
preparedStatement.setParameters(parameters);
}
+ @Override
+ public Boolean isUpdate() {
+ return preparedStatement.isUpdate();
+ }
+
@Override
public void close() {
try {
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
index 0369c3a162..078837adf3 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightPreparedStatementTest.java
@@ -98,6 +98,40 @@ public void testSimpleQueryNoParameterBindingWithExecute() throws SQLException {
}
}
+ @Test
+ public void testSimpleQueryNoParameterBindingWithExecuteV2() throws SQLException {
+ final String query = "SELECT * FROM TEST_V2";
+ final Schema schema =
+ new Schema(Collections.singletonList(Field.nullable("", Types.MinorType.INT.getType())));
+ PRODUCER.addSelectQuery(
+ query,
+ schema,
+ Collections.singletonList(
+ listener -> {
+ try (final BufferAllocator allocator = new RootAllocator(Long.MAX_VALUE);
+ final VectorSchemaRoot root = VectorSchemaRoot.create(schema, allocator)) {
+ root.allocateNew();
+ ((IntVector) root.getVector(0)).setSafe(0, 123);
+ root.setRowCount(1);
+ listener.start(root);
+ listener.putNext();
+ } finally {
+ listener.completed();
+ }
+ }),
+ false);
+ try (final PreparedStatement preparedStatement = connection.prepareStatement(query)) {
+ boolean isResultSet = preparedStatement.execute();
+ assertTrue(isResultSet);
+ final ResultSet resultSet = preparedStatement.getResultSet();
+ assertTrue(resultSet.next());
+ assertEquals(123, resultSet.getInt(1));
+ assertFalse(resultSet.next());
+ assertFalse(preparedStatement.getMoreResults());
+ assertEquals(-1, preparedStatement.getUpdateCount());
+ }
+ }
+
@Test
public void testQueryWithParameterBinding() throws SQLException {
final String query = "Fake query with parameters";
@@ -203,6 +237,20 @@ public void testUpdateQueryWithExecute() throws SQLException {
}
}
+ @Test
+ public void testUpdateQueryWithExecuteV2() throws SQLException {
+ String query = "Fake update with execute V2";
+ PRODUCER.addUpdateQuery(query, /*updatedRows*/ 99, true);
+ try (final PreparedStatement stmt = connection.prepareStatement(query)) {
+ boolean isResultSet = stmt.execute();
+ assertFalse(isResultSet);
+ int updated = stmt.getUpdateCount();
+ assertEquals(99, updated);
+ assertFalse(stmt.getMoreResults());
+ assertEquals(-1, stmt.getUpdateCount());
+ }
+ }
+
@Test
public void testUpdateQueryWithParameters() throws SQLException {
String query = "Fake update with parameters";
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
index 632cb0ba56..6acce9c2a6 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/ArrowFlightStatementExecuteTest.java
@@ -62,6 +62,9 @@ public class ArrowFlightStatementExecuteTest {
private static final String SAMPLE_LARGE_UPDATE_QUERY =
"UPDATE this_large_table SET this_large_field = that_large_field FROM this_large_test WHERE this_large_condition";
private static final long SAMPLE_LARGE_UPDATE_COUNT = Long.MAX_VALUE;
+ private static final String SAMPLE_QUERY_CMD_V2 = "SELECT * FROM this_test_v2";
+ private static final String SAMPLE_LARGE_UPDATE_QUERY_V2 =
+ "UPDATE this_large_table_v2 SET this_large_field = that_large_field FROM this_large_test WHERE this_large_condition";
private static final MockFlightSqlProducer PRODUCER = new MockFlightSqlProducer();
@RegisterExtension
@@ -96,6 +99,31 @@ public static void setUpBeforeClass() {
}));
PRODUCER.addUpdateQuery(SAMPLE_UPDATE_QUERY, SAMPLE_UPDATE_COUNT);
PRODUCER.addUpdateQuery(SAMPLE_LARGE_UPDATE_QUERY, SAMPLE_LARGE_UPDATE_COUNT);
+
+ // V2 queries with is_update field set
+ PRODUCER.addSelectQuery(
+ SAMPLE_QUERY_CMD_V2,
+ SAMPLE_QUERY_SCHEMA,
+ Collections.singletonList(
+ listener -> {
+ try (final BufferAllocator allocator = new RootAllocator(Long.MAX_VALUE);
+ final VectorSchemaRoot root =
+ VectorSchemaRoot.create(SAMPLE_QUERY_SCHEMA, allocator)) {
+ final UInt1Vector vector = (UInt1Vector) root.getVector(VECTOR_NAME);
+ IntStream.range(0, SAMPLE_QUERY_ROWS)
+ .forEach(index -> vector.setSafe(index, index));
+ vector.setValueCount(SAMPLE_QUERY_ROWS);
+ root.setRowCount(SAMPLE_QUERY_ROWS);
+ listener.start(root);
+ listener.putNext();
+ } catch (final Throwable throwable) {
+ listener.error(throwable);
+ } finally {
+ listener.completed();
+ }
+ }),
+ false);
+ PRODUCER.addUpdateQuery(SAMPLE_LARGE_UPDATE_QUERY_V2, SAMPLE_LARGE_UPDATE_COUNT, true);
}
@BeforeEach
@@ -168,4 +196,42 @@ public void testUpdateCountShouldStartOnZero() throws SQLException {
is(allOf(equalTo(statement.getLargeUpdateCount()), equalTo(0L))));
assertThat(statement.getResultSet(), is(nullValue()));
}
+
+ @Test
+ public void testExecuteShouldRunSelectQueryV2() throws SQLException {
+ assertThat(statement.execute(SAMPLE_QUERY_CMD_V2), is(true));
+ final Set numbers =
+ IntStream.range(0, SAMPLE_QUERY_ROWS)
+ .boxed()
+ .map(Integer::byteValue)
+ .collect(Collectors.toCollection(HashSet::new));
+ try (final ResultSet resultSet = statement.getResultSet()) {
+ final int columnCount = resultSet.getMetaData().getColumnCount();
+ assertThat(columnCount, is(1));
+ int rowCount = 0;
+ for (; resultSet.next(); rowCount++) {
+ assertThat(numbers.remove(resultSet.getByte(1)), is(true));
+ }
+ assertThat(rowCount, is(equalTo(SAMPLE_QUERY_ROWS)));
+ }
+ assertThat(numbers, is(Collections.emptySet()));
+ assertThat(
+ (long) statement.getUpdateCount(),
+ is(allOf(equalTo(statement.getLargeUpdateCount()), equalTo(-1L))));
+ }
+
+ @Test
+ public void testExecuteShouldRunUpdateQueryForLargeUpdateV2() throws SQLException {
+ assertThat(statement.execute(SAMPLE_LARGE_UPDATE_QUERY_V2), is(false)); // UPDATE query.
+ final long updateCountSmall = statement.getUpdateCount();
+ final long updateCountLarge = statement.getLargeUpdateCount();
+ assertThat(updateCountLarge, is(equalTo(SAMPLE_LARGE_UPDATE_COUNT)));
+ assertThat(
+ updateCountSmall,
+ is(
+ allOf(
+ equalTo((long) AvaticaUtils.toSaturatedInt(updateCountLarge)),
+ not(equalTo(updateCountLarge)))));
+ assertThat(statement.getResultSet(), is(nullValue()));
+ }
}
diff --git a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
index 45c2a96404..6627d91ab6 100644
--- a/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
+++ b/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/utils/MockFlightSqlProducer.java
@@ -87,6 +87,7 @@
import org.apache.arrow.vector.types.pojo.Schema;
import org.apache.arrow.vector.util.JsonStringArrayList;
import org.apache.calcite.avatica.Meta.StatementType;
+import org.checkerframework.checker.nullness.qual.Nullable;
/** An ad-hoc {@link FlightSqlProducer} for tests. */
public final class MockFlightSqlProducer implements FlightSqlProducer {
@@ -101,6 +102,7 @@ public final class MockFlightSqlProducer implements FlightSqlProducer {
private final SqlInfoBuilder sqlInfoBuilder = new SqlInfoBuilder();
private final Map parameterSchemas = new HashMap<>();
private final Map>> expectedParameterValues = new HashMap<>();
+ private final Map isUpdateMap = new HashMap<>();
private final Map actionTypeCounter = new HashMap<>();
@@ -176,6 +178,40 @@ public void addUpdateQuery(final String sqlCommand, final long updatedRows) {
});
}
+ /**
+ * Registers a new {@link StatementType#SELECT} SQL query, optionally setting the is_update field.
+ *
+ * @param sqlCommand the SQL command under which to register the new query.
+ * @param schema the schema to use for the query result.
+ * @param resultProviders the result provider for this query.
+ * @param isUpdate value to report for the is_update field, or {@code null} to leave it unset.
+ */
+ public void addSelectQuery(
+ final String sqlCommand,
+ final Schema schema,
+ final List> resultProviders,
+ final @Nullable Boolean isUpdate) {
+ addSelectQuery(sqlCommand, schema, resultProviders);
+ if (isUpdate != null) {
+ isUpdateMap.put(sqlCommand, isUpdate);
+ }
+ }
+
+ /**
+ * Registers a new {@link StatementType#UPDATE} SQL query, optionally setting the is_update field.
+ *
+ * @param sqlCommand the SQL command.
+ * @param updatedRows the number of rows affected.
+ * @param isUpdate value to report for the is_update field, or {@code null} to leave it unset.
+ */
+ public void addUpdateQuery(
+ final String sqlCommand, final long updatedRows, final @Nullable Boolean isUpdate) {
+ addUpdateQuery(sqlCommand, updatedRows);
+ if (isUpdate != null) {
+ isUpdateMap.put(sqlCommand, isUpdate);
+ }
+ }
+
/**
* Adds a catalog query to the results.
*
@@ -247,6 +283,12 @@ public void createPreparedStatement(
resultBuilder.setParameterSchema(ByteString.copyFrom(outputStream.toByteArray()));
}
+ // Set is_update field if present
+ final Boolean isUpdate = isUpdateMap.get(query);
+ if (isUpdate != null) {
+ resultBuilder.setIsUpdate(isUpdate);
+ }
+
listener.onNext(new Result(pack(resultBuilder.build()).toByteArray()));
} catch (final Throwable t) {
listener.onError(t);
diff --git a/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java b/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
index 623f9311e8..0af09faee1 100644
--- a/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
+++ b/flight/flight-sql/src/main/java/org/apache/arrow/flight/sql/FlightSqlClient.java
@@ -1284,6 +1284,19 @@ public Schema getParameterSchema() {
return parameterSchema;
}
+ /**
+ * Returns whether the server indicated this prepared statement is an update query.
+ *
+ * @return true if the server indicated this is an update query, false if the server indicated
+ * this is a select query, or null if the server did not provide this information.
+ */
+ public Boolean isUpdate() {
+ if (preparedStatementResult.hasIsUpdate()) {
+ return preparedStatementResult.getIsUpdate();
+ }
+ return null;
+ }
+
/** Get the schema of the result set (should be identical to {@link #getResultSetSchema()}). */
public SchemaResult fetchSchema(CallOption... options) {
checkOpen();
From fcba1b0345faed30621863af85a102c6d2fc1362 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 07:51:48 +0200
Subject: [PATCH 102/120] MINOR: Bump org.cyclonedx:cyclonedx-maven-plugin from
2.9.1 to 2.9.2 (#1198)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin)
from 2.9.1 to 2.9.2.
Release notes
Sourced from org.cyclonedx:cyclonedx-maven-plugin's
releases.
2.9.2
🚀 New features and improvements
- chore: upgrade maven-dependency-analyzer/asm, support Java 25 (#630)
@shihyuho
📦 Dependency updates
🔧 Build
Commits
0fe189d
[maven-release-plugin] prepare release cyclonedx-maven-plugin-2.9.296c218c
update scm urls0fe08b4
Revert "Bump JamesIves/github-pages-deploy-action from 4.7.3 to
4.8.0"6779e48
Revert "Bump release-drafter/release-drafter from 6 to 7"955fead
switch to Central Publishing Portal50dbac7
Bump release-drafter/release-drafter from 6 to 7d50bc58
Bump org.apache.maven.plugins:maven-project-info-reports-plugin1034644
Bump plugin-tools.version from 3.15.0 to 3.15.2018ab8e
Bump commons-codec:commons-codec from 1.17.1 to 1.22.0e359705
Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index c39eafc209..6a97ac4620 100644
--- a/pom.xml
+++ b/pom.xml
@@ -522,7 +522,7 @@ under the License.
org.cyclonedx
cyclonedx-maven-plugin
- 2.9.1
+ 2.9.2
org.apache.drill.tools
From bd8cd52fc8426b485a8b3e64997fb178c84c9de2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 07:54:25 +0200
Subject: [PATCH 103/120] MINOR: Bump com.github.luben:zstd-jni from 1.5.7-10
to 1.5.7-11 (#1184)
Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)
from 1.5.7-10 to 1.5.7-11.
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
compression/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/compression/pom.xml b/compression/pom.xml
index 41cdb03796..aa7dee6f89 100644
--- a/compression/pom.xml
+++ b/compression/pom.xml
@@ -55,7 +55,7 @@ under the License.
com.github.luben
zstd-jni
- 1.5.7-10
+ 1.5.7-11
From 04471f4f8900e0a91efe0d6ae717c3211aa5efbd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 2 Jul 2026 08:11:17 +0200
Subject: [PATCH 104/120] MINOR: Bump logback.version from 1.5.32 to 1.5.34
(#1171)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps `logback.version` from 1.5.32 to 1.5.34.
Updates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34
Release notes
Sourced from ch.qos.logback:logback-classic's
releases.
Logback 1.5.34
2026-06-01 Release of logback version 1.5.34
• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues #1040](qos-ch/logback#1040),
reported by Naotsugu Kobayashi.
• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by York Shen and registered as CVE-2026-10532.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java "21" 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.33
2026-05-27 Release of logback version 1.5.33
• PropertiesConfiguratorModelHandler now registers
properties file URLs to the ConfigurationWatchList when
scan is enabled (via local scan="true" attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in issues/1034.
• When processing <conversionRule> elements and
both class and converterClass attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in issues/1031.
• HardenedModelInputStream will no longer accept to
deserialize all classes located under the "java.lang" and
"java.util" packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by York Shen and registered as CVE-2026-9828.
• SSL parameters for SSLSocketAppender now enable
hostname verification by default. Moreover, the default protocol is now
"TLSv1.2". This potential vulnerability was reported by York
Shen.
• When printing the status message field,
ViewStatusMessagesServletBase now escapes special
characters such as "&" as character entities. This
potential vulnerability was reported by York Shen.
• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Commits
e62272a
prepare release 1.5.341e9e926
add resolveProxyClassRejectsDynamicProxies unit test2de5cbe
added StackTraceElementProxyTest, minor edits to AGENTS.md0e9b927
in case StackTraceElement is null use a substitute, fixing
issues/1040f7a0654
prevent resolveProxyClass bypass249b81f
docs are no longer distributed1c3b26a
start work on 1.5.34-SNAPSHOT124e8b4
prepare release 1.5.33d8fd6f2
escapeTags in message field when printing status messages95edbeb
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...- Additional commits viewable in compare
view
Updates `ch.qos.logback:logback-core` from 1.5.32 to 1.5.34
Release notes
Sourced from ch.qos.logback:logback-core's
releases.
Logback 1.5.34
2026-06-01 Release of logback version 1.5.34
• In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null, StackTraceElementProxy
substitutes a dummy instance instead of throwing an
IllegalArgumentException. This resolves [issues #1040](qos-ch/logback#1040),
reported by Naotsugu Kobayashi.
• HardenedObjectInputStream will now throw an InvalidClassException
during deserialization attempts of Proxy classes. This change addresses
potential deserialization whitelist bypass vulnerability reported by York Shen and registered as CVE-2026-10532.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag
v_1.5.34. This release was built using Java "21" 2023-10-17
LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.33
2026-05-27 Release of logback version 1.5.33
• PropertiesConfiguratorModelHandler now registers
properties file URLs to the ConfigurationWatchList when
scan is enabled (via local scan="true" attribute or top-level
configuration scan), ensuring changes are detected and reconfiguration
occurs. This problem was reported in issues/1034.
• When processing <conversionRule> elements and
both class and converterClass attributes are
specified, silently use the class attribute without issuing a warning.
However, if the attribute values differ, a warning will be issued. This
change was requested in issues/1031.
• HardenedModelInputStream will no longer accept to
deserialize all classes located under the "java.lang" and
"java.util" packages but a limited number of explicitly
authorized classes in those packages. This potential deserialization
whitelist bypass vulnerability was reported by York Shen and registered as CVE-2026-9828.
• SSL parameters for SSLSocketAppender now enable
hostname verification by default. Moreover, the default protocol is now
"TLSv1.2". This potential vulnerability was reported by York
Shen.
• When printing the status message field,
ViewStatusMessagesServletBase now escapes special
characters such as "&" as character entities. This
potential vulnerability was reported by York Shen.
• A bit-wise identical binary of this version can be reproduced by
building from source code at commit
124e8b49b55ac34d08743a0646bd463410192647 associated with the tag
v_1.5.33. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Commits
e62272a
prepare release 1.5.341e9e926
add resolveProxyClassRejectsDynamicProxies unit test2de5cbe
added StackTraceElementProxyTest, minor edits to AGENTS.md0e9b927
in case StackTraceElement is null use a substitute, fixing
issues/1040f7a0654
prevent resolveProxyClass bypass249b81f
docs are no longer distributed1c3b26a
start work on 1.5.34-SNAPSHOT124e8b4
prepare release 1.5.33d8fd6f2
escapeTags in message field when printing status messages95edbeb
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...- Additional commits viewable in compare
view
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 6a97ac4620..231720eb44 100644
--- a/pom.xml
+++ b/pom.xml
@@ -113,7 +113,7 @@ under the License.
true
2.42.0
4.2.0
- 1.5.32
+ 1.5.34
none
-Xdoclint:none
From 8ce39730fe969b41c8620b02f3fa77c974d90784 Mon Sep 17 00:00:00 2001
From: Jordan Epstein <32082339+jordepic@users.noreply.github.com>
Date: Thu, 2 Jul 2026 18:16:18 -0500
Subject: [PATCH 105/120] GH-1179: Correct the size of var-width vector with >0
start offset during vector append (#1180)
## What's Changed
Fix VectorAppender data size computation for variable-width vectors with
non-zero start offsets
When appending a variable width offset vector in DataFusion comet I was
receiving exceptions
due to allocating too much memory. This is because Comet passes variable
width arrays back
to Java where the initial offset vector entry is greater than 0. Prior
to this change, arrow-java
determines how many bytes to copy by just looking at the last offset
entry in the buffer,
completely disregarding the value of the first. If first = 100 and last
= 200, Java will still
copy 200 bytes instead of 100. In this change we fix that.
Closes #1179
---------
Co-authored-by: Jordan Epstein
---
.../arrow/vector/util/VectorAppender.java | 92 ++++++---
.../arrow/vector/util/TestVectorAppender.java | 189 ++++++++++++++++++
2 files changed, 257 insertions(+), 24 deletions(-)
diff --git a/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java b/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
index e7c0d11cb9..2cfeb0a04d 100644
--- a/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
+++ b/vector/src/main/java/org/apache/arrow/vector/util/VectorAppender.java
@@ -125,10 +125,15 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
targetVector
.getOffsetBuffer()
.getInt((long) targetVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
+ // The delta vector's offset buffer need not start at zero (e.g. a vector imported through
+ // the C data interface from a sliced array), so the amount of data to append is the
+ // distance between its first and last offsets, not the last offset itself.
+ int deltaDataStart = deltaVector.getOffsetBuffer().getInt(0);
int deltaDataSize =
deltaVector
- .getOffsetBuffer()
- .getInt((long) deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
+ .getOffsetBuffer()
+ .getInt((long) deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH)
+ - deltaDataStart;
int newValueCapacity = targetDataSize + deltaDataSize;
// make sure there is enough capacity
@@ -149,7 +154,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
// append data buffer
MemoryUtil.copyMemory(
- deltaVector.getDataBuffer().memoryAddress(),
+ deltaVector.getDataBuffer().memoryAddress() + deltaDataStart,
targetVector.getDataBuffer().memoryAddress() + targetDataSize,
deltaDataSize);
@@ -160,7 +165,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
+ (targetVector.getValueCount() + 1) * BaseVariableWidthVector.OFFSET_WIDTH,
deltaVector.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH);
- // increase each offset from the second buffer
+ // rebase each appended offset to the target's data, accounting for the delta's start offset
for (int i = 0; i < deltaVector.getValueCount(); i++) {
int oldOffset =
targetVector
@@ -172,7 +177,7 @@ public ValueVector visit(BaseVariableWidthVector deltaVector, Void value) {
.getOffsetBuffer()
.setInt(
(long) (targetVector.getValueCount() + 1 + i) * BaseVariableWidthVector.OFFSET_WIDTH,
- oldOffset + targetDataSize);
+ oldOffset - deltaDataStart + targetDataSize);
}
((BaseVariableWidthVector) targetVector).setLastSet(newValueCount - 1);
targetVector.setValueCount(newValueCount);
@@ -196,11 +201,15 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
.getOffsetBuffer()
.getLong(
(long) targetVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
+ // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+ // offset buffer need not start at zero
+ long deltaDataStart = deltaVector.getOffsetBuffer().getLong(0);
long deltaDataSize =
deltaVector
- .getOffsetBuffer()
- .getLong(
- (long) deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
+ .getOffsetBuffer()
+ .getLong(
+ (long) deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH)
+ - deltaDataStart;
long newValueCapacity = targetDataSize + deltaDataSize;
// make sure there is enough capacity
@@ -221,7 +230,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
// append data buffer
MemoryUtil.copyMemory(
- deltaVector.getDataBuffer().memoryAddress(),
+ deltaVector.getDataBuffer().memoryAddress() + deltaDataStart,
targetVector.getDataBuffer().memoryAddress() + targetDataSize,
deltaDataSize);
@@ -232,7 +241,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
+ (targetVector.getValueCount() + 1) * BaseLargeVariableWidthVector.OFFSET_WIDTH,
deltaVector.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH);
- // increase each offset from the second buffer
+ // rebase each appended offset to the target's data, accounting for the delta's start offset
for (int i = 0; i < deltaVector.getValueCount(); i++) {
long oldOffset =
targetVector
@@ -245,7 +254,7 @@ public ValueVector visit(BaseLargeVariableWidthVector deltaVector, Void value) {
.setLong(
(long) (targetVector.getValueCount() + 1 + i)
* BaseLargeVariableWidthVector.OFFSET_WIDTH,
- oldOffset + targetDataSize);
+ oldOffset - deltaDataStart + targetDataSize);
}
((BaseLargeVariableWidthVector) targetVector).setLastSet(newValueCount - 1);
targetVector.setValueCount(newValueCount);
@@ -331,16 +340,20 @@ public ValueVector visit(ListVector deltaVector, Void value) {
targetVector
.getOffsetBuffer()
.getInt((long) targetVector.getValueCount() * ListVector.OFFSET_WIDTH);
- int deltaListSize =
+ // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+ // offset buffer need not start at zero
+ int deltaListStart = deltaVector.getOffsetBuffer().getInt(0);
+ int deltaListEnd =
deltaVector
.getOffsetBuffer()
.getInt((long) deltaVector.getValueCount() * ListVector.OFFSET_WIDTH);
+ int deltaListSize = deltaListEnd - deltaListStart;
ListVector targetListVector = (ListVector) targetVector;
// make sure the underlying vector has value count set
targetListVector.getDataVector().setValueCount(targetListSize);
- deltaVector.getDataVector().setValueCount(deltaListSize);
+ deltaVector.getDataVector().setValueCount(deltaListEnd);
// make sure there is enough capacity
while (targetVector.getValueCapacity() < newValueCount) {
@@ -372,13 +385,16 @@ public ValueVector visit(ListVector deltaVector, Void value) {
.getOffsetBuffer()
.setInt(
(long) (targetVector.getValueCount() + 1 + i) * ListVector.OFFSET_WIDTH,
- oldOffset + targetListSize);
+ oldOffset - deltaListStart + targetListSize);
}
targetListVector.setLastSet(newValueCount - 1);
// append underlying vectors
- VectorAppender innerAppender = new VectorAppender(targetListVector.getDataVector());
- deltaVector.getDataVector().accept(innerAppender, null);
+ appendDataVector(
+ targetListVector.getDataVector(),
+ deltaVector.getDataVector(),
+ deltaListStart,
+ deltaListSize);
targetVector.setValueCount(newValueCount);
return targetVector;
@@ -400,17 +416,21 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
targetVector
.getOffsetBuffer()
.getLong((long) targetVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
- long deltaListSize =
+ // see the corresponding comment in visit(BaseVariableWidthVector, Void): the delta's
+ // offset buffer need not start at zero
+ long deltaListStart = deltaVector.getOffsetBuffer().getLong(0);
+ long deltaListEnd =
deltaVector
.getOffsetBuffer()
.getLong((long) deltaVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
+ long deltaListSize = deltaListEnd - deltaListStart;
- ListVector targetListVector = (ListVector) targetVector;
+ LargeListVector targetListVector = (LargeListVector) targetVector;
// make sure the underlying vector has value count set
// todo recheck these casts when int64 vectors are supported
targetListVector.getDataVector().setValueCount(checkedCastToInt(targetListSize));
- deltaVector.getDataVector().setValueCount(checkedCastToInt(deltaListSize));
+ deltaVector.getDataVector().setValueCount(checkedCastToInt(deltaListEnd));
// make sure there is enough capacity
while (targetVector.getValueCapacity() < newValueCount) {
@@ -427,10 +447,10 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
// append offset buffer
MemoryUtil.copyMemory(
- deltaVector.getOffsetBuffer().memoryAddress() + ListVector.OFFSET_WIDTH,
+ deltaVector.getOffsetBuffer().memoryAddress() + LargeListVector.OFFSET_WIDTH,
targetVector.getOffsetBuffer().memoryAddress()
+ (targetVector.getValueCount() + 1) * LargeListVector.OFFSET_WIDTH,
- (long) deltaVector.getValueCount() * ListVector.OFFSET_WIDTH);
+ (long) deltaVector.getValueCount() * LargeListVector.OFFSET_WIDTH);
// increase each offset from the second buffer
for (int i = 0; i < deltaVector.getValueCount(); i++) {
@@ -443,18 +463,42 @@ public ValueVector visit(LargeListVector deltaVector, Void value) {
.getOffsetBuffer()
.setLong(
(long) (targetVector.getValueCount() + 1 + i) * LargeListVector.OFFSET_WIDTH,
- oldOffset + targetListSize);
+ oldOffset - deltaListStart + targetListSize);
}
targetListVector.setLastSet(newValueCount - 1);
// append underlying vectors
- VectorAppender innerAppender = new VectorAppender(targetListVector.getDataVector());
- deltaVector.getDataVector().accept(innerAppender, null);
+ appendDataVector(
+ targetListVector.getDataVector(),
+ deltaVector.getDataVector(),
+ checkedCastToInt(deltaListStart),
+ checkedCastToInt(deltaListSize));
targetVector.setValueCount(newValueCount);
return targetVector;
}
+ /**
+ * Appends the range [start, start + length) of the delta vector's data vector to the target
+ * vector's data vector. The range may not cover the whole delta data vector when the delta's
+ * offset buffer does not start at zero.
+ */
+ private static void appendDataVector(
+ ValueVector targetDataVector, ValueVector deltaDataVector, int start, int length) {
+ if (start == 0 && length == deltaDataVector.getValueCount()) {
+ VectorAppender innerAppender = new VectorAppender(targetDataVector);
+ deltaDataVector.accept(innerAppender, null);
+ return;
+ }
+ TransferPair transferPair =
+ deltaDataVector.getTransferPair(deltaDataVector.getField(), deltaDataVector.getAllocator());
+ transferPair.splitAndTransfer(start, length);
+ try (ValueVector slicedDeltaDataVector = transferPair.getTo()) {
+ VectorAppender innerAppender = new VectorAppender(targetDataVector);
+ slicedDeltaDataVector.accept(innerAppender, null);
+ }
+ }
+
@Override
public ValueVector visit(FixedSizeListVector deltaVector, Void value) {
Preconditions.checkArgument(
diff --git a/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java b/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
index df5521a1ad..9a8143f51b 100644
--- a/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
+++ b/vector/src/test/java/org/apache/arrow/vector/util/TestVectorAppender.java
@@ -26,10 +26,13 @@
import java.util.List;
import java.util.stream.IntStream;
import java.util.stream.Stream;
+import org.apache.arrow.memory.ArrowBuf;
import org.apache.arrow.memory.BufferAllocator;
import org.apache.arrow.memory.RootAllocator;
import org.apache.arrow.memory.util.CommonUtil;
+import org.apache.arrow.vector.BaseLargeVariableWidthVector;
import org.apache.arrow.vector.BaseValueVector;
+import org.apache.arrow.vector.BaseVariableWidthVector;
import org.apache.arrow.vector.BaseVariableWidthViewVector;
import org.apache.arrow.vector.BigIntVector;
import org.apache.arrow.vector.BitVector;
@@ -53,6 +56,7 @@
import org.apache.arrow.vector.holders.NullableBigIntHolder;
import org.apache.arrow.vector.holders.NullableFloat4Holder;
import org.apache.arrow.vector.holders.NullableIntHolder;
+import org.apache.arrow.vector.ipc.message.ArrowFieldNode;
import org.apache.arrow.vector.testing.ValueVectorDataPopulator;
import org.apache.arrow.vector.types.Types;
import org.apache.arrow.vector.types.pojo.ArrowType;
@@ -178,6 +182,82 @@ public void testAppendVariableWidthVector() {
}
}
+ @Test
+ public void testAppendVariableWidthVectorWithNonZeroStartOffset() {
+ try (VarCharVector target = new VarCharVector("", allocator);
+ VarCharVector delta = new VarCharVector("", allocator)) {
+
+ target.allocateNew(64, 4);
+ ValueVectorDataPopulator.setVector(target, "a0", "a1");
+
+ // Build a delta vector whose offset buffer does not start at zero, as produced e.g. by
+ // importing a sliced array through the C data interface. The values are "BBBB" and
+ // "CCCC"; the data buffer additionally holds 4 bytes of unreferenced prefix ("AAAA").
+ try (ArrowBuf validity = allocator.buffer(1);
+ ArrowBuf offsets = allocator.buffer(12);
+ ArrowBuf data = allocator.buffer(12)) {
+ validity.setByte(0, 0b11);
+ offsets.setInt(0, 4);
+ offsets.setInt(4, 8);
+ offsets.setInt(8, 12);
+ data.setBytes(0, "AAAABBBBCCCC".getBytes(StandardCharsets.UTF_8));
+ delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets, data));
+ }
+
+ VectorAppender appender = new VectorAppender(target);
+ delta.accept(appender, null);
+
+ // the unreferenced prefix must not be appended
+ assertEquals(
+ 4 + 8,
+ target
+ .getOffsetBuffer()
+ .getInt((long) target.getValueCount() * BaseVariableWidthVector.OFFSET_WIDTH));
+
+ try (VarCharVector expected = new VarCharVector("expected", allocator)) {
+ expected.allocateNew();
+ ValueVectorDataPopulator.setVector(expected, "a0", "a1", "BBBB", "CCCC");
+ assertVectorsEqual(expected, target);
+ }
+ }
+ }
+
+ @Test
+ public void testAppendLargeVariableWidthVectorWithNonZeroStartOffset() {
+ try (LargeVarCharVector target = new LargeVarCharVector("", allocator);
+ LargeVarCharVector delta = new LargeVarCharVector("", allocator)) {
+
+ target.allocateNew(64, 4);
+ ValueVectorDataPopulator.setVector(target, "a0", "a1");
+
+ try (ArrowBuf validity = allocator.buffer(1);
+ ArrowBuf offsets = allocator.buffer(24);
+ ArrowBuf data = allocator.buffer(12)) {
+ validity.setByte(0, 0b11);
+ offsets.setLong(0, 4);
+ offsets.setLong(8, 8);
+ offsets.setLong(16, 12);
+ data.setBytes(0, "AAAABBBBCCCC".getBytes(StandardCharsets.UTF_8));
+ delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets, data));
+ }
+
+ VectorAppender appender = new VectorAppender(target);
+ delta.accept(appender, null);
+
+ assertEquals(
+ 4 + 8,
+ target
+ .getOffsetBuffer()
+ .getLong((long) target.getValueCount() * BaseLargeVariableWidthVector.OFFSET_WIDTH));
+
+ try (LargeVarCharVector expected = new LargeVarCharVector("expected", allocator)) {
+ expected.allocateNew();
+ ValueVectorDataPopulator.setVector(expected, "a0", "a1", "BBBB", "CCCC");
+ assertVectorsEqual(expected, target);
+ }
+ }
+ }
+
@Test
public void testAppendVariableWidthViewVector() {
final int length1 = 10;
@@ -431,6 +511,115 @@ public void testAppendListVector() {
}
}
+ @Test
+ public void testAppendListVectorWithNonZeroStartOffset() {
+ try (ListVector target = ListVector.empty("target", allocator);
+ ListVector delta = ListVector.empty("delta", allocator)) {
+
+ target.allocateNew();
+ ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), Arrays.asList(2, 3));
+
+ // Build a delta vector whose offset buffer does not start at zero, as produced e.g. by
+ // importing a sliced array through the C data interface: lists [10, 11] and [12, 13],
+ // with one unreferenced prefix element (9) in the data vector.
+ delta.addOrGetVector(FieldType.nullable(Types.MinorType.INT.getType()));
+ IntVector deltaDataVector = (IntVector) delta.getDataVector();
+ deltaDataVector.allocateNew(5);
+ for (int i = 0; i < 5; i++) {
+ deltaDataVector.set(i, 9 + i);
+ }
+ deltaDataVector.setValueCount(5);
+ try (ArrowBuf validity = allocator.buffer(1);
+ ArrowBuf offsets = allocator.buffer(12)) {
+ validity.setByte(0, 0b11);
+ offsets.setInt(0, 1);
+ offsets.setInt(4, 3);
+ offsets.setInt(8, 5);
+ delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets));
+ }
+ assertEquals(Arrays.asList(10, 11), delta.getObject(0));
+
+ VectorAppender appender = new VectorAppender(target);
+ delta.accept(appender, null);
+
+ assertEquals(4, target.getValueCount());
+ // the unreferenced prefix element must not be appended
+ assertEquals(
+ 4 + 4,
+ target.getOffsetBuffer().getInt((long) target.getValueCount() * ListVector.OFFSET_WIDTH));
+ assertEquals(Arrays.asList(0, 1), target.getObject(0));
+ assertEquals(Arrays.asList(2, 3), target.getObject(1));
+ assertEquals(Arrays.asList(10, 11), target.getObject(2));
+ assertEquals(Arrays.asList(12, 13), target.getObject(3));
+ }
+ }
+
+ @Test
+ public void testAppendLargeListVector() {
+ try (LargeListVector target = LargeListVector.empty("target", allocator);
+ LargeListVector delta = LargeListVector.empty("delta", allocator)) {
+
+ target.allocateNew();
+ ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), null, Arrays.asList(4, 5));
+
+ delta.allocateNew();
+ ValueVectorDataPopulator.setVector(delta, Arrays.asList(10, 11, 12), Arrays.asList(13, 14));
+
+ VectorAppender appender = new VectorAppender(target);
+ delta.accept(appender, null);
+
+ assertEquals(5, target.getValueCount());
+ assertEquals(Arrays.asList(0, 1), target.getObject(0));
+ assertTrue(target.isNull(1));
+ assertEquals(Arrays.asList(4, 5), target.getObject(2));
+ assertEquals(Arrays.asList(10, 11, 12), target.getObject(3));
+ assertEquals(Arrays.asList(13, 14), target.getObject(4));
+ }
+ }
+
+ @Test
+ public void testAppendLargeListVectorWithNonZeroStartOffset() {
+ try (LargeListVector target = LargeListVector.empty("target", allocator);
+ LargeListVector delta = LargeListVector.empty("delta", allocator)) {
+
+ target.allocateNew();
+ ValueVectorDataPopulator.setVector(target, Arrays.asList(0, 1), Arrays.asList(2, 3));
+
+ // same as testAppendListVectorWithNonZeroStartOffset, with 8-byte offsets
+ delta.addOrGetVector(FieldType.nullable(Types.MinorType.INT.getType()));
+ IntVector deltaDataVector = (IntVector) delta.getDataVector();
+ deltaDataVector.allocateNew(5);
+ for (int i = 0; i < 5; i++) {
+ deltaDataVector.set(i, 9 + i);
+ }
+ deltaDataVector.setValueCount(5);
+ try (ArrowBuf validity = allocator.buffer(1);
+ ArrowBuf offsets = allocator.buffer(24)) {
+ validity.setByte(0, 0b11);
+ offsets.setLong(0, 1);
+ offsets.setLong(8, 3);
+ offsets.setLong(16, 5);
+ delta.loadFieldBuffers(new ArrowFieldNode(2, 0), Arrays.asList(validity, offsets));
+ }
+ assertEquals(Arrays.asList(10, 11), delta.getObject(0));
+
+ VectorAppender appender = new VectorAppender(target);
+ delta.accept(appender, null);
+
+ assertEquals(4, target.getValueCount());
+ // the unreferenced prefix element must not be appended
+ assertEquals(
+ 4 + 4,
+ target
+ .getOffsetBuffer()
+ .getLong((long) target.getValueCount() * LargeListVector.OFFSET_WIDTH));
+ assertEquals(Arrays.asList(0, 1), target.getObject(0));
+ assertEquals(Arrays.asList(2, 3), target.getObject(1));
+ assertEquals(Arrays.asList(10, 11), target.getObject(2));
+ assertEquals(Arrays.asList(12, 13), target.getObject(3));
+ }
+ }
+
@Test
public void testAppendEmptyListVector() {
try (ListVector target = ListVector.empty("target", allocator);
From 9e863319b1e3bedda45dbb12d5989f6b1330f664 Mon Sep 17 00:00:00 2001
From: Abdul Rawoof Khan
Date: Mon, 6 Jul 2026 06:39:33 +0530
Subject: [PATCH 106/120] GH-1206: validate decompressed length in
Lz4CompressionCodec (#1207)
## What's Changed
`Lz4CompressionCodec.doDecompress` sizes the output buffer to the bytes
it actually decompressed, but sets `writerIndex` to the length taken
from the untrusted 8-byte prefix. A buffer whose prefix claims more than
the real output leaves the returned `ArrowBuf` with a `writerIndex` past
its capacity, and consumers then read off-heap memory beyond the
allocation. This adds the actual-vs-claimed length check the ZSTD codec
already does, so a mismatch throws instead of producing an over-long
buffer.
Closes #1206.
---
.../compression/Lz4CompressionCodec.java | 7 ++++++
.../compression/TestCompressionCodec.java | 22 +++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java b/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
index 91cefc2a9e..f268e815fe 100644
--- a/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
+++ b/compression/src/main/java/org/apache/arrow/compression/Lz4CompressionCodec.java
@@ -80,6 +80,13 @@ protected ArrowBuf doDecompress(BufferAllocator allocator, ArrowBuf compressedBu
}
byte[] outBytes = out.toByteArray();
+ if (outBytes.length != decompressedLength) {
+ throw new RuntimeException(
+ "Expected != actual decompressed length: "
+ + decompressedLength
+ + " != "
+ + outBytes.length);
+ }
ArrowBuf decompressedBuffer = allocator.buffer(outBytes.length);
decompressedBuffer.setBytes(/* index= */ 0, outBytes);
decompressedBuffer.writerIndex(decompressedLength);
diff --git a/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java b/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
index b8fb4e28b9..d2d2921649 100644
--- a/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
+++ b/compression/src/test/java/org/apache/arrow/compression/TestCompressionCodec.java
@@ -20,6 +20,7 @@
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import java.io.ByteArrayOutputStream;
@@ -59,6 +60,7 @@
import org.apache.arrow.vector.util.ByteArrayReadableSeekableByteChannel;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource;
@@ -231,6 +233,26 @@ void testEmptyBuffer(int vectorLength, CompressionCodec codec) throws Exception
AutoCloseables.close(decompressedBuffers);
}
+ @Test
+ void testLz4DecompressRejectsWrongLength() {
+ byte[] data = new byte[512]; // all zeros, highly compressible
+ ArrowBuf orig = allocator.buffer(data.length);
+ orig.setBytes(0, data);
+ orig.writerIndex(data.length);
+
+ CompressionCodec codec = new Lz4CompressionCodec();
+ ArrowBuf compressed = codec.compress(allocator, orig);
+
+ // tamper with the 8-byte uncompressed-length prefix so it no longer matches
+ // the real decompressed size
+ compressed.setLong(0, 1_000_000L);
+
+ RuntimeException e =
+ assertThrows(RuntimeException.class, () -> codec.decompress(allocator, compressed));
+ assertTrue(e.getMessage().contains("decompressed length"));
+ compressed.close();
+ }
+
private static Stream codecTypes() {
return Arrays.stream(CompressionUtil.CodecType.values());
}
From c7e8e75c9978c60234dbcbd31311ac3ee2975fa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Pupier?=
Date: Mon, 6 Jul 2026 08:50:26 +0200
Subject: [PATCH 107/120] MINOR: Restrict trigger push branch for GitHub
Workflow (#1204)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Feature branches rarely need their own CI runs: the code is already
tested when a pull request is opened against a release branch. If the
push trigger has no branch restriction and pull_request is also
configured, every push to a branch with an open PR runs the workflow
twice: once for the push and once for the PR synchronisation.
Always give the push trigger an explicit list of branches: this stops
branches created from a release branch from inheriting its workflow
runs.
see
https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=430408443#GitHubActionsRecommendedPractices-Restrictthepushtriggertospecificbranches
## What's Changed
Please fill in a description of the changes here.
**This contains breaking changes.**
Closes #NNN.
Note that I needed to recreate a PR as the previous one was closed
https://github.com/apache/arrow-java/pull/1202#issuecomment-4864548916
Signed-off-by: Aurélien Pupier
---
.github/workflows/dev.yml | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 25b08700fd..7c590c749a 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -19,7 +19,9 @@ name: Dev
on:
pull_request: {}
- push: {}
+ push:
+ branches-ignore:
+ - dependabot/**
concurrency:
group: ${{ github.repository }}-${{ github.ref }}-${{ github.workflow }}
From 9e100a3b7f681a64f11eb4405e9e43431caf3647 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:21:40 +0200
Subject: [PATCH 108/120] MINOR: Bump com.squareup.okhttp3:mockwebserver3 from
5.3.2 to 5.4.0 (#1215)
Bumps
[com.squareup.okhttp3:mockwebserver3](https://github.com/square/okhttp)
from 5.3.2 to 5.4.0.
Changelog
Sourced from com.squareup.okhttp3:mockwebserver3's
changelog.
Version 5.4.0
2026-06-08
- New: Add superpowers to interceptors. Interceptors can now override
anything settable on
OkHttpClient.Builder, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom Call.Factory wrappers.
- Fix: Limit each HTTP/2 response to 256 KiB of total headers.
- Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
okhttp-coroutines artifact.
- Upgrade: [GraalVM 25.0.3][graalvm_25].
- Upgrade: [Okio 3.17.0][okio_3_17_0].
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index 9a8406cf31..e25d8438af 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -123,7 +123,7 @@ under the License.
com.squareup.okhttp3
mockwebserver3
- 5.3.2
+ 5.4.0
test
From e087824935d283d3636d8edb908a79df2de217c4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:25:41 +0200
Subject: [PATCH 109/120] MINOR: Bump
com.diffplug.spotless:spotless-maven-plugin from 3.6.0 to 3.8.0 (#1214)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 3.6.0 to 3.8.0.
Release notes
Sourced from com.diffplug.spotless:spotless-maven-plugin's
releases.
Maven Plugin v3.8.0
Added
- Add support for custom string format for license header copyright
year via
yearStringFormat(). (#2965)
Fixed
<expandWildcardImports> no longer triggers a full
transitive dependency resolution on every build. Dependency resolution
is now deferred until the step actually runs, so projects that do not
use <expandWildcardImports> (or that use version
ranges) are no longer penalized. (#2983)
Maven Plugin v3.7.0
Fixed
- Parse standard git year output in LicenseHeaderStep. (#2940)
<toggleOffOn> no longer disables lint-only steps
such as <forbidWildcardImports>. (#2962)- Fix
StringIndexOutOfBoundsException in scenarios where
copyright year is surrounded by whitespace. (#2973)
Added
- Add support for AsciiDoc formatting via
adocfmt. (#2960)
<flexmark> step now supports arbitrary formatter
options via <formatterOptions>. (#2968)
Changelog
Sourced from com.diffplug.spotless:spotless-maven-plugin's
changelog.
spotless-lib and spotless-lib-extra releases
If you are a Spotless user (as opposed to developer), then you are
probably looking for:
This document is intended for Spotless developers.
We adhere to the keepachangelog format
(starting after version 1.27.0).
[Unreleased]
[4.8.0] - 2026-06-29
Added
- Add support for custom string format for license header copyright
year via
yearStringFormat(). (#2965)
[4.7.0] - 2026-06-16
Added
- Add support for AsciiDoc formatting via
adocfmt. (#2960)
flexmark step now supports arbitrary formatter options
via a formatterOptions map. (#2968)
Fixed
FenceStep.preserveWithin now forwards lints from nested
steps while still suppressing lints inside preserved blocks. (#2962)- Support
ktfmt 0.63 and use its new builder API for
formatting options to better avoid future breaking changes.
- Parse standard git year output in LicenseHeaderStep. (#2940)
- Fix
StringIndexOutOfBoundsException in scenarios where
copyright year is surrounded by whitespace. (#2973)
Changes
- Bump default
greclipse version to latest
4.35 -> 4.39. (#2924)
[4.6.2] - 2026-05-27
Fixed
P2Provisioner now passes cache directory overrides
directly to Solstice. (#2944)forbidWildcardImports and
forbidModuleImports now detect imports that have leading
whitespace (indentation/tabs). (#2939)versionCatalog step no longer splits long inline tables
across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line
inline tables. The maxLineLength option has been removed.
(#2948)
Changes
EclipseJdtFormtterStep now can conditionally set
compiler source/compliance options. Allows for better parsing of AST
Node for newer language features and more correct sorting; e.g. records
or seal classes. (#2942)Formatter no longer recomputes line-ending
normalization (LineEnding.toUnix) a second time for every
formatter step that changes content, removing redundant O(n) work from
the core formatting loop. (#2934)- expandWildcardImports support pom type dependency. (#2839)
[4.6.1] - 2026-05-15
Fixed
LicenseHeaderStep in SET_FROM_GIT year
mode no longer invokes git log through bash -c
/ cmd /c, eliminating a shell-injection vector when
processing repositories that contain files whose names include shell
metacharacters.
[4.6.0] - 2026-05-14
Added
scalafmt() now reads the version from the
version field in the scalafmt config file when no version
is explicitly set in the plugin config, falling back to the built-in
default only if neither is available. (#2922)- Add
versionCatalog step for formatting and sorting
Gradle version catalog (.toml) files. (#2916)
- Add
javaparserVersion option to the Cleanthat step,
allowing callers to override the JavaParser version pulled in
transitively by Cleanthat. (#2903)
Fixed
... (truncated)
Commits
03d43ba
Published maven/3.8.08b80c13
Published gradle/8.8.08ee6cf9
Published lib/4.8.06c02c0b
Add missing changelog entry.264f4cc
Add regression test for forbidWildcardImports inside toggleOffOn (#2982)6abb064
fix #2983,
expandWildcardImports triggers a full transitive reso… (#2984)f4536d4
Update plugin spotbugs to v6.5.8 (#2987)873454a
Update plugin spotbugs to v6.5.8000b8a8
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (#2985)84ebcab
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
bom/pom.xml | 2 +-
pom.xml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/bom/pom.xml b/bom/pom.xml
index 3201761e81..2d1085b160 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -208,7 +208,7 @@ under the License.
com.diffplug.spotless
spotless-maven-plugin
- 3.6.0
+ 3.8.0
org.codehaus.mojo
diff --git a/pom.xml b/pom.xml
index 231720eb44..017e3acb81 100644
--- a/pom.xml
+++ b/pom.xml
@@ -492,7 +492,7 @@ under the License.
com.diffplug.spotless
spotless-maven-plugin
- 3.6.0
+ 3.8.0
org.codehaus.mojo
From 1801a8a0937fb4aaac3654c66ec9109a6892666c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:28:19 +0200
Subject: [PATCH 110/120] MINOR: Bump
com.gradle:common-custom-user-data-maven-extension from 2.2.0 to 2.3.0
(#1213)
Bumps
[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)
from 2.2.0 to 2.3.0.
Release notes
Sourced from com.gradle:common-custom-user-data-maven-extension's
releases.
2.3.0
- [NEW] Capture Cursor as an AI agent via the
CURSOR_AGENT environment variable
Commits
61a5a45
[maven-release-plugin] prepare release v2.3.0398a231
[Renovate Bot] Update actions/setup-java digest to 1bcf9fb (#389)f66a5c6
Merge pull request #391
from gradle/erichaagdev/capture-cursor-ai-agent8311f58
Capture Cursor as an AI agent0236fc8
[Renovate Bot] Update dependency
org.eclipse.sisu:org.eclipse.sisu.inject to ...0d8c2c5
[Renovate Bot] Update GitHub Actions to v7 (#386)21ef159
[Renovate Bot] Update Maven dependencies (#387)d9240f0
[Renovate Bot] Update Maven dependencies to v0.11.0 (#384)83935cc
Auto-merge GitHub Actions digest re-pins (#385)9d03ae6
[Renovate Bot] Update GitHub Actions to ad2b381 (#383)- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.mvn/extensions.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index 38b3c807b7..eb06ecc9fb 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -28,6 +28,6 @@
com.gradle
common-custom-user-data-maven-extension
- 2.2.0
+ 2.3.0
From afd688e024753c75854e707748fe5ad4411d3361 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:29:40 +0200
Subject: [PATCH 111/120] MINOR: Bump com.gradle:develocity-maven-extension
from 2.4.1 to 2.5.0 (#1212)
Bumps com.gradle:develocity-maven-extension from 2.4.1 to 2.5.0.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.mvn/extensions.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
index eb06ecc9fb..74482cb2c4 100644
--- a/.mvn/extensions.xml
+++ b/.mvn/extensions.xml
@@ -23,7 +23,7 @@
com.gradle
develocity-maven-extension
- 2.4.1
+ 2.5.0
com.gradle
From 59010e63bb58c702ccdbcf6f7e0fb047bf8c8f73 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:31:03 +0200
Subject: [PATCH 112/120] MINOR: Bump checker.framework.version from 4.2.0 to
4.2.1 (#1211)
Bumps `checker.framework.version` from 4.2.0 to 4.2.1.
Updates `org.checkerframework:checker-qual` from 4.2.0 to 4.2.1
Release notes
Sourced from org.checkerframework:checker-qual's
releases.
Checker Framework 4.2.1
Version 4.2.1 (2026-07-01)
Closed issues
#7726.
Changelog
Sourced from org.checkerframework:checker-qual's
changelog.
Version 4.2.1 (2026-07-01)
Closed issues
#7726.
Commits
Updates `org.checkerframework:checker` from 4.2.0 to 4.2.1
Release notes
Sourced from org.checkerframework:checker's
releases.
Checker Framework 4.2.1
Version 4.2.1 (2026-07-01)
Closed issues
#7726.
Changelog
Sourced from org.checkerframework:checker's
changelog.
Version 4.2.1 (2026-07-01)
Closed issues
#7726.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 017e3acb81..d9f9d59c43 100644
--- a/pom.xml
+++ b/pom.xml
@@ -112,7 +112,7 @@ under the License.
10.23.0
true
2.42.0
- 4.2.0
+ 4.2.1
1.5.34
none
-Xdoclint:none
From f2594c99cc98923ad5949713d4519c5d4f24f4f6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 14:32:02 +0200
Subject: [PATCH 113/120] MINOR: [CI] Bump docker/login-action from 4.2.0 to
4.4.0 (#1210)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [docker/login-action](https://github.com/docker/login-action) from
4.2.0 to 4.4.0.
Release notes
Sourced from docker/login-action's
releases.
v4.4.0
Full Changelog: https://github.com/docker/login-action/compare/v4.3.0...v4.4.0
v4.3.0
Full Changelog: https://github.com/docker/login-action/compare/v4.2.0...v4.3.0
Commits
af1e73f
Merge pull request #1034
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...da722bd
[dependabot skip] chore: update generated content2916ad6
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...ca0a662
Merge pull request #1035
from crazy-max/fix-registry-auth-empty-maskc455755
chore: update generated content4835190
skip empty registry-auth secret mask992421c
Merge pull request #1033
from docker/dependabot/github_actions/docker/bake-ac...b249b43
Merge pull request #1032
from docker/dependabot/github_actions/docker/bake-ac...1b67977
build(deps): bump docker/bake-action from 7.2.0 to 7.3.09d49d6a
build(deps): bump docker/bake-action/subaction/matrix- Additional commits viewable in compare
view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/rc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index fdfcd1cce3..5d2fb6683a 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -127,7 +127,7 @@ jobs:
with:
repository: apache/parquet-testing
path: arrow/cpp/submodules/parquet-testing
- - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+ - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
with:
registry: ghcr.io
username: ${{ github.actor }}
From 915428751b8871406268aeb27bd2f055dcfba6bf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:00:46 +0200
Subject: [PATCH 114/120] MINOR: Bump logback.version from 1.5.34 to 1.5.37
(#1209)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps `logback.version` from 1.5.34 to 1.5.37.
Updates `ch.qos.logback:logback-classic` from 1.5.34 to 1.5.37
Release notes
Sourced from ch.qos.logback:logback-classic's
releases.
Logback 1.5.37
2026-06-26 Release of logback version 1.5.37
- • Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java expressions
using the Janino library, support for such expressions has been removed.
Users are offered the an online
migration service or the
<condition> element
introduced in version 1.5.20. See the relevant
documentation for more details.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag
v_1.5.37. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.36
2026-06-25 Release of logback version 1.5.36
• The 'condition' attribute in <if> elements now
reject certain references that are associated with ACE attacks. This
issue was reported by "yulate" (yulate531@gmail.com.com) and
registered as CVE-2026-13006.
Please note that version 1.5.37 provides the full fix to this
vulnerability.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag
v_1.5.36. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.35
026-06-23 Release of logback version 1.5.35
• The 'condition' attribute in <if> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006.
Please note that version 1.5.37 provides the full fix to this
vulnerability.
• Added ConfiguratorRank.AUTHENTICATING (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
ContextInitializer now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.
• ConsoleCharsetPropertyDefiner is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner
will need an alternative approach for console charset detection.
• The logback-examples module is now included in artifacts published
to Maven Central.
• JoranConfigurator.makeAnotherInstance() and
DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()
are now protected, allowing derived configurators to override these
methods.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Commits
Updates `ch.qos.logback:logback-core` from 1.5.34 to 1.5.37
Release notes
Sourced from ch.qos.logback:logback-core's
releases.
Logback 1.5.37
2026-06-26 Release of logback version 1.5.37
- • Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java expressions
using the Janino library, support for such expressions has been removed.
Users are offered the an online
migration service or the
<condition> element
introduced in version 1.5.20. See the relevant
documentation for more details.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag
v_1.5.37. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.36
2026-06-25 Release of logback version 1.5.36
• The 'condition' attribute in <if> elements now
reject certain references that are associated with ACE attacks. This
issue was reported by "yulate" (yulate531@gmail.com.com) and
registered as CVE-2026-13006.
Please note that version 1.5.37 provides the full fix to this
vulnerability.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag
v_1.5.36. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.35
026-06-23 Release of logback version 1.5.35
• The 'condition' attribute in <if> elements now
rejects unicode escape sequences (\u and \U). This closes a bypass of
the existing prohibition on the new operator in Janino-evaluated
conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006.
Please note that version 1.5.37 provides the full fix to this
vulnerability.
• Added ConfiguratorRank.AUTHENTICATING (rank 100), the
highest configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism.
ContextInitializer now requires that at most one such
configurator exist on the classpath; if more than one is found,
initialization aborts with an error.
• ConsoleCharsetPropertyDefiner is no longer shipped.
The Java 21 multi-release compilation of logback-core has been disabled,
which removes this class from the published artifact. Configurations
that referenced
ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner
will need an alternative approach for console charset detection.
• The logback-examples module is now included in artifacts published
to Maven Central.
• JoranConfigurator.makeAnotherInstance() and
DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()
are now protected, allowing derived configurators to override these
methods.
• A bitwise identical binary of this version can be reproduced by
building from source code at commit
08bd1598d565d83444f72983935e7da4746783b7 associated with the tag
v_1.5.35. Release built using Java "21" 2023-10-17 LTS build
21.0.1.+12-LTS-29 under Linux Debian 11.6.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index d9f9d59c43..78137eb4e9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -113,7 +113,7 @@ under the License.
true
2.42.0
4.2.1
- 1.5.34
+ 1.5.37
none
-Xdoclint:none
From a9f0086090e649b83c89ea864c82ed7fcc84ab2f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 22:19:02 +0200
Subject: [PATCH 115/120] MINOR: Bump com.squareup.okhttp3:okhttp-jvm from
5.3.2 to 5.4.0 (#1208)
Bumps
[com.squareup.okhttp3:okhttp-jvm](https://github.com/square/okhttp) from
5.3.2 to 5.4.0.
Changelog
Sourced from com.squareup.okhttp3:okhttp-jvm's
changelog.
Version 5.4.0
2026-06-08
- New: Add superpowers to interceptors. Interceptors can now override
anything settable on
OkHttpClient.Builder, such as the cache, connection pool,
socket factory, and DNS. We expect
this will allow most users to use interceptors everywhere, insted of
mixing and matching
interceptors with custom Call.Factory wrappers.
- Fix: Limit each HTTP/2 response to 256 KiB of total headers.
- Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is
used by the optional
okhttp-coroutines artifact.
- Upgrade: [GraalVM 25.0.3][graalvm_25].
- Upgrade: [Okio 3.17.0][okio_3_17_0].
Commits
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
flight/flight-sql-jdbc-core/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/flight/flight-sql-jdbc-core/pom.xml b/flight/flight-sql-jdbc-core/pom.xml
index e25d8438af..be2ee32868 100644
--- a/flight/flight-sql-jdbc-core/pom.xml
+++ b/flight/flight-sql-jdbc-core/pom.xml
@@ -135,7 +135,7 @@ under the License.
com.squareup.okhttp3
okhttp-jvm
- 5.3.2
+ 5.4.0
test
From 7f1f9f588af610b842ee1c3bccf6afbd528ae4db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9lder=20Greg=C3=B3rio?=
Date: Thu, 9 Jul 2026 14:42:25 +0100
Subject: [PATCH 116/120] GH-1188: Reduce test workflow waste (#1189)
## Summary
This PR reduces wasted GitHub Actions time in the `Test` workflow by
removing redundant rebuilds, improving caching, and skipping integration
work when it is not relevant.
## What changed
- Removed `clean` from `ci/scripts/test.sh` so the test phase reuses the
classes compiled earlier in the job instead of deleting and recompiling
them.
- Narrowed the Maven/Docker cache key to POM changes, so source-only
edits do not invalidate the dependency cache.
- Enabled Maven dependency caching on the macOS and Windows test jobs.
- Added `pull-requests: read` so the integration job can inspect changed
files.
Closes #1188
Note: The changes on this PR were highlighted and addressed with AI
assistance
---
.github/workflows/test.yml | 24 +++++++++++++-----------
ci/scripts/test.sh | 7 ++++---
2 files changed, 17 insertions(+), 14 deletions(-)
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ac8080d075..41a42c05ed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -66,7 +66,7 @@ jobs:
uses: actions/cache@v6
with:
path: .docker
- key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml', '**/*.java') }}
+ key: maven-${{ matrix.jdk }}-${{ matrix.maven }}-${{ hashFiles('compose.yaml', '**/pom.xml') }}
restore-keys: maven-${{ matrix.jdk }}-${{ matrix.maven }}-
- name: Execute Docker Build
env:
@@ -94,16 +94,17 @@ jobs:
jdk: 17
macos: latest
steps:
- - name: Set up Java
- uses: actions/setup-java@v5
- with:
- distribution: 'temurin'
- java-version: ${{ matrix.jdk }}
- name: Checkout Arrow
uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
+ - name: Set up Java
+ uses: actions/setup-java@v5
+ with:
+ distribution: 'temurin'
+ java-version: ${{ matrix.jdk }}
+ cache: 'maven'
- name: Build
shell: bash
env:
@@ -125,16 +126,17 @@ jobs:
matrix:
jdk: [17]
steps:
- - name: Set up Java
- uses: actions/setup-java@v5
- with:
- java-version: ${{ matrix.jdk }}
- distribution: 'temurin'
- name: Checkout Arrow
uses: actions/checkout@v7
with:
fetch-depth: 0
submodules: recursive
+ - name: Set up Java
+ uses: actions/setup-java@v5
+ with:
+ java-version: ${{ matrix.jdk }}
+ distribution: 'temurin'
+ cache: 'maven'
- name: Build
shell: bash
env:
diff --git a/ci/scripts/test.sh b/ci/scripts/test.sh
index cacc20034e..8061ee455d 100755
--- a/ci/scripts/test.sh
+++ b/ci/scripts/test.sh
@@ -34,10 +34,11 @@ fi
mvn="mvn -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
# Use `2 * ncores` threads
mvn="${mvn} -T 2C"
+mvn="${mvn} -Denforcer.skip=true"
pushd "${build_dir}"
-${mvn} -Darrow.test.dataRoot="${source_dir}/testing/data" clean test
+${mvn} -Darrow.test.dataRoot="${source_dir}/testing/data" test
projects=()
if [ "${ARROW_JAVA_JNI}" = "ON" ]; then
@@ -46,7 +47,7 @@ if [ "${ARROW_JAVA_JNI}" = "ON" ]; then
projects+=(gandiva)
fi
if [ "${#projects[@]}" -gt 0 ]; then
- ${mvn} clean test \
+ ${mvn} test \
-Parrow-jni \
-pl "$(
IFS=,
@@ -56,7 +57,7 @@ if [ "${#projects[@]}" -gt 0 ]; then
fi
if [ "${ARROW_JAVA_CDATA}" = "ON" ]; then
- ${mvn} clean test -Parrow-c-data -pl c -Darrow.c.jni.dist.dir="${java_jni_dist_dir}"
+ ${mvn} test -Parrow-c-data -pl c -Darrow.c.jni.dist.dir="${java_jni_dist_dir}"
fi
popd
From 21b6a05154b7713b12ace4c0ba3572ba5cc8fe66 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:19:32 +0900
Subject: [PATCH 117/120] MINOR: [CI] Bump actions/setup-python from 6 to 7
(#1235)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps [actions/setup-python](https://github.com/actions/setup-python)
from 6 to 7.
Release notes
Sourced from actions/setup-python's
releases.
v7.0.0
What's Changed
Enhancements
Bug Fix
Dependency Upgrade
New Contributors
Full Changelog: https://github.com/actions/setup-python/compare/v6...v7.0.0
v6.3.0
What's Changed
Enhancement
Dependency update
Documentation
New Contributors
Full Changelog: https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0
v6.2.0
What's Changed
Dependency Upgrades
... (truncated)
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/dev.yml | 2 +-
.github/workflows/rc.yml | 4 ++--
.github/workflows/test.yml | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 7c590c749a..f4dc9ad6f1 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -40,7 +40,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- - uses: actions/setup-python@v6
+ - uses: actions/setup-python@v7
with:
python-version: '3.x'
- name: pre-commit (cache)
diff --git a/.github/workflows/rc.yml b/.github/workflows/rc.yml
index 5d2fb6683a..18a721ac02 100644
--- a/.github/workflows/rc.yml
+++ b/.github/workflows/rc.yml
@@ -195,7 +195,7 @@ jobs:
repository: apache/parquet-testing
path: arrow/cpp/submodules/parquet-testing
- name: Set up Python
- uses: actions/setup-python@v6
+ uses: actions/setup-python@v7
with:
cache: 'pip'
python-version: 3.12
@@ -446,7 +446,7 @@ jobs:
contents: read
packages: write
steps:
- - uses: actions/setup-python@v6
+ - uses: actions/setup-python@v7
with:
cache: 'pip'
- name: Download source archive
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 41a42c05ed..853b7cec09 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -198,7 +198,7 @@ jobs:
key: integration-conda-${{ hashFiles('cpp/**') }}
restore-keys: integration-conda-
- name: Setup Python
- uses: actions/setup-python@v6
+ uses: actions/setup-python@v7
with:
python-version: 3.12
- name: Setup Archery
From 06170242bde2f492e068235efdd2183a3cbd87d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9lder=20Greg=C3=B3rio?=
Date: Sat, 25 Jul 2026 14:35:09 +0100
Subject: [PATCH 118/120] GH-1244: Move integration tests to separate workflow
(#1245)
## What's Changed
Move the `integration` job from `test.yml` into its own
`integration.yml` workflow.
The new workflow uses top-level `paths` filters, so integration tests
run only when changes affect relevant code or build inputs.
This should also help to reduce the amount of runner time. Topic
initially triggered in the [mailing
list](https://lists.apache.org/thread/drf0o5kzg1zfmok7gc09k8qz8hh9ymvh)
Closes #1244
---
.github/workflows/integration.yml | 127 ++++++++++++++++++++++++++++++
.github/workflows/test.yml | 69 ----------------
2 files changed, 127 insertions(+), 69 deletions(-)
create mode 100644 .github/workflows/integration.yml
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
new file mode 100644
index 0000000000..3872d03d2f
--- /dev/null
+++ b/.github/workflows/integration.yml
@@ -0,0 +1,127 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Integration
+
+on:
+ push:
+ branches:
+ - '**'
+ - '!dependabot/**'
+ tags:
+ - '**'
+ paths:
+ - '.github/workflows/integration.yml'
+ - '**/pom.xml'
+ - 'c/**'
+ - 'ci/scripts/**'
+ - 'compose.yaml'
+ - 'flight/**'
+ - 'format/**'
+ - 'testing/data/**'
+ - 'vector/**'
+ pull_request:
+ paths:
+ - '.github/workflows/integration.yml'
+ - '**/pom.xml'
+ - 'c/**'
+ - 'ci/scripts/**'
+ - 'compose.yaml'
+ - 'flight/**'
+ - 'format/**'
+ - 'testing/data/**'
+ - 'vector/**'
+
+concurrency:
+ group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+env:
+ DOCKER_VOLUME_PREFIX: ".docker/"
+
+jobs:
+ integration:
+ name: AMD64 integration
+ runs-on: ubuntu-latest
+ timeout-minutes: 60
+ steps:
+ - name: Checkout Arrow
+ uses: actions/checkout@v7
+ with:
+ fetch-depth: 0
+ repository: apache/arrow
+ submodules: recursive
+ - name: Checkout Arrow Rust
+ uses: actions/checkout@v7
+ with:
+ repository: apache/arrow-rs
+ path: rust
+ - name: Checkout Arrow nanoarrow
+ uses: actions/checkout@v7
+ with:
+ repository: apache/arrow-nanoarrow
+ path: nanoarrow
+ - name: Checkout Arrow .NET
+ uses: actions/checkout@v7
+ with:
+ repository: apache/arrow-dotnet
+ path: dotnet
+ - name: Checkout Arrow Go
+ uses: actions/checkout@v7
+ with:
+ repository: apache/arrow-go
+ path: go
+ - name: Checkout Arrow Java
+ uses: actions/checkout@v7
+ with:
+ path: java
+ - name: Checkout Arrow JavaScript
+ uses: actions/checkout@v7
+ with:
+ repository: apache/arrow-js
+ path: js
+ - name: Free up disk space
+ run: |
+ ci/scripts/util_free_space.sh
+ - name: Cache Docker Volumes
+ uses: actions/cache@v6
+ with:
+ path: .docker
+ key: integration-conda-${{ hashFiles('cpp/**') }}
+ restore-keys: integration-conda-
+ - name: Setup Python
+ uses: actions/setup-python@v6
+ with:
+ python-version: 3.12
+ - name: Setup Archery
+ run: pip install -e dev/archery[docker]
+ - name: Execute Docker Build
+ run: |
+ source ci/scripts/util_enable_core_dumps.sh
+ archery docker run \
+ -e ARCHERY_DEFAULT_BRANCH=main \
+ -e ARCHERY_INTEGRATION_TARGET_IMPLEMENTATIONS=java \
+ -e ARCHERY_INTEGRATION_WITH_DOTNET=1 \
+ -e ARCHERY_INTEGRATION_WITH_GO=1 \
+ -e ARCHERY_INTEGRATION_WITH_JAVA=1 \
+ -e ARCHERY_INTEGRATION_WITH_JS=1 \
+ -e ARCHERY_INTEGRATION_WITH_NANOARROW=1 \
+ -e ARCHERY_INTEGRATION_WITH_RUST=1 \
+ conda-integration
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 853b7cec09..653b16fa32 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -147,72 +147,3 @@ jobs:
env:
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
run: ci/scripts/test.sh . build jni
-
- integration:
- name: AMD64 integration
- runs-on: ubuntu-latest
- timeout-minutes: 60
- steps:
- - name: Checkout Arrow
- uses: actions/checkout@v7
- with:
- fetch-depth: 0
- repository: apache/arrow
- submodules: recursive
- - name: Checkout Arrow Rust
- uses: actions/checkout@v7
- with:
- repository: apache/arrow-rs
- path: rust
- - name: Checkout Arrow nanoarrow
- uses: actions/checkout@v7
- with:
- repository: apache/arrow-nanoarrow
- path: nanoarrow
- - name: Checkout Arrow .NET
- uses: actions/checkout@v7
- with:
- repository: apache/arrow-dotnet
- path: dotnet
- - name: Checkout Arrow Go
- uses: actions/checkout@v7
- with:
- repository: apache/arrow-go
- path: go
- - name: Checkout Arrow Java
- uses: actions/checkout@v7
- with:
- path: java
- - name: Checkout Arrow JavaScript
- uses: actions/checkout@v7
- with:
- repository: apache/arrow-js
- path: js
- - name: Free up disk space
- run: |
- ci/scripts/util_free_space.sh
- - name: Cache Docker Volumes
- uses: actions/cache@v6
- with:
- path: .docker
- key: integration-conda-${{ hashFiles('cpp/**') }}
- restore-keys: integration-conda-
- - name: Setup Python
- uses: actions/setup-python@v7
- with:
- python-version: 3.12
- - name: Setup Archery
- run: pip install -e dev/archery[docker]
- - name: Execute Docker Build
- run: |
- source ci/scripts/util_enable_core_dumps.sh
- archery docker run \
- -e ARCHERY_DEFAULT_BRANCH=main \
- -e ARCHERY_INTEGRATION_TARGET_IMPLEMENTATIONS=java \
- -e ARCHERY_INTEGRATION_WITH_DOTNET=1 \
- -e ARCHERY_INTEGRATION_WITH_GO=1 \
- -e ARCHERY_INTEGRATION_WITH_JAVA=1 \
- -e ARCHERY_INTEGRATION_WITH_JS=1 \
- -e ARCHERY_INTEGRATION_WITH_NANOARROW=1 \
- -e ARCHERY_INTEGRATION_WITH_RUST=1 \
- conda-integration
From 85d7ef30ee5f623cf3442dd989df09c3c5754ad2 Mon Sep 17 00:00:00 2001
From: Sandesh Kumar
Date: Thu, 6 Aug 2026 17:29:51 -0700
Subject: [PATCH 119/120] GH-1239: Fix memory leak when C Data import hits
allocator limit mid-array (#1240)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
`ReferenceCountedArrowArray.unsafeAssociateAllocation` calls `retain()`
before `wrapForeignAllocation`. If `wrapForeignAllocation` throws
(allocator over its limit), the retain is never balanced, the reference
count stays elevated, and the C Data release callback never fires —
leaking the producer's native memory.
**Fix:** call `retain()` after `wrapForeignAllocation` returns. Same
behavior on the success path; on failure the existing `finally` in
`ArrayImporter.importArray` drives the count to zero and fires the
release callback.
**Test:** `ImportOutOfMemoryTest` — exports a batch from a "producer"
allocator, tries to import it into a too-small consumer, and asserts the
producer drains to zero after the OOM. Fails on the original code,
passes with the fix.
Fixes: https://github.com/apache/arrow-java/issues/1239
---------
Signed-off-by: Sandesh Kumar
Co-authored-by: Sandesh Kumar
---
.../arrow/c/ReferenceCountedArrowArray.java | 19 ++-
.../apache/arrow/c/ImportOutOfMemoryTest.java | 139 ++++++++++++++++++
2 files changed, 151 insertions(+), 7 deletions(-)
create mode 100644 c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java
diff --git a/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java b/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
index cf50f9417b..f51fb25105 100644
--- a/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
+++ b/c/src/main/java/org/apache/arrow/c/ReferenceCountedArrowArray.java
@@ -64,13 +64,18 @@ void release() {
*/
ArrowBuf unsafeAssociateAllocation(
BufferAllocator trackingAllocator, long capacity, long memoryAddress) {
+ // Retain only after wrapForeignAllocation succeeds. On the allocator-limit OOM path,
+ // wrapForeignAllocation throws before the ForeignAllocation is associated, so release0()
+ // is not called; retaining first would leave the count elevated with no matching release0().
+ ArrowBuf buf =
+ trackingAllocator.wrapForeignAllocation(
+ new ForeignAllocation(capacity, memoryAddress) {
+ @Override
+ protected void release0() {
+ ReferenceCountedArrowArray.this.release();
+ }
+ });
retain();
- return trackingAllocator.wrapForeignAllocation(
- new ForeignAllocation(capacity, memoryAddress) {
- @Override
- protected void release0() {
- ReferenceCountedArrowArray.this.release();
- }
- });
+ return buf;
}
}
diff --git a/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java b/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java
new file mode 100644
index 0000000000..7c099f2ef0
--- /dev/null
+++ b/c/src/test/java/org/apache/arrow/c/ImportOutOfMemoryTest.java
@@ -0,0 +1,139 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.arrow.c;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.arrow.memory.BufferAllocator;
+import org.apache.arrow.memory.OutOfMemoryException;
+import org.apache.arrow.memory.RootAllocator;
+import org.apache.arrow.vector.FieldVector;
+import org.apache.arrow.vector.VarCharVector;
+import org.apache.arrow.vector.VectorSchemaRoot;
+import org.apache.arrow.vector.types.pojo.Schema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Regression test: a mid-import {@link OutOfMemoryException} must not leak the imported array.
+ *
+ * A "producer" allocator owns the exported batch; if the C Data release callback fires, the
+ * producer drains to zero. A too-small consumer allocator forces an OOM part-way through the
+ * import. The test asserts the producer drains, confirming the release callback fired despite the
+ * failure.
+ */
+final class ImportOutOfMemoryTest {
+ private static final int ROWS = 1024;
+ private static final int VALUE_BYTES = 256;
+ private static final int COLUMNS = 4;
+ // Far smaller than the exported batch, so the import OOMs part-way through the buffers.
+ private static final long TINY_LIMIT = 16 * 1024;
+
+ private RootAllocator root;
+
+ @BeforeEach
+ public void setUp() {
+ root = new RootAllocator(Long.MAX_VALUE);
+ }
+
+ @AfterEach
+ public void tearDown() {
+ root.close();
+ }
+
+ @Test
+ public void importOomDoesNotLeakExportedArray() {
+ // "producer" owns only the exported batch buffers; the C Data struct containers live on a
+ // separate allocator (they are consumed/closed by import, which would otherwise muddy the
+ // producer's balance). So producer draining to zero is an exact signal that the array's release
+ // callback fired.
+ try (BufferAllocator producer = root.newChildAllocator("producer", 0, Long.MAX_VALUE);
+ BufferAllocator structs = root.newChildAllocator("structs", 0, Long.MAX_VALUE)) {
+ try (ArrowArray array = ArrowArray.allocateNew(structs);
+ ArrowSchema schema = ArrowSchema.allocateNew(structs)) {
+ exportBatch(producer, array, schema);
+ assertTrue(
+ producer.getAllocatedMemory() > 0, "producer holds the exported batch before import");
+
+ // A consumer allocator far too small to hold the batch: the import throws part-way through.
+ try (BufferAllocator consumer = root.newChildAllocator("consumer", 0, TINY_LIMIT);
+ CDataDictionaryProvider provider = new CDataDictionaryProvider()) {
+ Schema importSchema = Data.importSchema(consumer, schema, provider);
+ try (VectorSchemaRoot importRoot = VectorSchemaRoot.create(importSchema, consumer)) {
+ Exception thrown =
+ assertThrows(
+ Exception.class,
+ () -> Data.importIntoVectorSchemaRoot(consumer, array, importRoot, provider));
+ assertTrue(
+ hasOutOfMemoryCause(thrown),
+ "mid-import failure must be an allocator OOM: " + thrown);
+ }
+ }
+
+ // The array's release callback must have fired despite the mid-import OOM, freeing the
+ // whole exported batch. On the unfixed retain-before-wrap code the batch is stranded.
+ assertEquals(
+ 0L,
+ producer.getAllocatedMemory(),
+ "import OOM leaked the exported batch (producer not drained)");
+ }
+ }
+ }
+
+ /** True if {@code t} is, or is caused by, an Arrow {@link OutOfMemoryException}. */
+ private static boolean hasOutOfMemoryCause(Throwable t) {
+ for (Throwable cause = t; cause != null; cause = cause.getCause()) {
+ if (cause instanceof OutOfMemoryException) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Builds a wide multi-column VarChar batch on {@code alloc} and exports it into the C structs.
+ */
+ private void exportBatch(BufferAllocator alloc, ArrowArray array, ArrowSchema schema) {
+ byte[] value = new byte[VALUE_BYTES];
+ for (int i = 0; i < value.length; i++) {
+ value[i] = (byte) 'x';
+ }
+ List vectors = new ArrayList<>(COLUMNS);
+ for (int c = 0; c < COLUMNS; c++) {
+ VarCharVector vector = new VarCharVector("col" + c, alloc);
+ vector.allocateNew((long) ROWS * VALUE_BYTES, ROWS);
+ for (int r = 0; r < ROWS; r++) {
+ vector.setSafe(r, value);
+ }
+ vector.setValueCount(ROWS);
+ vectors.add(vector);
+ }
+ try (VectorSchemaRoot source = new VectorSchemaRoot(vectors)) {
+ long total = 0;
+ for (FieldVector vector : source.getFieldVectors()) {
+ total += vector.getBufferSize();
+ }
+ assertTrue(total > TINY_LIMIT, "test setup: batch must exceed the consumer limit");
+ Data.exportVectorSchemaRoot(alloc, source, null, array, schema);
+ }
+ }
+}
From fa20039f39a7deacf5624ba8a6ee10e9d31e98ce Mon Sep 17 00:00:00 2001
From: David Li
Date: Fri, 14 Aug 2026 10:57:43 +0900
Subject: [PATCH 120/120] GH-1241: Bump vcpkg version to stay in sync with
apache/arrow (#1260)
This fixes the CI for Linux.
Closes #1241.
---
.env | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.env b/.env
index 51daa0406c..ef0c5fb101 100644
--- a/.env
+++ b/.env
@@ -53,4 +53,4 @@ MAVEN=3.9.9
# Versions for various dependencies used to build artifacts
# Keep in sync with apache/arrow
ARROW_REPO_ROOT=./arrow
-VCPKG="66c0373dc7fca549e5803087b9487edfe3aca0a1" # 2026.01.16 Release
+VCPKG="9b965a116838c6cdcd36bca60d1b81b030c8ab8d" # 2026.05.27 (not release, upstream commit)