)]}'
{
  "log": [
    {
      "commit": "48b4e9c2ac45b1dd96f939cfa5127ffa8105a385",
      "tree": "004fd09c9aa5277c1d0788c1edb9e8f67c3d8ee7",
      "parents": [
        "3d61c609b6e01631dc253e2112a29f85d95fef39"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 11:45:56 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 11:45:56 2026 +0100"
      },
      "message": "MINOR: [CI] Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1348)"
    },
    {
      "commit": "3d61c609b6e01631dc253e2112a29f85d95fef39",
      "tree": "6ec0779ad6243f7a6a49db2bcd652423ea30efbd",
      "parents": [
        "b8522418d1cacffa8141d293caf78948b2eed36f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 11:45:30 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 11:45:30 2026 +0100"
      },
      "message": "MINOR: Bump com.google.protobuf:protobuf-bom from 4.35.1 to 4.36.2 (#1349)"
    },
    {
      "commit": "b8522418d1cacffa8141d293caf78948b2eed36f",
      "tree": "797ef26eadb1be2bba23034d8c71ba40311cdb1a",
      "parents": [
        "0b576faddbd82f9e772079fbf7dc1cc74c8f1e9f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 09:26:06 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 09:26:06 2026 +0200"
      },
      "message": "MINOR: Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#1346)\n\nBumps\n[org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin)\nfrom 3.6.1 to 3.6.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/releases\"\u003eorg.codehaus.mojo:build-helper-maven-plugin\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReplace raw \u003ccode\u003eNPEx\u003c/code\u003e with customized exception message (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/239\"\u003e#239\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/pzygielo\"\u003e\u003ccode\u003e@​pzygielo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove redundant maven-resolver-api dependency and ignore\nResolver/SLF4J 2.x in Dependabot (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/248\"\u003e#248\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e@​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003eRemove redundant maven-resolver-api dependency and ignore\nResolver/SLF4J 2.x in Dependabot (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/248\"\u003e#248\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e@​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/247\"\u003e#247\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump\napache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\nfrom 4 to 5 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/244\"\u003e#244\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 96 to 97 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/246\"\u003e#246\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump\napache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4\nto 5 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/245\"\u003e#245\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/241\"\u003e#241\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 95 to 96 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/240\"\u003e#240\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 94 to 95 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/235\"\u003e#235\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 93 to 94 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/233\"\u003e#233\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 92 to 93 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/232\"\u003e#232\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 91 to 92 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/231\"\u003e#231\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/813bc7d2f03f2c9975de1f079cf7a7334211e0b6\"\u003e\u003ccode\u003e813bc7d\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release 3.6.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/07d91091b06db894178bcb6e71bc55f857546f46\"\u003e\u003ccode\u003e07d9109\u003c/code\u003e\u003c/a\u003e\nRemove redundant maven-resolver-api and ignore Resolver/SLF4J 2.x in\nDependabot\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/9abd552f324e429beb586407139eb4d43127344a\"\u003e\u003ccode\u003e9abd552\u003c/code\u003e\u003c/a\u003e\nBump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/3c15526bf151e28d6ce651197b36958164da4d4a\"\u003e\u003ccode\u003e3c15526\u003c/code\u003e\u003c/a\u003e\nBump\napache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/3b1f104096756ce33e8fc3e4c3062b1ccd8cf227\"\u003e\u003ccode\u003e3b1f104\u003c/code\u003e\u003c/a\u003e\nBump org.codehaus.mojo:mojo-parent from 96 to 97\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/1749855c90317f651eed427e45cb27c52cf8a542\"\u003e\u003ccode\u003e1749855\u003c/code\u003e\u003c/a\u003e\nBump\napache/maven-gh-actions-shared/.github/workflows/maven-verify.yml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/52300415d70e84a20924c06c26d9375b152e5409\"\u003e\u003ccode\u003e5230041\u003c/code\u003e\u003c/a\u003e\nBump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/c0e937567a4604534e32cf3cc4c3abb43bfa243c\"\u003e\u003ccode\u003ec0e9375\u003c/code\u003e\u003c/a\u003e\nDelete .github/release-drafter.yml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/84a839e4cb9b84b3afbbeef7f6c950ba5b478b31\"\u003e\u003ccode\u003e84a839e\u003c/code\u003e\u003c/a\u003e\nBump org.codehaus.mojo:mojo-parent from 95 to 96\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/a85c668b83334b423844fc448709b1d6e53cb32c\"\u003e\u003ccode\u003ea85c668\u003c/code\u003e\u003c/a\u003e\nReplace raw \u003ccode\u003eNPEx\u003c/code\u003e with customized exception message\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.1...3.6.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "0b576faddbd82f9e772079fbf7dc1cc74c8f1e9f",
      "tree": "1924a210e37f5dea22c3c832e3b809d129592a78",
      "parents": [
        "2ca48336bc3122f0bbd48c8db080f650b0d33c8d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 09:25:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 09:25:47 2026 +0200"
      },
      "message": "MINOR: Bump org.apache.orc:orc-core from 2.3.0 to 2.3.1 (#1345)\n\nBumps org.apache.orc:orc-core from 2.3.0 to 2.3.1.\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "2ca48336bc3122f0bbd48c8db080f650b0d33c8d",
      "tree": "640036871b7b06fecefc7f4b1e67cc542f8102a5",
      "parents": [
        "97bffabddec118e002c618266d04c4c92f42b0cb"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 09:24:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 09:24:47 2026 +0200"
      },
      "message": "MINOR: [CI] Bump actions/download-artifact from 8.0.1 to 8.0.2 (#1350)\n\nBumps\n[actions/download-artifact](https://github.com/actions/download-artifact)\nfrom 8.0.1 to 8.0.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/download-artifact/releases\"\u003eactions/download-artifact\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev8.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the readme by \u003ca\nhref\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e@​danwkennedy\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/473\"\u003eactions/download-artifact#473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproves artifact download retries when the service returns HTTP 429\n(rate limiting), including honoring valid Retry-After headers.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1 by \u003ca\nhref\u003d\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare download-artifact v8.0.2 by \u003ca\nhref\u003d\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/493\"\u003eactions/download-artifact#493\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/tunc-d\"\u003e\u003ccode\u003e@​tunc-d\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/pull/492\"\u003eactions/download-artifact#492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\"\u003ehttps://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003e\u003ccode\u003e9000827\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/issues/493\"\u003e#493\u003c/a\u003e\nfrom actions/tunc-d-prepare-download-v8-0-2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/e455989ae00f5bdd4054f05d3e972c6bf8a62dc5\"\u003e\u003ccode\u003ee455989\u003c/code\u003e\u003c/a\u003e\nPrepare download-artifact v8.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/a00b90c4a2f01d73a8c89552caabca6ea3b43137\"\u003e\u003ccode\u003ea00b90c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/issues/492\"\u003e#492\u003c/a\u003e\nfrom actions/tunc-d-download-artifact-package-bump\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/29bb7ce6af5345aeab5bb4774ce7249ee3ccc27f\"\u003e\u003ccode\u003e29bb7ce\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003e@​actions/artifact\u003c/code\u003e to 6.3.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/download-artifact/commit/484a0b528fb4d7bd804637ccb632e47a0e638317\"\u003e\u003ccode\u003e484a0b5\u003c/code\u003e\u003c/a\u003e\nUpdate the readme (\u003ca\nhref\u003d\"https://redirect.github.com/actions/download-artifact/issues/473\"\u003e#473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "97bffabddec118e002c618266d04c4c92f42b0cb",
      "tree": "989b5c304f4353e1c007f28836129b028339625d",
      "parents": [
        "6edad854362d3d9d2bdb8e98f201bd46de454794"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 09:24:01 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 09:24:01 2026 +0200"
      },
      "message": "MINOR: Bump io.grpc:grpc-bom from 1.84.0 to 1.84.2 (#1351)\n\nBumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.84.0\nto 1.84.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/releases\"\u003eio.grpc:grpc-bom\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.84.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ecore: Gracefully handle GOAWAY frames with unrecognized error codes\n(\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-java/issues/13043\"\u003e#13043\u003c/a\u003e).\nTreats unrecognized HTTP/2 GOAWAY error codes as INTERNAL_ERROR instead\nof throwing NullPointerException.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/1d2977b0cff51be8da111c8449cb03c0e0b10995\"\u003e\u003ccode\u003e1d2977b\u003c/code\u003e\u003c/a\u003e\nBump version to 1.84.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/9f24a017a95703fa955a6bdd56fe796119bad682\"\u003e\u003ccode\u003e9f24a01\u003c/code\u003e\u003c/a\u003e\nUpdate README etc to reference 1.84.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/7ab444a66f8b55dc2a3ae43a189a42906414a8aa\"\u003e\u003ccode\u003e7ab444a\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Release v1.84.2 (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-java/issues/13101\"\u003e#13101\u003c/a\u003e)\u0026quot;\n(\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-java/issues/13102\"\u003e#13102\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/30336aa0d9186569241e77d17305ddcdb57d3991\"\u003e\u003ccode\u003e30336aa\u003c/code\u003e\u003c/a\u003e\nRelease v1.84.2 (\u003ca\nhref\u003d\"https://redirect.github.com/grpc/grpc-java/issues/13101\"\u003e#13101\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/62e0ebd9ec4b7bacab4885bb0b6686a4d401dc0b\"\u003e\u003ccode\u003e62e0ebd\u003c/code\u003e\u003c/a\u003e\nxDS: fix DistributorWatcher thread safety in CertificateProvider\n(v1.84.x bac...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/b73b67b1555464d748df84a6ee50b47a1c066b31\"\u003e\u003ccode\u003eb73b67b\u003c/code\u003e\u003c/a\u003e\ncore: Delayed deserialization for unary/server-streaming calls (v1.84.x\nbackp...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/e009a54d71018fa25ef6bfbd6b8f6d815880ec5a\"\u003e\u003ccode\u003ee009a54\u003c/code\u003e\u003c/a\u003e\nBump version to 1.84.2-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/c0ba89f3492e448c4a9bb5f43832d1d06422a299\"\u003e\u003ccode\u003ec0ba89f\u003c/code\u003e\u003c/a\u003e\nBump version to 1.84.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/48e06f6295090a6f8dcf6b9a6718c6f41e55d7d0\"\u003e\u003ccode\u003e48e06f6\u003c/code\u003e\u003c/a\u003e\nUpdate README etc to reference 1.84.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/commit/0384c788cb21c9417e59bbd70999bd666bd914b4\"\u003e\u003ccode\u003e0384c78\u003c/code\u003e\u003c/a\u003e\ncore: Gracefully handle GOAWAY frames with unrecognized error codes\n(v1.84.x ...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/grpc/grpc-java/compare/v1.84.0...v1.84.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6edad854362d3d9d2bdb8e98f201bd46de454794",
      "tree": "d92f163d31583e9e029ea038593618d548497929",
      "parents": [
        "f106063802a64703ddf4f2c395a960bdcb00ebbb"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 09:23:43 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 09:23:43 2026 +0200"
      },
      "message": "MINOR: Bump org.apache.avro:avro from 1.12.1 to 1.12.2 (#1352)\n\nBumps org.apache.avro:avro from 1.12.1 to 1.12.2.\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "f106063802a64703ddf4f2c395a960bdcb00ebbb",
      "tree": "9d849513b7d1e54d816ff59321120f49bcf5abef",
      "parents": [
        "a7ebcb876a3e0fa2fb0be1d16d6bdcff91c4517a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 09:23:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 09:23:26 2026 +0200"
      },
      "message": "MINOR: Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4 (#1353)\n\nBumps\n[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)\nfrom 3.10.3 to 3.10.4.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.10.4\u003c/h2\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003eeclipse\u003c/code\u003e version from \u003ccode\u003e4.40\u003c/code\u003e to\n\u003ccode\u003e4.41\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egherkin\u003c/code\u003e version \u003ccode\u003e42.0.0\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e42.0.1\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3088\"\u003e#3088\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejackson\u003c/code\u003e version \u003ccode\u003e2.22.2\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e2.22.3\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3101\"\u003e#3101\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003epalantir-java-format\u003c/code\u003e version\n\u003ccode\u003e2.98.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.102.0\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3103\"\u003e#3103\u003c/a\u003e,\n\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3132\"\u003e#3132\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003emockito-core\u003c/code\u003e version \u003ccode\u003e5.23.0\u003c/code\u003e\n-\u0026gt; \u003ccode\u003e5.24.0\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3106\"\u003e#3106\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egreclipse\u003c/code\u003e version to latest\n\u003ccode\u003e4.40\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.41\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3123\"\u003e#3123\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ektfmt\u003c/code\u003e version \u003ccode\u003e0.64\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e0.65\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3135\"\u003e#3135\u003c/a\u003e)\u003cbr\n/\u003e\nWhich moved to the \u003ccode\u003eorg.jetbrains.kotlinx:ktfmt\u003c/code\u003e coordinate\nand \u003ccode\u003eorg.jetbrains.kotlinx.ktfmt\u003c/code\u003e package. Older versions are\nstill supported.\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003epalantir-java-format\u003c/code\u003e version\n\u003ccode\u003e2.99.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.102.0\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3132\"\u003e#3132\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate Plexus component injection to JSR-330 and Maven parameter.\n(\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3122\"\u003e#3122\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eshortenFullyQualifiedTypes\u003c/code\u003e leaves a qualified name\nalone when the enclosing type extends or implements a type that is not\nin the same file, so an inherited member type cannot take the simple\nname. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3117\"\u003e#3117\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eexpandWildcardImports\u003c/code\u003e no longer drops the import of a\ntype that is only used to qualify a static member (such as\n\u003ccode\u003eCollections.sort(list)\u003c/code\u003e or \u003ccode\u003eTimeUnit.SECONDS\u003c/code\u003e),\nor the static import of a field or enum constant (such as\n\u003ccode\u003ePI\u003c/code\u003e from \u003ccode\u003eimport static java.lang.Math.*\u003c/code\u003e), which\nproduced code that did not compile. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2833\"\u003e#2833\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/62e727dd766addbcac781ce96f48481a5429d671\"\u003e\u003ccode\u003e62e727d\u003c/code\u003e\u003c/a\u003e\nPublished maven/3.10.4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/d9e7a412fe136999bb304c65287e9e903c9c5e3a\"\u003e\u003ccode\u003ed9e7a41\u003c/code\u003e\u003c/a\u003e\nPublished gradle/8.10.4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/c006d66c0218a8eaa0c315e74c24bba7c1be9286\"\u003e\u003ccode\u003ec006d66\u003c/code\u003e\u003c/a\u003e\nPublished lib/4.10.4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/8adb835389b1b883707a204a48c789f61073d7cc\"\u003e\u003ccode\u003e8adb835\u003c/code\u003e\u003c/a\u003e\nMerge release publishing fixes into main (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3138\"\u003e#3138\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/67b4dbfdff010a8702a093bbb22c770910b8dcc1\"\u003e\u003ccode\u003e67b4dbf\u003c/code\u003e\u003c/a\u003e\nRemove internal publishing changes from release notes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/b9c48306d38e82718e14add4f63901a78893338c\"\u003e\u003ccode\u003eb9c4830\u003c/code\u003e\u003c/a\u003e\nKeep Rewrite plugin on publicly resolvable releases (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3036\"\u003e#3036\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/1c93df4f0b4eb62f445057dcdf78fd8e986310e3\"\u003e\u003ccode\u003e1c93df4\u003c/code\u003e\u003c/a\u003e\nUpdate dependency com.palantir.javaformat:palantir-java-format to\nv2.102.0 (#...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/ab153a9c3816b2d7663f171b5b53cce7fcbf4cbb\"\u003e\u003ccode\u003eab153a9\u003c/code\u003e\u003c/a\u003e\nKeep Rewrite plugin on publicly resolvable releases\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/feb10d8d0f575c526ecbd7f827c0d28f7f6b4577\"\u003e\u003ccode\u003efeb10d8\u003c/code\u003e\u003c/a\u003e\nUpdate plugin rewrite to v7.41.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/20836645844f5f8d947e9d00514284b0d01b8517\"\u003e\u003ccode\u003e2083664\u003c/code\u003e\u003c/a\u003e\nUpdate changelogs for default formatter version bump (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3132\"\u003e#3132\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/diffplug/spotless/compare/maven/3.10.3...maven/3.10.4\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "a7ebcb876a3e0fa2fb0be1d16d6bdcff91c4517a",
      "tree": "2ac7718d6fe75323b6e6cd64c562357e5e21fb22",
      "parents": [
        "02a37f8900b72207277ba73584901aea365016e5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 15 15:07:40 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 15 15:07:40 2026 +0200"
      },
      "message": "MINOR: Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 (#1355)\n\nBumps\n[org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin)\nfrom 3.6.3 to 3.6.4.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/releases\"\u003eorg.codehaus.mojo:exec-maven-plugin\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.6.4\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e📝 Documentation updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix typo in docs (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/531\"\u003e#531\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/pzygielo\"\u003e\u003ccode\u003e@​pzygielo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore Maven Resolver \u0026gt;\u003d 2.0 and SLF4J \u0026gt;\u003d 2.0 in Dependabot\n(\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/538\"\u003e#538\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e@​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eStop dependabot from updating test fixtures (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/535\"\u003e#535\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e@​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd IT using custom plugin repository (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/497\"\u003e#497\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/Marcono1234\"\u003e\u003ccode\u003e@​Marcono1234\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore Maven Resolver \u0026gt;\u003d 2.0 and SLF4J \u0026gt;\u003d 2.0 in Dependabot\n(\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/538\"\u003e#538\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e@​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 3.0.24 to 3.6.1 in\n/src/it/projects/jigsaw (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/537\"\u003e#537\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/536\"\u003e#536\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump\napache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\nfrom 4 to 5 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/528\"\u003e#528\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 96 to 97 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/530\"\u003e#530\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-toolchains-plugin from 3.2.0 to\n3.3.0 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/533\"\u003e#533\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump\napache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4\nto 5 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/529\"\u003e#529\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump asm.version from 9.10 to 9.10.1 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/525\"\u003e#525\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump asm.version from 9.9.1 to 9.10 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/524\"\u003e#524\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/516\"\u003e#516\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness\nfrom 3.5.0 to 3.5.1 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/512\"\u003e#512\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 95 to 96 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/514\"\u003e#514\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness\nfrom 3.4.0 to 3.5.0 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/511\"\u003e#511\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 94 to 95 (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/pull/510\"\u003e#510\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/56083f01f49958e6a1c6feac4fbb50062518749a\"\u003e\u003ccode\u003e56083f0\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release 3.6.4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/57c594b3c1b86aa6981ecfd6760eac8d51eaba09\"\u003e\u003ccode\u003e57c594b\u003c/code\u003e\u003c/a\u003e\nIgnore Maven Resolver \u0026gt;\u003d 2.0 and SLF4J \u0026gt;\u003d 2.0 in Dependabot\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/c2f5d4e05214d346a364551219504f24fa920378\"\u003e\u003ccode\u003ec2f5d4e\u003c/code\u003e\u003c/a\u003e\nUpdate required module name in jigsaw IT to\norg.codehaus.plexus.util\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/d227ee6474b1d78fdfd2d55039f504894b98c197\"\u003e\u003ccode\u003ed227ee6\u003c/code\u003e\u003c/a\u003e\nBump org.codehaus.plexus:plexus-utils in /src/it/projects/jigsaw\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/388fd993ec9fdfc6c2b1bb9ce92a83275b6c175f\"\u003e\u003ccode\u003e388fd99\u003c/code\u003e\u003c/a\u003e\nBump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/30106e8a549998483380864ef6fecc7b26be349c\"\u003e\u003ccode\u003e30106e8\u003c/code\u003e\u003c/a\u003e\nStop dependabot from updating test fixtures\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/b6d5eab1370df8a70ce3c75bf4675eaccf28e1b6\"\u003e\u003ccode\u003eb6d5eab\u003c/code\u003e\u003c/a\u003e\nBump\napache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/aa98abaeea3b97226e5c89a534b7b2db938b1d46\"\u003e\u003ccode\u003eaa98aba\u003c/code\u003e\u003c/a\u003e\nBump org.codehaus.mojo:mojo-parent from 96 to 97\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/79cfdcd526cdea443a112ed164552ecdcc112f2f\"\u003e\u003ccode\u003e79cfdcd\u003c/code\u003e\u003c/a\u003e\nBump org.apache.maven.plugins:maven-toolchains-plugin\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/commit/8c58ad610d7cb068afdee9556c019bfed35e8207\"\u003e\u003ccode\u003e8c58ad6\u003c/code\u003e\u003c/a\u003e\nFix typo in docs (\u003ca\nhref\u003d\"https://redirect.github.com/mojohaus/exec-maven-plugin/issues/531\"\u003e#531\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/mojohaus/exec-maven-plugin/compare/3.6.3...3.6.4\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "02a37f8900b72207277ba73584901aea365016e5",
      "tree": "12b7386392c019eacf255f48597c844ad85b8f4b",
      "parents": [
        "b6df6f3aad9a9e1cef5bf85dcfe94f4c9a3e9240"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 15 15:07:25 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 15 15:07:25 2026 +0200"
      },
      "message": "MINOR: Bump com.h2database:h2 from 2.4.240 to 2.5.252 (#1356)\n\nBumps [com.h2database:h2](https://github.com/h2database/h2database) from\n2.4.240 to 2.5.252.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/h2database/h2database/releases\"\u003ecom.h2database:h2\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 2.5.252\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eversion-2.5.250\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/f986838bbbf4941d2edcd5298b18c9936d1b7359\"\u003e\u003ccode\u003ef986838\u003c/code\u003e\u003c/a\u003e\nin preparation for a release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/06c34a7fa288208ecabb5d670555fd807270bb2a\"\u003e\u003ccode\u003e06c34a7\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4418\"\u003e#4418\u003c/a\u003e\nfrom andreitokar/issues-4380-4376\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/1aef3e0692b7379402b2a1a14e5223a8911e31ec\"\u003e\u003ccode\u003e1aef3e0\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4376\"\u003e#4376\u003c/a\u003e:\nReading INFORMATION_SCHEMA.COLUMNS fails with a NPE while any\nmaterial...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/4bb8aee6bf4305a83e79b6a93e9e3781f904fed9\"\u003e\u003ccode\u003e4bb8aee\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4380\"\u003e#4380\u003c/a\u003e:\ncreating a MATERIALIZED VIEW makes a persistent database permanently\nu...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/95b6af03b8768d770e5dac1ae829b7c15301b38e\"\u003e\u003ccode\u003e95b6af0\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4417\"\u003e#4417\u003c/a\u003e\nfrom andreitokar/issue-4395\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/6ec30b66b68a298d6cfc424aa77fec90ebf05199\"\u003e\u003ccode\u003e6ec30b6\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4395\"\u003e#4395\u003c/a\u003e\ndisallow constraints between temporary and permanent tables\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/0f0f85605084bd4eaad8f6a467ff802161048b60\"\u003e\u003ccode\u003e0f0f856\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4416\"\u003e#4416\u003c/a\u003e\nfrom andreitokar/issue-4405\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/f718b764c6d53e160f94d05003eae81d554ec253\"\u003e\u003ccode\u003ef718b76\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4405\"\u003e#4405\u003c/a\u003e\nSecureFileStore.readFully() may skip decryption\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/e231ff7def4c280ffb845cb0b6e92fb9686867d1\"\u003e\u003ccode\u003ee231ff7\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4405\"\u003e#4405\u003c/a\u003e\nSecureFileStore.readFully() may skip\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/h2database/h2database/commit/4da0d1d02b4e860d6c2e68ff2de0c11c0a19011c\"\u003e\u003ccode\u003e4da0d1d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/h2database/h2database/issues/4415\"\u003e#4415\u003c/a\u003e\nfrom jjh75607/fix/log-sql-aarch64\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/h2database/h2database/compare/version-2.4.240...version-2.5.252\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "b6df6f3aad9a9e1cef5bf85dcfe94f4c9a3e9240",
      "tree": "75f70a05c198290090c0ef75d7a8ec1969c147af",
      "parents": [
        "bc064bb3bb2717b2b60b4abc0854f369594747f5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 15 08:21:27 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 15 08:21:27 2026 +0100"
      },
      "message": "MINOR: Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.3 (#1354)\n\nBumps\n[com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom)\nfrom 2.22.0 to 2.22.3.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/9b1c380eabf9464268c98684da6e232d09f56fd3\"\u003e\u003ccode\u003e9b1c380\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-bom-2.22.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/f76ca146005cb6230b7a14b370bac9766bbc3a02\"\u003e\u003ccode\u003ef76ca14\u003c/code\u003e\u003c/a\u003e\nPrep for 2.22.3 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/d6ac1083e4a144d41accccadce8bc893350385dc\"\u003e\u003ccode\u003ed6ac108\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.21\u0027 into 2.22\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/093a05e12cb5b0ebc36f64c52098d905794fa0db\"\u003e\u003ccode\u003e093a05e\u003c/code\u003e\u003c/a\u003e\nPost-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/e7a71a21b5c165e3d927070ae9cec013189bfcdc\"\u003e\u003ccode\u003ee7a71a2\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/62d4d51724430074c0b7223fa69bacab444bee04\"\u003e\u003ccode\u003e62d4d51\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release jackson-bom-2.21.7\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/6171b545bc3f85b91abf324fda144c12127a08b1\"\u003e\u003ccode\u003e6171b54\u003c/code\u003e\u003c/a\u003e\nPrep for 2.21.7 release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/6702bf32e5dfab76ebd57906eee2ff4f68b3eb41\"\u003e\u003ccode\u003e6702bf3\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.20\u0027 into 2.21\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/2feb1f9b0d418a9d064ef9e4592696532ac6f887\"\u003e\u003ccode\u003e2feb1f9\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.19\u0027 into 2.20\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/commit/1129aa08ce02f82f47b57a7dbcb3e64b4fd10a8e\"\u003e\u003ccode\u003e1129aa0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u00272.18\u0027 into 2.19\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.22.0...jackson-bom-2.22.3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "bc064bb3bb2717b2b60b4abc0854f369594747f5",
      "tree": "a0d019a2a88b95879ccc4a7f6e4b7352ceb51f4a",
      "parents": [
        "1536b94c5d58a39ebe482edb92ffdf0072c55522"
      ],
      "author": {
        "name": "Laurent Goujon",
        "email": "laurentgo@users.noreply.github.com",
        "time": "Tue Oct 13 23:17:24 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 13 23:17:24 2026 -0700"
      },
      "message": "GH-1340: [CI][JNI] Always build the vcpkg-jni image and use the right cpp-jni base tag (#1341)\n\n## What\u0027s Changed\n\nThe Linux JNI jobs fail installing Archery with `Python \u003c 3.11 is not\nsupported`. `docker compose run vcpkg-jni` pulls a stale published image\nbuilt on an old `apache/arrow` `cpp-jni` base that still had Python 3.10\nfirst on `PATH`, and nothing rebuilds it because the image tag only\ndepends on the `VCPKG` pin.\n\n- Run `docker compose build --pull vcpkg-jni` before `docker compose run\nvcpkg-jni`, so the image is always rebuilt on top of the current base\nimage (using the published image as cache), as suggested in review.\n- Use apache/arrow\u0027s short architecture name (`ARCH_SHORT`: `amd64` /\n`arm64`) for the `cpp-jni` base image tag. apache/arrow switched its\ntags from `arm64v8-…` to `arm64-…` in apache/arrow#50125 (GH-32994); the\nold `arm64v8-cpp-jni-…` tag is a stale image (Python 3.10, built\n2026-06-02) that was never updated again, so the aarch64 job kept using\nit. `ARCH` is unchanged, so our own tag naming and the `ubuntu` service\n(`${ARCH}/maven`) are not affected.\n\nThe `VCPKG` pin is unchanged: it must stay in sync with apache/arrow,\nwhich only publishes `cpp-jni` images for its own pin (`9b965a1…`).\n\nAI assistance (Claude Code) was used during development; the complete\ndiff was reviewed by the author.\n\nCloses #1340.\n\nCo-authored-by: Claude Sonnet 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "1536b94c5d58a39ebe482edb92ffdf0072c55522",
      "tree": "dc4ee747f3e36a1dace9bb95ba0630c26ec337cd",
      "parents": [
        "f5f196118fb47260db3b35a5ba07defa6429a31b"
      ],
      "author": {
        "name": "Laurent Goujon",
        "email": "laurentgo@users.noreply.github.com",
        "time": "Tue Oct 13 01:19:38 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 13 09:19:38 2026 +0100"
      },
      "message": "GH-1343: [CI] Bump develocity-maven-extension to 2.6.0 for Maven 3.10 compatibility (#1344)\n\n## What\u0027s Changed\nBump `com.gradle:develocity-maven-extension` from 2.5.0 to 2.6.0 in\n`.mvn/extensions.xml`. 2.5.0 fails at project load on Maven 3.10.0 (the\nversion now on the GitHub runner images) with a Guice\n`NullInjectedIntoNonNullable` error, which breaks the `Binaries` job in\n`rc.yml`. 2.6.0 loads on both Maven 3.9.x and 3.10.0.\n\nVerified locally: `mvn -N validate` passes on Maven 3.9.12 and 3.10.0\n(JDK 25 and 17), and `mvn -DskipTests clean verify` passes on Maven\n3.10.0 on JDK 25 and 17. The full `Binaries` job (JNI profiles,\n`apache-release`, `site`) and build scan publishing could not be run\nlocally.\n\nCloses #1343.\n\nAI assistance was used during development; the complete diff and test\nresults were reviewed by the author.\n\nCo-authored-by: Claude Sonnet 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "f5f196118fb47260db3b35a5ba07defa6429a31b",
      "tree": "b9979781802fd29268e7066235c4e153001d2ee1",
      "parents": [
        "d5450742b7ceef737ab4b1d92007f92fc549b939"
      ],
      "author": {
        "name": "Efe",
        "email": "gokdemirefe1903@gmail.com",
        "time": "Tue Oct 06 15:56:55 2026 +0300"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 14:56:55 2026 +0200"
      },
      "message": "GH-1261: Reject out-of-range dictionary indices (#1309)\n\n## What\u0027s Changed\nReject negative and dictionaryCount indices before copying dictionary\nvalues.\n\nAdd regression coverage for both invalid bounds and allocator cleanup,\nand keep the existing struct decode regression focused on the later\ninvalid field.\n\nCloses #1261.\n\nAI assistance was used during development; the complete diff and test\nresults were reviewed by the author.\n\n---------\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e\nSigned-off-by: Efe Gökdemir \u003cgokdemirefe1903@gmail.com\u003e"
    },
    {
      "commit": "d5450742b7ceef737ab4b1d92007f92fc549b939",
      "tree": "ab6f33d29319fd16ad5ea4230b1957451d69ae89",
      "parents": [
        "4b2d53ed1639173b30aa0dc694ce3a0fa9965bb6"
      ],
      "author": {
        "name": "Prateek Ganigi",
        "email": "91584519+PG1204@users.noreply.github.com",
        "time": "Tue Oct 06 04:26:29 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 13:26:29 2026 +0200"
      },
      "message": "GH-1196: Write NO_COMPRESSION_LENGTH sentinel for empty buffers in compress() (#1248)\n\n## What\u0027s Changed\n\n`AbstractCompressionCodec.compress()` wrote a length prefix of `0` for\nempty buffers. The Arrow IPC compression format only defines a positive\nlength (compressed) or `-1` / `NO_COMPRESSION_LENGTH` (stored\nuncompressed); a `0` prefix is undefined. As a result, C++/PyArrow\nreject Java-produced streams that contain empty buffers, even though\nJava itself accepts them on read.\n\nThis changes the empty-buffer shortcut in `compress()` to write\n`CompressionUtil.NO_COMPRESSION_LENGTH` (`-1`) instead of `0`.\n\n`decompress()` is intentionally left unchanged:\n- its `NO_COMPRESSION_LENGTH` branch handles the new output, and\n- its `decompressedLength \u003d\u003d 0` branch remains for backward-compatible\nreads of older Java-produced streams.\n\nAdded a parameterized test (`testEmptyBufferWritesUncompressedSentinel`,\ncovering LZ4 and ZSTD) that compresses an empty buffer, asserts the\nprefix equals `NO_COMPRESSION_LENGTH`, and asserts it round-trips back\nto a zero-length buffer. The pre-existing `testEmptyBuffer` continues to\npass with empty buffers now routed through the `-1` path.\n\nCloses #1196."
    },
    {
      "commit": "4b2d53ed1639173b30aa0dc694ce3a0fa9965bb6",
      "tree": "fb9ef181da11488ccf0ad1c878c6641e23cb5cf4",
      "parents": [
        "ae008896c5f959f9852c9ac28f75585d10055e5d"
      ],
      "author": {
        "name": "Prateek Ganigi",
        "email": "91584519+PG1204@users.noreply.github.com",
        "time": "Tue Oct 06 01:14:40 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 10:14:40 2026 +0200"
      },
      "message": "GH-1205: Fix byte-array element leak in FromSchemaByteArray (#1249)\n\n## What\u0027s Changed\n\n`FromSchemaByteArray()` in `dataset/src/main/cpp/jni_util.cc` acquires\nthe Java byte-array elements via `GetByteArrayElements()`, but the\nmatching `ReleaseByteArrayElements()` was only reached on the success\npath. When `arrow::ipc::ReadSchema()` failed, `ARROW_ASSIGN_OR_RAISE`\nreturned early and skipped the release, leaking the pinned/copied array\nbuffer on every call with malformed or incompatible serialized schema\nbytes (e.g. via `createDataset()`).\n\nThis releases the elements through an RAII guard so they are always\nfreed on every exit path - success or error, and stays correct if\nadditional early returns are added later.\n\nCloses #1205."
    },
    {
      "commit": "ae008896c5f959f9852c9ac28f75585d10055e5d",
      "tree": "57dca7210d90974fb00993e572ae19373a0bea55",
      "parents": [
        "5a6314d1b1ed4bebeb2614275e4e5672c84bead1"
      ],
      "author": {
        "name": "Abdul Rawoof Khan",
        "email": "abdulr@bugqore.com",
        "time": "Tue Oct 06 13:20:37 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 09:50:37 2026 +0200"
      },
      "message": "GH-1317: bound FlightData frame field length before allocating (#1318)\n\n## What\u0027s Changed\n\n`ArrowMessage.frame` is the DoPut/DoExchange request marshaller, and for\neach FlightData field it allocated a buffer sized by a length prefix\ntaken straight off the wire before reading any content, so a client\ncould force an arbitrarily large allocation with a tiny frame (an\nunauthenticated denial of service during request deframing). The\ndescriptor and header paths used `new byte[size]`, which allocates on\nthe JVM heap and bypasses the `BufferAllocator` limit entirely.\nConcretely, a ~10-byte HEADER frame whose length prefix encodes\n`0x7FFFFFFF` drove a `new byte[2147483647]` (2 GiB) heap allocation\nbefore the subsequent read failed.\n\nThe length prefix is now read and validated in one place\n(`readFieldLength`): a negative length is rejected outright, and when\nthe stream is `io.grpc.KnownLength` (gRPC\u0027s uncompressed\n`BufferInputStream`, where `available()` is the number of bytes left in\nthe message) a length larger than that is rejected before anything is\nallocated. For other streams, such as the decompressing stream gRPC\nhands over for compressed messages, `available()` isn\u0027t the remaining\nlength, so the read itself bounds the allocation: fields are read with\n`readNBytes` plus a length check, and the `ArrowBuf` is allocated once\nthe bytes have actually arrived. The `KnownLength` path keeps the\nexisting `GetReadableBuffer` fast path.\n\n`frame()` is also made exception-safe: `appMetadata` and `body` are\nreleased when a later field fails, and a repeated `app_metadata` field\nreleases the earlier buffer like `BODY` already did, so a rejected frame\ncan\u0027t leak direct memory.\n\nThe new tests run each case over both a real gRPC `BufferInputStream`\nand a `GZIPInputStream`: a well-formed frame, oversized and negative\nlengths for all four fields (asserting the allocator\u0027s peak allocation\nstays at 0), a valid app_metadata and body followed by a rejected field\n(asserting nothing is left allocated), and a repeated field.\n\nCloses #1317."
    },
    {
      "commit": "5a6314d1b1ed4bebeb2614275e4e5672c84bead1",
      "tree": "c4da72b1f9156a3fd0a5c27e484e74aaf826ec2c",
      "parents": [
        "eb733ad64a158a56cab91df5e60a513536133be2"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Tue Oct 06 07:21:15 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 07:21:15 2026 +0200"
      },
      "message": "GH-384: Wait for the server executor in FlightServer.close() (#1333)\n\n## What\u0027s Changed\n\n`TestDoExchange.tearDown` is flaky (most recently in\n`testServerCancelLeak` on the macOS job) with:\n\n```\njava.lang.IllegalStateException: Memory was leaked by query. Memory leaked: (8192)\nAllocator(ROOT) 0/0/16384/2147483647 (res/actual/peak/limit)\n```\n\nThis is a shutdown race rather than a real leak: the message reports\n8192 leaked bytes, but the allocator state printed right after already\nshows 0 bytes allocated.\n\ngRPC reports the server as terminated once its transports are closed,\nwithout waiting for the calls still running on the executor.\n`FlightServer.close()` returned at that point, while such a call could\nstill be parsing an incoming message (which allocates a buffer,\ndiscarded right after because the stream is already closed). Closing the\nallocator in that window reports a leak.\n\n`FlightServer.close()` now also waits for the executor it created,\nwithin the existing 6 seconds budget, and logs a warning if the executor\ndoes not terminate in time. Nothing changes for user-supplied executors\n(Flight does not own them), nor for `shutdown()` / `awaitTermination()`.\n\nTests:\n\n- `TestServerOptions.closeWaitsForDefaultExecutor` is a new test that\nfails without the fix.\n- `TestDoExchange.testClientClose` leaked the allocator on purpose to\nwork around the same race (`TODO(ARROW-9586)`). This workaround is\nremoved.\n\nI reproduced the flakiness locally by looping the tests in parallel JVMs\n(to get CPU contention):\n\n| Scenario | Before | After |\n|---|---|---|\n| `testServerCancelLeak` | 61 failures / 12,000 runs | 0 / 12,000 |\n| `testClientClose` without the workaround | 1,250 failures / 7,200 runs\n| 0 / 7,200 |\n\nCloses #384."
    },
    {
      "commit": "eb733ad64a158a56cab91df5e60a513536133be2",
      "tree": "4e96f4405e71325f5cefeef9a0c72338627aa54c",
      "parents": [
        "ce8a19d8a6d4a1708bddd6dda61bab8d2526bfbe"
      ],
      "author": {
        "name": "Sunflower_PJ",
        "email": "hkgy87fbn4@privaterelay.appleid.com",
        "time": "Mon Oct 05 22:41:51 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 16:41:51 2026 +0200"
      },
      "message": "GH-1234: Release serialization buffers when compression fails (#1290)\n\n## What\u0027s Changed\n\nWhen record batch serialization fails after retaining or compressing\nbuffers, `VectorUnloader` can leave those buffers alive even after the\nsource vectors are closed. Compression allocation failures can also\nleave an extra reference to the input buffer in\n`AbstractCompressionCodec`.\n\nRelease collected batch buffers if traversal or batch construction\nthrows, while preserving the original exception. Use try-with-resources\nin `AbstractCompressionCodec.compress` so the codec releases the input\nit owns on both success and failure. Cleanup remains in the component\nthat owns each buffer: the unloader does not release an input already\nhanded to a custom codec.\n\nRegression coverage checks allocator exhaustion with zero allocation\nheadroom, runtime exceptions and errors injected on the second\ncompression call, an empty input buffer, and a malformed later vector.\nThe compression-only test stub is explicitly named `SimulatedLz4Codec`;\nit exercises allocation and ownership, not LZ4 round trips. The tests\nassert memory usage and reference counts return to their previous values\nand that the source data remains readable. Additional tests exercise\nallocation failure with the real LZ4 and ZSTD codecs.\n\nThe memory-leak report and initial outer-cleanup proposal are from\n#1234; this change also handles the codec\u0027s input ownership.\n\n## Validation\n\n- Before the fix: the initial regression run exposed retained references\nand unreleased allocations; the 5 existing unload/load tests passed.\n- After the review update: 10 vector cases pass on each of Netty and\nUnsafe; 53 compression cases pass, including LZ4/ZSTD allocation\nfailures and compressed stream/file round trips (73 test executions, no\nfailures/errors/skips).\n- JDK 17 compilation and Checkstyle passed. Spotless check passed on JDK\n23; `git diff --check` passed.\n\n```sh\nmvn -B -ntp -pl compression -am test -Dtest\u003dTestVectorUnloadLoad,TestVectorUnloaderFailure,TestCompressionCodec,TestArrowReaderWriterWithCompression,TestCompressionCodecServiceProvider -Dsurefire.failIfNoSpecifiedTests\u003dfalse\n```\n\n- No full repository test run, native dataset/Flight integration run or\nperformance benchmark is claimed.\n\nCloses #1234.\n\nAI assistance: OpenAI Codex was used for implementation and local\nvalidation."
    },
    {
      "commit": "ce8a19d8a6d4a1708bddd6dda61bab8d2526bfbe",
      "tree": "2b3f0ecb36b229dc65455548ab7f90efe137b3f1",
      "parents": [
        "ba9f2e3626b1fb15a0fb7c68fa405730234d8cce"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 16:22:04 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 16:22:04 2026 +0200"
      },
      "message": "MINOR: Bump com.squareup.okhttp3:mockwebserver3 from 5.4.0 to 5.5.0 (#1327)\n\nBumps\n[com.squareup.okhttp3:mockwebserver3](https://github.com/lysine-dev/okhttp)\nfrom 5.4.0 to 5.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md\"\u003ecom.squareup.okhttp3:mockwebserver3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 5.5.0\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003e2026-08-16\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003eThis release introduces \u003cstrong\u003eopt-in\u003c/strong\u003e support for\n[Encrypted Client Hello (ECH)]. This new feature\nimproves user privacy by encrypting domain names in transit. With\nregular TLS, your coffee shop’s\nWi-Fi router can see that you’re visiting \u003cem\u003ewikipedia.com\u003c/em\u003e, but it\ncannot see which page you’re\nlooking at. With ECH, the router observes only the IP address. This\nadditional privacy is most\neffective on sites hosted by big CDNs because the IP address doesn’t\nimply a particular website.\u003c/p\u003e\n\u003cp\u003eThis requires ECH support in the platform’s TLS stack. Today this is\nonly Android 17 (API 37,\nreleased June 2026). When other TLS stacks add ECH support, we\u0027ll\nintegrate them.\u003c/p\u003e\n\u003cp\u003eECH took a lot of work to implement because the encryption keys are\npublished over DNS in the\n[HTTPS resource record], and we needed to write new code to fetch these\nrecords. This release\nincludes a major update to OkHttp’s DNS API: it now supports multiple\nresource record types (not\njust IP addresses!), asynchronous streaming results, and in-memory\ncaching.\u003c/p\u003e\n\u003cp\u003eTo opt in, you can use \u003ccode\u003eDnsOverHttps\u003c/code\u003e:\u003c/p\u003e\n\u003cpre lang\u003d\"kotlin\"\u003e\u003ccode\u003e// DnsOverHttps itself uses OkHttpClient. Build\nboth clients upon the\n// same bootstrap client so they share a connection pool and dispatcher.\nval bootstrapClient \u003d OkHttpClient()\n\u003cp\u003e// This sample uses Cloudflare\u0027s 1.1.1.1 DnsOverHttps service.\nval client \u003d bootstrapClient.newBuilder()\n.dns(DnsOverHttps.Builder()\n.client(bootstrapClient)\n.url(\u0026quot;\u003ca\nhref\u003d\"https://1.1.1.1/dns-query\u0026amp;quot;.toHttpUrl()\"\u003ehttps://1.1.1.1/dns-query\u0026amp;quot;.toHttpUrl()\u003c/a\u003e)\n.build())\n.build()\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eYou could also opt in with our new \u003ccode\u003eAndroidDns\u003c/code\u003e API.\nUnfortunately, the privacy benefits of ECH are\nthwarted because its DNS queries are not encrypted by default.\u003c/p\u003e\n\u003cpre lang\u003d\"kotlin\"\u003e\u003ccode\u003e// AndroidDns fetches the HTTPS DNS resource\nrecords necessary for ECH.\nval client \u003d OkHttpClient.Builder()\n  .dns(AndroidDns())\n  .build()\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eNew: OkHttp artifacts are now signed with our [new signing key].\nThis project and three sibling\nprojects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the\nCommonhaus Foundation].\u003c/li\u003e\n\u003cli\u003eFix: MockWebServer’s \u003ccode\u003e@StartStop\u003c/code\u003e annotation now supports\n\u003ccode\u003e@Nested\u003c/code\u003e JUnit 5 tests.\u003c/li\u003e\n\u003cli\u003eFix: Our default TLS hostname verifier now reject hosts that fail IP\ncanonicalization.\u003c/li\u003e\n\u003cli\u003eFix: Closing a multipart part\u0027s sink no longer closes the entire\nrequest body.\u003c/li\u003e\n\u003cli\u003eFix: Flush HTTP/1 request bodies before detaching the timeout. We\nhad a bug where timeouts\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/a94bdf152084d11acecd44dcd09ffef203f4f0aa\"\u003e\u003ccode\u003ea94bdf1\u003c/code\u003e\u003c/a\u003e\nPrepare for release 5.5.0.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/ecc3b05adfe6b2607b8ec251562c2cccf7c1923a\"\u003e\u003ccode\u003eecc3b05\u003c/code\u003e\u003c/a\u003e\nUse a fixed size for DoH request body (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9687\"\u003e#9687\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/9926082660dfa6f1cc848c6f465cf5ccb998e415\"\u003e\u003ccode\u003e9926082\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Use a fixed size for DoH request body\u0026quot; (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9686\"\u003e#9686\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/0070c2e7b4c162ee03abf1c88fd94083e94697f4\"\u003e\u003ccode\u003e0070c2e\u003c/code\u003e\u003c/a\u003e\nUse a fixed size for DoH request body\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/15764539c69842dad607462f102a2507223dbfe7\"\u003e\u003ccode\u003e1576453\u003c/code\u003e\u003c/a\u003e\nOrder ServiceMetadata records per the spec (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9683\"\u003e#9683\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/fb582e976a9a82d691342a4d57b3c72208ce416c\"\u003e\u003ccode\u003efb582e9\u003c/code\u003e\u003c/a\u003e\nFlip wiring of Dns.SYSTEM (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9682\"\u003e#9682\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/4e884abb1a207c321acffb070c476acb4b89fa3f\"\u003e\u003ccode\u003e4e884ab\u003c/code\u003e\u003c/a\u003e\nretryOnConnectionFailure doesn\u0027t impact ECH retries (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9681\"\u003e#9681\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/0433cee8131b63fa2c0634fa2f9b3a01f9a8b1f3\"\u003e\u003ccode\u003e0433cee\u003c/code\u003e\u003c/a\u003e\nOnly one contributing.md doc (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9678\"\u003e#9678\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/a2cf5aa9f8711dabe514871e9dc4a9336a0e403f\"\u003e\u003ccode\u003ea2cf5aa\u003c/code\u003e\u003c/a\u003e\nDon\u0027t recover after an ECH public_name fails to verify (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9680\"\u003e#9680\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/commit/5410de9760bce8719129c3d08eb19e5bace75f6e\"\u003e\u003ccode\u003e5410de9\u003c/code\u003e\u003c/a\u003e\nTest ECH + HTTP proxy (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okhttp/issues/9671\"\u003e#9671\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/lysine-dev/okhttp/compare/parent-5.4.0...parent-5.5.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjbonofre@apache.org\u003e"
    },
    {
      "commit": "ba9f2e3626b1fb15a0fb7c68fa405730234d8cce",
      "tree": "e4f5b13559bf89625d9b3a5d0b78d53703932f83",
      "parents": [
        "59ecb0c49e4515633d1447c55e7241fcf829fe44"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 13:16:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 13:16:26 2026 +0200"
      },
      "message": "MINOR: Bump logback.version from 1.6.3 to 1.6.5 (#1322)"
    },
    {
      "commit": "59ecb0c49e4515633d1447c55e7241fcf829fe44",
      "tree": "ea0b13b6fe5a1e594a042900ed75a59b058996ae",
      "parents": [
        "e479da4801fef03855fe377f04e66026f3e0213c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 09:29:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 09:29:47 2026 +0200"
      },
      "message": "MINOR: Bump parquet.version from 1.18.0 to 1.18.1 (#1323)"
    },
    {
      "commit": "e479da4801fef03855fe377f04e66026f3e0213c",
      "tree": "ddd13c3ddc39d7dd4e2f818419e9ecbcce318b9e",
      "parents": [
        "faca9d07fddde1a4f1f6eddac727228291e5cfa3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 09:29:09 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 09:29:09 2026 +0200"
      },
      "message": "MINOR: Bump org.bouncycastle:bcpkix-jdk18on from 1.85 to 1.86 (#1325)"
    },
    {
      "commit": "faca9d07fddde1a4f1f6eddac727228291e5cfa3",
      "tree": "4aa56a5ff676555a97122cdf56b9ca357593befc",
      "parents": [
        "bad4d7322fd4a69aaef8de09bfa43a620631c0f3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 09:28:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 09:28:38 2026 +0200"
      },
      "message": "MINOR: Bump org.codehaus.mojo:versions-maven-plugin from 2.21.0 to 2.22.0 (#1326)"
    },
    {
      "commit": "bad4d7322fd4a69aaef8de09bfa43a620631c0f3",
      "tree": "c15b7f64e343ac6965b2c580ed49bc23f20f5a6f",
      "parents": [
        "f082405139fe77c3635c0503720c9f76fff99243"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 09:26:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 09:26:47 2026 +0200"
      },
      "message": "MINOR: Bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0 (#1328)"
    },
    {
      "commit": "f082405139fe77c3635c0503720c9f76fff99243",
      "tree": "9d4c21586e3edb8aa5e5a4c50b6d7bfa2160c530",
      "parents": [
        "96a23dd87f398ee9871880e5b837651b3fd03587"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 09:26:05 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 09:26:05 2026 +0200"
      },
      "message": "MINOR: Bump checker.framework.version from 4.2.1 to 4.3.0 (#1329)"
    },
    {
      "commit": "96a23dd87f398ee9871880e5b837651b3fd03587",
      "tree": "143509b485535f74113df0fe43fcce53d6ab0022",
      "parents": [
        "3eaed33885d135b0483d9538aa996dc6f742d73f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 09:23:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 09:23:26 2026 +0200"
      },
      "message": "MINOR: Bump io.grpc:grpc-bom from 1.83.1 to 1.84.0 (#1330)"
    },
    {
      "commit": "3eaed33885d135b0483d9538aa996dc6f742d73f",
      "tree": "0ba963997d603442b87f56b69c1f54b7abcf0adb",
      "parents": [
        "2d9f1359d66767ff8330aa92b4668a304efef4d8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 05 09:22:52 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Oct 05 09:22:52 2026 +0200"
      },
      "message": "MINOR: Bump com.squareup.okhttp3:mockwebserver3-junit5 from 5.4.0 to 5.5.0 (#1331)"
    },
    {
      "commit": "2d9f1359d66767ff8330aa92b4668a304efef4d8",
      "tree": "2329e15d999d5dd36a0cd3201cf752216656cddb",
      "parents": [
        "f804f90748345cb0d19d16c31c81d8c9ac5f21ad"
      ],
      "author": {
        "name": "David Li",
        "email": "li.davidm96@gmail.com",
        "time": "Sun Oct 04 17:49:10 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 17:49:10 2026 -0700"
      },
      "message": "GH-1217: Bounds check before alloc in var-width view vectors (#1291)\n\nAlso, document that when enable_unsafe_memory_access is enabled, all\nbets are off.\n\nReported by n0mi1k."
    },
    {
      "commit": "f804f90748345cb0d19d16c31c81d8c9ac5f21ad",
      "tree": "d8c0266304377e4eecf8399382d4091b467095c6",
      "parents": [
        "c3dc4605e47b31fea9870d81f40c498f57660dd4"
      ],
      "author": {
        "name": "hutiefang76",
        "email": "137664623+hutiefang76@users.noreply.github.com",
        "time": "Sun Oct 04 23:05:53 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 17:05:53 2026 +0200"
      },
      "message": "GH-812: Fix appending to an empty UnionVector (#1292)\n\n## What\u0027s Changed\n\nAppending to a newly created `UnionVector` repeatedly reallocates its\ntype buffer until allocation fails: its value capacity remains zero\nuntil it has child vectors. Check the type buffer capacity at this\nstage, since the existing append loop creates and expands the child\nvectors afterward.\n\nThe regression appends two floats to an empty union with a bounded\nallocator. It fails before the change with an allocation error and\npasses afterward. All 32 `TestVectorAppender` tests pass with both the\nNetty and Unsafe allocators on JDK 21. Checkstyle and Spotless also\npass.\n\nCloses #812.\n\nValidation (JDK 21):\n\n```sh\nmvn -B -pl vector -am test -Dtest\u003dTestVectorAppender -Dsurefire.failIfNoSpecifiedTests\u003dfalse\nmvn -B -pl vector spotless:check\n```\n\nDeveloped with AI assistance; the regression was verified to fail before\nthe fix and pass afterward."
    },
    {
      "commit": "c3dc4605e47b31fea9870d81f40c498f57660dd4",
      "tree": "96a57ad6bf63b3b884ee08233017f0bd23bac6a8",
      "parents": [
        "e49c4be9cb4bb90f96430df8c2401fdaae0c784a"
      ],
      "author": {
        "name": "Xin Sun",
        "email": "ddupgs@gmail.com",
        "time": "Sun Oct 04 23:05:28 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 17:05:28 2026 +0200"
      },
      "message": "GH-1302: Add support for the arrow.json extension type (#1303)\n\nAdds `JsonType` and `JsonVector` for the canonical `arrow.json`\nextension, backed by `Utf8`, `LargeUtf8`, or `Utf8View`.\n\nIncludes metadata handling, registration, and vector transfers that\npreserve the extension type. IPC loading and unloading now inspect the\nunderlying vector when counting view buffers, so JSON backed by\n`Utf8View` can round-trip correctly.\n\nCloses #1302."
    },
    {
      "commit": "e49c4be9cb4bb90f96430df8c2401fdaae0c784a",
      "tree": "9f88b9cde3d56f8d567f6bee3f7f2c74a078f15b",
      "parents": [
        "3b2fd1a51acfab42e0a649f727f412599cc83692"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sun Oct 04 16:21:25 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 16:21:25 2026 +0200"
      },
      "message": "MINOR: Bump org.apache.derby:derby from 10.15.2.0 to 10.16.1.1 in /flight/flight-sql (#1321)\n\n### Rationale for this change\n\nBumps `org.apache.derby:derby` from 10.15.2.0 to 10.16.1.1 in\n`/flight/flight-sql`.\nDerby 10.17+ requires Java 21+, which is incompatible with Arrow Java\u0027s\nJava 17 baseline. Derby 10.16.1.1 is the highest version that supports\nJava 17.\n\nThis PR also updates the expected Derby version string in\n`TestFlightSql.java` to match Derby 10.16.1.1.\n\n### What changes are included in this PR?\n\n* Bump `org.apache.derby:derby` from 10.15.2.0 to 10.16.1.1 in\n`flight/flight-sql/pom.xml`.\n* Update expected version strings in `TestFlightSql.java` to `10.16.1.1\n- (1901046)`.\n\n### Are these changes tested?\n\nYes, verified with `TestFlightSql` and `TestFlightSqlStateless`.\n\n### Are there any user-facing changes?\n\nNo."
    },
    {
      "commit": "3b2fd1a51acfab42e0a649f727f412599cc83692",
      "tree": "bbd01677b3dc55ddd09e358a987c325bc94f2e5b",
      "parents": [
        "61bd5ecf2560047209a5481409296a84dbbd9a6b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Oct 04 16:21:11 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 16:21:11 2026 +0200"
      },
      "message": "MINOR: Bump parquet.version from 1.17.1 to 1.18.0 (#1277)\n\nBumps `parquet.version` from 1.17.1 to 1.18.0.\nUpdates `org.apache.parquet:parquet-avro` from 1.17.1 to 1.18.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/releases\"\u003eorg.apache.parquet:parquet-avro\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet 1.18.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMINOR: Fix error message in SimpleGroup.add() for Binary by \u003ca\nhref\u003d\"https://github.com/takezoe\"\u003e\u003ccode\u003e@​takezoe\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3385\"\u003eapache/parquet-java#3385\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] remove comment from pom.xml by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3382\"\u003eapache/parquet-java#3382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: \u003ccode\u003eci-before_install.sh\u003c/code\u003e should show wget errors and\nretry by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3381\"\u003eapache/parquet-java#3381\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: Upgrade spotless plugin by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3380\"\u003eapache/parquet-java#3380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] Move on from java8 for three core modules by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3379\"\u003eapache/parquet-java#3379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: \u003ccode\u003ejapicmp\u003c/code\u003e checks are failing after Java 11 release\nby \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3388\"\u003eapache/parquet-java#3388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: Bump version to 1.18.0-SNAPSHOT by \u003ca\nhref\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e@​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3389\"\u003eapache/parquet-java#3389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3372\"\u003eGH-3372\u003c/a\u003e:\nEnhance ColumnSizeCommand to sort by size by \u003ca\nhref\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e@​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3371\"\u003eapache/parquet-java#3371\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3399\"\u003eGH-3399\u003c/a\u003e:\nHint IDE the source code generated by thrift by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3400\"\u003eapache/parquet-java#3400\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3387\"\u003eGH-3387\u003c/a\u003e:\nbump aircompressor to mitigate CVE-2025-67721 by \u003ca\nhref\u003d\"https://github.com/olegbonar\"\u003e\u003ccode\u003e@​olegbonar\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3403\"\u003eapache/parquet-java#3403\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3383\"\u003eGH-3383\u003c/a\u003e:\nModernize mockito by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3384\"\u003eapache/parquet-java#3384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3404\"\u003eGH-3404\u003c/a\u003e:\nfix CI TestByteBitPacking512VectorLE.unpackValuesUsingVector randomly\noom by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3405\"\u003eapache/parquet-java#3405\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3401\"\u003eGH-3401\u003c/a\u003e:\nRemove redundant MAP_KEY_VALUE annotation at middle level of logical\ntype map by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3402\"\u003eapache/parquet-java#3402\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3406\"\u003eGH-3406\u003c/a\u003e:\nfix Float16 statistics handling for NaN and zero values by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3407\"\u003eapache/parquet-java#3407\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3215\"\u003eGH-3215\u003c/a\u003e:\nSort the list of org.apache.parquet.format.Encoding created … by \u003ca\nhref\u003d\"https://github.com/mbrannstrom\"\u003e\u003ccode\u003e@​mbrannstrom\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3413\"\u003eapache/parquet-java#3413\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump dependabot limit by \u003ca\nhref\u003d\"https://github.com/Fokko\"\u003e\u003ccode\u003e@​Fokko\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3416\"\u003eapache/parquet-java#3416\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.21.0 to 5.22.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3436\"\u003eapache/parquet-java#3436\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache:apache from 33 to 37 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3431\"\u003eapache/parquet-java#3431\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.33.2 to 4.34.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3441\"\u003eapache/parquet-java#3441\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.luben:zstd-jni from 1.5.7-3 to 1.5.7-7 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3442\"\u003eapache/parquet-java#3442\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-shade-plugin from 3.6.0 to 3.6.2\nby \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3430\"\u003eapache/parquet-java#3430\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.xerial.snappy:snappy-java from 1.1.10.7 to 1.1.10.8 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3426\"\u003eapache/parquet-java#3426\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.6.3 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3440\"\u003eapache/parquet-java#3440\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.parquet:parquet-pig from 1.15.0 to 1.15.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3420\"\u003eapache/parquet-java#3420\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-logging:commons-logging from 1.3.5 to 1.3.6 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3418\"\u003eapache/parquet-java#3418\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.re2j:re2j from 1.7 to 1.8 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3433\"\u003eapache/parquet-java#3433\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3429\"\u003eapache/parquet-java#3429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3411\"\u003eGH-3411\u003c/a\u003e\nExpose row group index via Parquet reader by \u003ca\nhref\u003d\"https://github.com/uros7251brick\"\u003e\u003ccode\u003e@​uros7251brick\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3412\"\u003eapache/parquet-java#3412\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.22.0 to 5.23.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3445\"\u003eapache/parquet-java#3445\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump net.openhft:zero-allocation-hashing from 0.27ea0 to 0.27ea1 by\n\u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3419\"\u003eapache/parquet-java#3419\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.tukaani:xz from 1.10 to 1.12 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3417\"\u003eapache/parquet-java#3417\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump it.unimi.dsi:fastutil from 8.5.15 to 8.5.18 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3422\"\u003eapache/parquet-java#3422\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-text from 1.13.1 to 1.15.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3438\"\u003eapache/parquet-java#3438\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3449\"\u003eGH-3449\u003c/a\u003e:\nFix BinaryStats int overflow by \u003ca\nhref\u003d\"https://github.com/Jiayi-Wang-db\"\u003e\u003ccode\u003e@​Jiayi-Wang-db\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3448\"\u003eapache/parquet-java#3448\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.34.0 to 4.34.1 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3453\"\u003eapache/parquet-java#3453\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.arrow:arrow-vector from 17.0.0 to 19.0.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3454\"\u003eapache/parquet-java#3454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3410\"\u003eGH-3410\u003c/a\u003e:\nBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca\nhref\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e@​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to\n0.25.4 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3437\"\u003eapache/parquet-java#3437\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.4 to\n0.25.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3473\"\u003eapache/parquet-java#3473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.5 to\n0.25.6 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3491\"\u003eapache/parquet-java#3491\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3492\"\u003eapache/parquet-java#3492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3011\"\u003eGH-3011\u003c/a\u003e:\nDeny further writes after InternalParquetRecordWriter is aborted by \u003ca\nhref\u003d\"https://github.com/LuciferYang\"\u003e\u003ccode\u003e@​LuciferYang\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3450\"\u003eapache/parquet-java#3450\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3461\"\u003eGH-3461\u003c/a\u003e:\nAvoid unnecessary debug logging overhead in record write hot path by \u003ca\nhref\u003d\"https://github.com/arouel\"\u003e\u003ccode\u003e@​arouel\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3462\"\u003eapache/parquet-java#3462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3408\"\u003eGH-3408\u003c/a\u003e\nAdd support for stale PR workflow by \u003ca\nhref\u003d\"https://github.com/ArnavBalyan\"\u003e\u003ccode\u003e@​ArnavBalyan\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3409\"\u003eapache/parquet-java#3409\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove Parquet-Pig by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3377\"\u003eapache/parquet-java#3377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.api.grpc:proto-google-common-protos from 2.59.2 to\n2.68.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3474\"\u003eapache/parquet-java#3474\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-dependency-plugin from 3.8.1 to\n3.10.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3425\"\u003eapache/parquet-java#3425\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/0209dfb48d153f2f3e49a9f12addebe15c0f1d77\"\u003e\u003ccode\u003e0209dfb\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release apache-parquet-1.18.0-rc2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/ac007fe19f9426dca3e3158fec217c9ca7af320f\"\u003e\u003ccode\u003eac007fe\u003c/code\u003e\u003c/a\u003e\nPARQUET-2249: Write IEEE 754 total order by default (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3699\"\u003e#3699\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/2c9fbb360e32cf19045f68ac27eee9b593c966f5\"\u003e\u003ccode\u003e2c9fbb3\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3574\"\u003eGH-3574\u003c/a\u003e:\nStatistics.toParquetStatistics always set null_count(\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3575\"\u003e#3575\u003c/a\u003e)\u0026quot;...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/ed6aa0594d6fafbe12c55da0ee31c25d25f722c0\"\u003e\u003ccode\u003eed6aa05\u003c/code\u003e\u003c/a\u003e\nMINOR: Verify LICENSE and NOTICE in published JARs (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3689\"\u003e#3689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/24ee4d34ec690fa62854eebc87952867d04bdfc9\"\u003e\u003ccode\u003e24ee4d3\u003c/code\u003e\u003c/a\u003e\nPARQUET: Include license files in packaged JARs (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3686\"\u003e#3686\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/15fdfc1dfc62c9006d15453b70ea35176b69c208\"\u003e\u003ccode\u003e15fdfc1\u003c/code\u003e\u003c/a\u003e\nchore: Update copyright year in NOTICE file (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3685\"\u003e#3685\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/83c2c80d49c57b1ae180df45229ee01dbceddc1e\"\u003e\u003ccode\u003e83c2c80\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3618\"\u003eGH-3618\u003c/a\u003e:\nBan JUnit4 imports (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3681\"\u003e#3681\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/a52c34bfa26fa5c2fb4f7bcb829b1f76e5b4b62b\"\u003e\u003ccode\u003ea52c34b\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3618\"\u003eGH-3618\u003c/a\u003e\nMigrate parquet-hadoop to JUnit5 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3676\"\u003e#3676\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/49843ee14003a8ee31e374d6fb90370d9461935c\"\u003e\u003ccode\u003e49843ee\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/5e2ad0969c7f411613671c5ef054d399995de5f9\"\u003e\u003ccode\u003e5e2ad09\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release apache-parquet-1.18.0-rc1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.1...apache-parquet-1.18.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `org.apache.parquet:parquet-hadoop` from 1.17.1 to 1.18.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/releases\"\u003eorg.apache.parquet:parquet-hadoop\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet 1.18.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMINOR: Fix error message in SimpleGroup.add() for Binary by \u003ca\nhref\u003d\"https://github.com/takezoe\"\u003e\u003ccode\u003e@​takezoe\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3385\"\u003eapache/parquet-java#3385\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] remove comment from pom.xml by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3382\"\u003eapache/parquet-java#3382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: \u003ccode\u003eci-before_install.sh\u003c/code\u003e should show wget errors and\nretry by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3381\"\u003eapache/parquet-java#3381\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: Upgrade spotless plugin by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3380\"\u003eapache/parquet-java#3380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] Move on from java8 for three core modules by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3379\"\u003eapache/parquet-java#3379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: \u003ccode\u003ejapicmp\u003c/code\u003e checks are failing after Java 11 release\nby \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3388\"\u003eapache/parquet-java#3388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: Bump version to 1.18.0-SNAPSHOT by \u003ca\nhref\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e@​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3389\"\u003eapache/parquet-java#3389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3372\"\u003eGH-3372\u003c/a\u003e:\nEnhance ColumnSizeCommand to sort by size by \u003ca\nhref\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e@​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3371\"\u003eapache/parquet-java#3371\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3399\"\u003eGH-3399\u003c/a\u003e:\nHint IDE the source code generated by thrift by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3400\"\u003eapache/parquet-java#3400\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3387\"\u003eGH-3387\u003c/a\u003e:\nbump aircompressor to mitigate CVE-2025-67721 by \u003ca\nhref\u003d\"https://github.com/olegbonar\"\u003e\u003ccode\u003e@​olegbonar\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3403\"\u003eapache/parquet-java#3403\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3383\"\u003eGH-3383\u003c/a\u003e:\nModernize mockito by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3384\"\u003eapache/parquet-java#3384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3404\"\u003eGH-3404\u003c/a\u003e:\nfix CI TestByteBitPacking512VectorLE.unpackValuesUsingVector randomly\noom by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3405\"\u003eapache/parquet-java#3405\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3401\"\u003eGH-3401\u003c/a\u003e:\nRemove redundant MAP_KEY_VALUE annotation at middle level of logical\ntype map by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3402\"\u003eapache/parquet-java#3402\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3406\"\u003eGH-3406\u003c/a\u003e:\nfix Float16 statistics handling for NaN and zero values by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3407\"\u003eapache/parquet-java#3407\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3215\"\u003eGH-3215\u003c/a\u003e:\nSort the list of org.apache.parquet.format.Encoding created … by \u003ca\nhref\u003d\"https://github.com/mbrannstrom\"\u003e\u003ccode\u003e@​mbrannstrom\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3413\"\u003eapache/parquet-java#3413\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump dependabot limit by \u003ca\nhref\u003d\"https://github.com/Fokko\"\u003e\u003ccode\u003e@​Fokko\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3416\"\u003eapache/parquet-java#3416\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.21.0 to 5.22.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3436\"\u003eapache/parquet-java#3436\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache:apache from 33 to 37 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3431\"\u003eapache/parquet-java#3431\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.33.2 to 4.34.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3441\"\u003eapache/parquet-java#3441\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.luben:zstd-jni from 1.5.7-3 to 1.5.7-7 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3442\"\u003eapache/parquet-java#3442\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-shade-plugin from 3.6.0 to 3.6.2\nby \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3430\"\u003eapache/parquet-java#3430\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.xerial.snappy:snappy-java from 1.1.10.7 to 1.1.10.8 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3426\"\u003eapache/parquet-java#3426\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.6.3 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3440\"\u003eapache/parquet-java#3440\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.parquet:parquet-pig from 1.15.0 to 1.15.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3420\"\u003eapache/parquet-java#3420\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-logging:commons-logging from 1.3.5 to 1.3.6 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3418\"\u003eapache/parquet-java#3418\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.re2j:re2j from 1.7 to 1.8 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3433\"\u003eapache/parquet-java#3433\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3429\"\u003eapache/parquet-java#3429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3411\"\u003eGH-3411\u003c/a\u003e\nExpose row group index via Parquet reader by \u003ca\nhref\u003d\"https://github.com/uros7251brick\"\u003e\u003ccode\u003e@​uros7251brick\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3412\"\u003eapache/parquet-java#3412\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.22.0 to 5.23.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3445\"\u003eapache/parquet-java#3445\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump net.openhft:zero-allocation-hashing from 0.27ea0 to 0.27ea1 by\n\u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3419\"\u003eapache/parquet-java#3419\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.tukaani:xz from 1.10 to 1.12 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3417\"\u003eapache/parquet-java#3417\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump it.unimi.dsi:fastutil from 8.5.15 to 8.5.18 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3422\"\u003eapache/parquet-java#3422\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-text from 1.13.1 to 1.15.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3438\"\u003eapache/parquet-java#3438\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3449\"\u003eGH-3449\u003c/a\u003e:\nFix BinaryStats int overflow by \u003ca\nhref\u003d\"https://github.com/Jiayi-Wang-db\"\u003e\u003ccode\u003e@​Jiayi-Wang-db\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3448\"\u003eapache/parquet-java#3448\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.34.0 to 4.34.1 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3453\"\u003eapache/parquet-java#3453\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.arrow:arrow-vector from 17.0.0 to 19.0.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3454\"\u003eapache/parquet-java#3454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3410\"\u003eGH-3410\u003c/a\u003e:\nBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca\nhref\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e@​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to\n0.25.4 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3437\"\u003eapache/parquet-java#3437\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.4 to\n0.25.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3473\"\u003eapache/parquet-java#3473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.5 to\n0.25.6 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3491\"\u003eapache/parquet-java#3491\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3492\"\u003eapache/parquet-java#3492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3011\"\u003eGH-3011\u003c/a\u003e:\nDeny further writes after InternalParquetRecordWriter is aborted by \u003ca\nhref\u003d\"https://github.com/LuciferYang\"\u003e\u003ccode\u003e@​LuciferYang\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3450\"\u003eapache/parquet-java#3450\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3461\"\u003eGH-3461\u003c/a\u003e:\nAvoid unnecessary debug logging overhead in record write hot path by \u003ca\nhref\u003d\"https://github.com/arouel\"\u003e\u003ccode\u003e@​arouel\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3462\"\u003eapache/parquet-java#3462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3408\"\u003eGH-3408\u003c/a\u003e\nAdd support for stale PR workflow by \u003ca\nhref\u003d\"https://github.com/ArnavBalyan\"\u003e\u003ccode\u003e@​ArnavBalyan\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3409\"\u003eapache/parquet-java#3409\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove Parquet-Pig by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3377\"\u003eapache/parquet-java#3377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.api.grpc:proto-google-common-protos from 2.59.2 to\n2.68.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3474\"\u003eapache/parquet-java#3474\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-dependency-plugin from 3.8.1 to\n3.10.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3425\"\u003eapache/parquet-java#3425\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/0209dfb48d153f2f3e49a9f12addebe15c0f1d77\"\u003e\u003ccode\u003e0209dfb\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release apache-parquet-1.18.0-rc2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/ac007fe19f9426dca3e3158fec217c9ca7af320f\"\u003e\u003ccode\u003eac007fe\u003c/code\u003e\u003c/a\u003e\nPARQUET-2249: Write IEEE 754 total order by default (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3699\"\u003e#3699\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/2c9fbb360e32cf19045f68ac27eee9b593c966f5\"\u003e\u003ccode\u003e2c9fbb3\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3574\"\u003eGH-3574\u003c/a\u003e:\nStatistics.toParquetStatistics always set null_count(\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3575\"\u003e#3575\u003c/a\u003e)\u0026quot;...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/ed6aa0594d6fafbe12c55da0ee31c25d25f722c0\"\u003e\u003ccode\u003eed6aa05\u003c/code\u003e\u003c/a\u003e\nMINOR: Verify LICENSE and NOTICE in published JARs (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3689\"\u003e#3689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/24ee4d34ec690fa62854eebc87952867d04bdfc9\"\u003e\u003ccode\u003e24ee4d3\u003c/code\u003e\u003c/a\u003e\nPARQUET: Include license files in packaged JARs (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3686\"\u003e#3686\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/15fdfc1dfc62c9006d15453b70ea35176b69c208\"\u003e\u003ccode\u003e15fdfc1\u003c/code\u003e\u003c/a\u003e\nchore: Update copyright year in NOTICE file (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3685\"\u003e#3685\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/83c2c80d49c57b1ae180df45229ee01dbceddc1e\"\u003e\u003ccode\u003e83c2c80\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3618\"\u003eGH-3618\u003c/a\u003e:\nBan JUnit4 imports (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3681\"\u003e#3681\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/a52c34bfa26fa5c2fb4f7bcb829b1f76e5b4b62b\"\u003e\u003ccode\u003ea52c34b\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3618\"\u003eGH-3618\u003c/a\u003e\nMigrate parquet-hadoop to JUnit5 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3676\"\u003e#3676\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/49843ee14003a8ee31e374d6fb90370d9461935c\"\u003e\u003ccode\u003e49843ee\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/5e2ad0969c7f411613671c5ef054d399995de5f9\"\u003e\u003ccode\u003e5e2ad09\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release apache-parquet-1.18.0-rc1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.1...apache-parquet-1.18.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nYou can trigger a rebase of this PR by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has\nbeen open for over 30 days.\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "61bd5ecf2560047209a5481409296a84dbbd9a6b",
      "tree": "59e32b3b3846a834a598dac402372eebba12b86e",
      "parents": [
        "d62da79348f61b9d46e109d3f1e04678c47c6133"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Oct 04 15:19:19 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 15:19:19 2026 +0200"
      },
      "message": "MINOR: Bump org.apache:apache from 38 to 40 (#1225)\n\nBumps [org.apache:apache](https://github.com/apache/maven-apache-parent)\nfrom 38 to 40.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/apache/maven-apache-parent/releases\"\u003eorg.apache:apache\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e40\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e:boom: Breaking changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReplace nicoulaj checksum plugin with maveniverse checksum plugin\n(\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/599\"\u003e#599\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e@​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/issues/586\"\u003e#586\u003c/a\u003e:\nUse RAT0.18 and remove commons-lang3 configuration for JDK25 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/587\"\u003e#587\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/ottlinger\"\u003e\u003ccode\u003e@​ottlinger\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eProperty \u003ccode\u003eversion.maven-surefire\u003c/code\u003e was removed in \u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/588\"\u003eapache/maven-apache-parent#588\u003c/a\u003e,\nshould be replaced by \u003ccode\u003eversion.maven-surefire-plugin\u003c/code\u003e,\n\u003ccode\u003eversion.maven-failsafe-plugin\u003c/code\u003e or\n\u003ccode\u003eversion.maven-surefire-report-plugin\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix several version property issues (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/588\"\u003e#588\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/ctubbsii\"\u003e\u003ccode\u003e@​ctubbsii\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📝 Documentation updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate documentation for push-to-atr profile (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/613\"\u003e#613\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e@​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRestore the common wording on the download page (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/596\"\u003e#596\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e@​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd local maven configuration for ATR project name override (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/614\"\u003e#614\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e@​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove custom name-template for release-drafter (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/604\"\u003e#604\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e@​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePort the site documentation from APT to Markdown (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/595\"\u003e#595\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e@​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to\n3.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/612\"\u003e#612\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to\n3.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/611\"\u003e#611\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-plugin-tools from 3.15.2 to\n3.16.0 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/610\"\u003e#610\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e@​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump surefire-plugin, failsafe-plugin, surefire-report-plugin from\n3.5.6 to 3.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/605\"\u003e#605\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e@​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.tooling:atr-maven-plugin from 1.0.0-alpha-1 to\n1.0.0-beta-1 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/598\"\u003e#598\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to\n3.16.0 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/600\"\u003e#600\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/issues/586\"\u003e#586\u003c/a\u003e:\nUse RAT0.18 and remove commons-lang3 configuration for JDK25 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/587\"\u003e#587\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/ottlinger\"\u003e\u003ccode\u003e@​ottlinger\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1\n(\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/594\"\u003e#594\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump\napache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\nfrom 4 to 5 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/591\"\u003e#591\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump\napache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from\n4 to 5 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/593\"\u003e#593\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump apache/maven-gh-actions-shared/.github/workflows/stale.yml from\n4 to 5 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/592\"\u003e#592\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump\napache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4\nto 5 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/590\"\u003e#590\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-help-plugin from 3.5.1 to 3.5.2\n(\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/589\"\u003e#589\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e39\u003c/h2\u003e\n\u003cp\u003esee \u003ccode\u003epush-to-atr\u003c/code\u003e profile integration documentation for\nmore details:\n\u003ca\nhref\u003d\"https://maven.apache.org/pom/asf/#the-push-to-atr-profile\"\u003ehttps://maven.apache.org/pom/asf/#the-push-to-atr-profile\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eadd push-to-atr profile (\u003ca\nhref\u003d\"https://redirect.github.com/apache/maven-apache-parent/pull/584\"\u003e#584\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/hboutemy\"\u003e\u003ccode\u003e@​hboutemy\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/apache/maven-apache-parent/commits\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has\nbeen open for over 30 days.\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjb.onofre@dremio.com\u003e"
    },
    {
      "commit": "d62da79348f61b9d46e109d3f1e04678c47c6133",
      "tree": "838d865bf0793891bc56c1f149a386cd559fc627",
      "parents": [
        "4aed2995fd09f4ca13c0f95ab5426a2ba45fb5ff"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Oct 04 08:45:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 08:45:55 2026 +0200"
      },
      "message": "MINOR: Bump org.apache.calcite.avatica:avatica from 1.27.0 to 1.28.0 (#1165)\n\nBumps\n[org.apache.calcite.avatica:avatica](https://github.com/apache/calcite-avatica)\nfrom 1.27.0 to 1.28.0.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/7d3662669f9b8a267931496bdd254c8942f8d42f\"\u003e\u003ccode\u003e7d36626\u003c/code\u003e\u003c/a\u003e\n[CALCITE-7495] Release Avatica 1.28.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/849b19e1f2f2d4a75358cef9d7cd4f8cd446f182\"\u003e\u003ccode\u003e849b19e\u003c/code\u003e\u003c/a\u003e\n[CALCITE-7507] NPE in ReleaseExtension.\u0026lt;init\u0026gt; when building from\nsources\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/4e1cbcc42ca22ee784dc1022445ccd13895c35ba\"\u003e\u003ccode\u003e4e1cbcc\u003c/code\u003e\u003c/a\u003e\n[CALCITE-7500] Add support for jdk 24 in CI\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/9efbff828397c7cfb9a5885aa06d94da8d2262dc\"\u003e\u003ccode\u003e9efbff8\u003c/code\u003e\u003c/a\u003e\n[CALCITE-6781] The isUpdateCapable method of calcite.avatica will\nincorrectly...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/49e231653f844022590803db7db06658eb2d7978\"\u003e\u003ccode\u003e49e2316\u003c/code\u003e\u003c/a\u003e\n[CALCITE-7329] Remove slf4j-api from avatica-shadow jar\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/2f226e0bf436c6118db83813d7fbab249ad3177c\"\u003e\u003ccode\u003e2f226e0\u003c/code\u003e\u003c/a\u003e\nBump addressable from 2.8.7 to 2.9.0 in /site\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/0b78b9cb2b16e9d3ad7ba9a6375c126ee4eb0058\"\u003e\u003ccode\u003e0b78b9c\u003c/code\u003e\u003c/a\u003e\n[CALCITE-7459] Upgrade Jackson in Avatica to 2.18.6 due to CVE\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/dc8a961d631213a12400e1067ccbd9fb4de49ec9\"\u003e\u003ccode\u003edc8a961\u003c/code\u003e\u003c/a\u003e\n[CALCITE-7449] DateTimeUtils.intervalDayTimeToString silently truncates\nlarge...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/8f2b775513ae82cec7cd2bf24b5ed88b57b20dfe\"\u003e\u003ccode\u003e8f2b775\u003c/code\u003e\u003c/a\u003e\n[CALCITE-7436] Add high-coverage Jazzer fuzzing for Avatica core\nmodules\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/commit/4acf635f365d31b94556f3f1b731375347282267\"\u003e\u003ccode\u003e4acf635\u003c/code\u003e\u003c/a\u003e\n[CALCITE-6135] BEARER authentication support\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/apache/calcite-avatica/compare/rel/avatica-1.27.0...rel/avatica-1.28.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has\nbeen open for over 30 days.\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nSigned-off-by: JB Onofré \u003cjbonofre@apache.org\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjbonofre@apache.org\u003e"
    },
    {
      "commit": "4aed2995fd09f4ca13c0f95ab5426a2ba45fb5ff",
      "tree": "d6df276a9d0fba1c717001de86fe39dbedbecfa5",
      "parents": [
        "70b149db730ba01d440546316fbec65ec91e8408"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sun Oct 04 06:53:24 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 06:53:24 2026 +0200"
      },
      "message": "MINOR: Use per-PR concurrency group in Dev PR workflow (#1320)\n\n## What\u0027s Changed\n\nThe `Dev PR` workflow runs on `pull_request_target`, where `github.ref`\nis the base branch (`refs/heads/main`), not the PR ref. Its concurrency\ngroup therefore resolved to `apache/arrow-java-refs/heads/main-Dev PR`\nfor every PR, and with `cancel-in-progress: true` a new run on one PR\ncancelled the run in progress on another.\n\nThis leaves a cancelled \"Ensure PR format\" check on the losing PR, which\nshows up as a failure. For example on #1295 the job was cancelled with:\n\n```\nCanceling since a higher priority waiting request for apache/arrow-java-refs/heads/main-Dev PR exists\n```\n\nThis change keys the concurrency group on the PR number, so runs are\nonly cancelled by newer runs of the same PR.\n\nNote that `pull_request_target` uses the workflow from the base branch,\nso this only takes effect once merged."
    },
    {
      "commit": "70b149db730ba01d440546316fbec65ec91e8408",
      "tree": "ffb9ea99ac896fed3b07f9524decd7c055a5d3de",
      "parents": [
        "1d8dc54ba0c80513adddf3f16508e4154f64e8e1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 03 15:03:53 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 03 15:03:53 2026 +0200"
      },
      "message": "MINOR: Bump com.squareup.okio:okio-jvm from 3.17.0 to 3.18.2 (#1295)\n\nBumps [com.squareup.okio:okio-jvm](https://github.com/lysine-dev/okio)\nfrom 3.17.0 to 3.18.2.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/blob/main/CHANGELOG.md\"\u003ecom.squareup.okio:okio-jvm\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.18.2\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003e2026-09-04\u003c/em\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix: Don\u0027t change behavior of base64-encoding. We introduced a bug\nin Okio 3.18.1 that caused\nbase64 strings to be encoded without padding, even though the previous\nand expected behavior is\nto encode such strings with padding (\u003ccode\u003e\u003d\u003c/code\u003e characters). The bug\nimpacts callers who compiled\nagainst Okio releases \u003ccode\u003e\u0026lt; 3.18.0\u003c/code\u003e, and executed on Okio\nreleases \u003ccode\u003e\u0026gt;\u003d 3.18\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.18.1\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003e2026-07-28\u003c/em\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix: Restore binary-compatibility with Okio 3.17.x for Kotlin/Native\nusers. When we introduced\nthe new \u003ccode\u003ebase64()\u003c/code\u003e function, we inadvertently changed the\nbinary signature! Ugh! This is now\nfixed and we\u0027ve automated binary-compatibility checking for\nKotlin/Native going forward.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.18.0\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003e2026-07-21\u003c/em\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix: Use wide character APIs to better support of non-UTF-8\nfilesystems on Windows.\u003c/li\u003e\n\u003cli\u003eFix: Don\u0027t crash in \u003ccode\u003eAssetFileSystem.exists()\u003c/code\u003e when the\nunderlying storage throws a\n\u003ccode\u003eFileNotFoundException\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFix: Load WASI paths relative to their \u003ccode\u003epreopen\u003c/code\u003e. The\nplatform behavior recently changed in\nNodeJS, causing our \u003ccode\u003eWasiFileSystem\u003c/code\u003e to be unable to access\nfiles!\u003c/li\u003e\n\u003cli\u003eNew: Optionally ignore whitespace when decoding hexadecimal.\u003c/li\u003e\n\u003cli\u003eNew: Optionally omit padding when encoding Base64.\u003c/li\u003e\n\u003cli\u003eNew: \u003ccode\u003eBufferedSource.readUInt()\u003c/code\u003e,\n\u003ccode\u003eBufferedSink.writeUInt()\u003c/code\u003e, and similar functions for\n\u003ccode\u003eUByte\u003c/code\u003e,\n\u003ccode\u003eUShort\u003c/code\u003e and \u003ccode\u003eULong\u003c/code\u003e. Also add support for\nunsigned and little-endian.\u003c/li\u003e\n\u003cli\u003eNew: \u003ccode\u003eBufferedSink.utf8Appendable()\u003c/code\u003e. Use this to adapt\nan Okio sink to an \u003ccode\u003eAppendable\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eNew: \u003ccode\u003eSource.limit()\u003c/code\u003e returns a wrapped source with a\nstrict limit on how many bytes are\nreturned.\u003c/li\u003e\n\u003cli\u003eNew: \u003ccode\u003eByteString.equals(other, constantTime)\u003c/code\u003e for subtle\ndefense against timing attacks.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/9403a094ac98d5a6ba8bad4ec3301399796fad67\"\u003e\u003ccode\u003e9403a09\u003c/code\u003e\u003c/a\u003e\nPrepare for release 3.18.2.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/5a1c1538b13cf55897d33c05b2fe2e5e2cdeef53\"\u003e\u003ccode\u003e5a1c153\u003c/code\u003e\u003c/a\u003e\nFix an unintended behavior change with base64 padding (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1869\"\u003e#1869\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/9f564fd76310120e35b4ffb94b62d6ab2a26207d\"\u003e\u003ccode\u003e9f564fd\u003c/code\u003e\u003c/a\u003e\nPrepare for release 3.18.1.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/531cf07b8ebe140d85448efd6ddff062c13ef317\"\u003e\u003ccode\u003e531cf07\u003c/code\u003e\u003c/a\u003e\nHide some accidentally public symbols (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1839\"\u003e#1839\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/e7ef43d4d5bd421a51daee9d81ed742a702d0675\"\u003e\u003ccode\u003ee7ef43d\u003c/code\u003e\u003c/a\u003e\nUpdate GitHub Actions for new secrets and branch (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1840\"\u003e#1840\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/a6730de231a0747359e220eb4b5546a829510d3d\"\u003e\u003ccode\u003ea6730de\u003c/code\u003e\u003c/a\u003e\nStart enforcing binary compatibility for Kotlin/Native (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1838\"\u003e#1838\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/e75a7e9e7fe144ea74baf3e4acd4f2df0a0d0cc0\"\u003e\u003ccode\u003ee75a7e9\u003c/code\u003e\u003c/a\u003e\nUpdate dependency com.android.tools.build:gradle to v9.3.1 (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1836\"\u003e#1836\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/9d21d5cba334fce36d3316f421d7adcd3fb7ef93\"\u003e\u003ccode\u003e9d21d5c\u003c/code\u003e\u003c/a\u003e\nFix interchanged docs links for 1.x and 2.x API (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1835\"\u003e#1835\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/bff1dffe5f90e9546b494d4693291a8f72cb07b4\"\u003e\u003ccode\u003ebff1dff\u003c/code\u003e\u003c/a\u003e\nTrack new docs locations from Dokka v2 (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1833\"\u003e#1833\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/commit/3b16d9b9dfe6b27ae198a00b7b6d45dc162cddcf\"\u003e\u003ccode\u003e3b16d9b\u003c/code\u003e\u003c/a\u003e\nGrant write permission to the publish-website action (\u003ca\nhref\u003d\"https://redirect.github.com/lysine-dev/okio/issues/1832\"\u003e#1832\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/lysine-dev/okio/compare/parent-3.17.0...parent-3.18.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "1d8dc54ba0c80513adddf3f16508e4154f64e8e1",
      "tree": "130fafd608d62c2663d60abdfd8d91d2d404349b",
      "parents": [
        "2afc1d30d892467bded7dac8cdfaca009a83ad1e"
      ],
      "author": {
        "name": "Dang Pham",
        "email": "phamnhathaidang@gmail.com",
        "time": "Sat Oct 03 12:38:11 2026 +0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 03 07:38:11 2026 +0200"
      },
      "message": "GH-471: Fix ListView reader iteration bounds (#1310)\n\n## What\u0027s Changed\n\nFix `UnionListViewReader` and `UnionLargeListViewReader` iteration so\nnon-empty\nListView values terminate after exactly the declared number of elements.\n\nCloses #471."
    },
    {
      "commit": "2afc1d30d892467bded7dac8cdfaca009a83ad1e",
      "tree": "34f604d8776cca67a03efd6b60bbeafc6cd61ec3",
      "parents": [
        "7cd07b1f54c3258adba861b57acfe50c7bbc64f3"
      ],
      "author": {
        "name": "Abdul Rawoof Khan",
        "email": "abdulr@bugqore.com",
        "time": "Sat Oct 03 08:04:45 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 03 04:34:45 2026 +0200"
      },
      "message": "GH-1311: Use Locale.ROOT when formatting JDBC interval strings (#1312)\n\n## What\u0027s Changed\n\n`formatIntervalYear` and `formatIntervalDay` build the Oracle-style\ninterval strings the JDBC interval accessor returns from\n`getString()`/`getObject()` with `String.format` and no explicit locale,\nso `java.util.Formatter` renders the `%d` digits using the JVM default\nlocale. On a JVM whose default locale uses non-ASCII digits (`ar-EG`,\n`bn-BD`, `mr-IN`, ...) an interval comes back as `+٠٢١-٠٢` instead of\n`+021-02`, which corrupts the value handed to JDBC clients and breaks\nanything parsing it as ASCII. Pass `Locale.ROOT` to both calls, the same\nfix GH-1300 applied to the C Data Interface format strings.\n\nCloses #1311."
    },
    {
      "commit": "7cd07b1f54c3258adba861b57acfe50c7bbc64f3",
      "tree": "567aee0f3d63361d1fb7bc5ba36ae29eaf2d467b",
      "parents": [
        "2c21d83974f9a12153266748e580a530b939b2aa"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 17:14:42 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 17:14:42 2026 +0200"
      },
      "message": "MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.37.2 to 11.38.2 (#1275)\n\nBumps\n[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)\nfrom 11.37.2 to 11.38.2.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt\"\u003ecom.nimbusds:oauth2-oidc-sdk\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eversion 1.0 (2012-05-29)\n* First official release with authorisation endpoint, token endpoint,\ncheck\nID endpoint and UserInfo endpoint support.\n* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.\n* Language Tags (RFC 5646) support through the Nimbus-LangTag library.\n* JSON support through the JSON Smart library.\u003c/p\u003e\n\u003cp\u003eversion 2.0 (2013-05-13)\n* Intermediary development release with Maven build, published to\nMaven Central.\u003c/p\u003e\n\u003cp\u003eversion 2.1 (2013-06-06)\n* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect\nStandard draft 21, OpenID Connect Discovery draft 17 and OpenID\nConnect Registration draft 19.\n* Major refactoring of the APIs for greater simplicity.\n* Adds JUnit tests.\u003c/p\u003e\n\u003cp\u003eversion 2.2 (2013-06-18)\n* Refactors dynamic OpenID Connect client registration.\n* Adds partial support of the OAuth 2.0 Dynamic Client Registration\nProtocol (draft-ietf-oauth-dyn-reg-12).\n* Optimises parsing of request parameters consisting of one or more\ntokens (scope, response type, etc).\u003c/p\u003e\n\u003cp\u003eversion 2.3 (2013-06-19)\n* Renames OAuth 2.0 dynamic client registration package.\n* Adds ClientInformation.getClientMetadata() method.\n* Adds OIDCClientInformation class.\u003c/p\u003e\n\u003cp\u003eversion 2.4 (2013-06-20)\n* Adds static OIDCClientInformation.parse(JSONObject) method.\u003c/p\u003e\n\u003cp\u003eversion 2.5 (2013-06-22)\n* Adds support OAuth 2.0 dynamic client update.\n* Adds OpenID Connect dynamic client registration classes.\u003c/p\u003e\n\u003cp\u003eversion 2.6 (2013-06-25)\n* Enforces order of preference of ACR values in OpenID Connect client\nmetadata, as required by the specification.\n* Documentation and performance improvements.\u003c/p\u003e\n\u003cp\u003eversion 2.7 (2013-06-26)\n* Switches Identifier generation to java.security.SecureRandom.\u003c/p\u003e\n\u003cp\u003eversion 2.8 (2013-06-30)\n* Fixes serialisation and assignment bugs in ClientMetadata.\n* Switches Secret generation to java.security.SecureRandom.\u003c/p\u003e\n\u003cp\u003eversion 2.9 (2013-09-17)\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/bbd0e837d1a42db51267c4520559e428dc2440ef\"\u003e\u003ccode\u003ebbd0e83\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/02b80a2f6e6dcbc6965b6bfc5b5b02dcff89fd66\"\u003e\u003ccode\u003e02b80a2\u003c/code\u003e\u003c/a\u003e\nAdds SubjectType.EPHEMERAL enum constant (iss \u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/issues/560\"\u003e#560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/15d3318bf824a187b81c85b4e9630af92bd29a3a\"\u003e\u003ccode\u003e15d3318\u003c/code\u003e\u003c/a\u003e\nDownloads current connect2id-com-chain.pem\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/6a7c5d393fe6768823bc56e1718c68752d2acb26\"\u003e\u003ccode\u003e6a7c5d3\u003c/code\u003e\u003c/a\u003e\nFixes pom.xml scm tag\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/6ed944dcba53b8ad628c242b9b177f1feb825073\"\u003e\u003ccode\u003e6ed944d\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release 11.38\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/9fc735f163fcdd9a1f475642d584b29b2db925c5\"\u003e\u003ccode\u003e9fc735f\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/0752d0d41b5059979b7515f8218e3363872b6a1b\"\u003e\u003ccode\u003e0752d0d\u003c/code\u003e\u003c/a\u003e\nUpdates OpenID Connect Ephemeral Subject Identifier draft version\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/bdc4fe2918be8fe05ecd30fb44473c42059db09f\"\u003e\u003ccode\u003ebdc4fe2\u003c/code\u003e\u003c/a\u003e\nFixes SIVAESBasedPairwiseSubjectCodec to property validate decoded parts\nand ...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/2172f42eb1224e17387608079633d172636fb64a\"\u003e\u003ccode\u003e2172f42\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release 11.38.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/c859ccfa297e6a1951872f549b72a306f890dd81\"\u003e\u003ccode\u003ec859ccf\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.38.2..11.37.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.nimbusds:oauth2-oidc-sdk\u0026package-manager\u003dmaven\u0026previous-version\u003d11.37.2\u0026new-version\u003d11.38.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nYou can trigger a rebase of this PR by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has\nbeen open for over 30 days.\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "2c21d83974f9a12153266748e580a530b939b2aa",
      "tree": "3ef99acf6f16288de904be3458c179f8ca579713",
      "parents": [
        "e0722cba2e6ccaa83ec7d323652934cd238e7fd4"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Fri Oct 02 17:14:28 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 17:14:28 2026 +0200"
      },
      "message": "MINOR: Bump org.apache.hive:hive-storage-api from 4.0.1 to 4.1.0 (#1281)\n\nSupersedes #1280.\n\nDependabot proposed bumping `org.apache.hive:hive-storage-api` to 4.2.1\nin #1280, but that fails the RC `Binaries` job:\n\n```\n[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.15.0:testCompile (default-testCompile) on project arrow-orc: Compilation failure\n[ERROR] adapter/orc/src/test/java/org/apache/arrow/adapter/orc/OrcReaderTest.java:[34,44] cannot access BytesColumnVector\n[ERROR]   bad class file: hive-storage-api-4.2.1.jar(/org/apache/hadoop/hive/ql/exec/vector/BytesColumnVector.class)\n[ERROR]     class file has wrong version 65.0, should be 61.0\n```\n\nHive moved its compiler target from Java 17 to Java 21 in 4.2.0, so\n4.2.x class files (major version 65) cannot be read by `javac --release\n17`, which is what this project builds with\n(`maven.compiler.release\u003d17`).\n\n| hive-storage-api | `maven.compiler.target` |\n| --- | --- |\n| 4.0.1 (current) | 17 |\n| 4.1.0 (this PR) | 17 |\n| 4.2.0 | 21 |\n| 4.2.1 | 21 |\n\n4.1.0 is the newest release still targeting Java 17, so bump to that\ninstead. Once the project raises its baseline to Java 21, 4.2.x becomes\nviable.\n\nNote that this only surfaces in the RC `Binaries` job:\n`ci/scripts/test.sh` adds `adapter/orc` and `dataset` to the reactor\nonly when `ARROW_JAVA_JNI\u003dON`, and the Conda JNI jobs run with\n`-DARROW_JAVA_JNI_ENABLE_ORC\u003dOFF`.\n\n### Verification\n\n`mvn -Parrow-jni -pl adapter/orc -am test-compile` and the same for\n`dataset` both succeed locally, including `OrcReaderTest`, the class\nthat fails on #1280."
    },
    {
      "commit": "e0722cba2e6ccaa83ec7d323652934cd238e7fd4",
      "tree": "2b80ac4b184db991bdf5658440a0f1406a6b022c",
      "parents": [
        "187fe36ad34b6fb6f93d30371aec46c0c69c6949"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 17:14:01 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 17:14:01 2026 +0200"
      },
      "message": "MINOR: Bump org.apache.parquet:parquet-variant from 1.17.1 to 1.18.1 (#1287)\n\nBumps\n[org.apache.parquet:parquet-variant](https://github.com/apache/parquet-java)\nfrom 1.17.1 to 1.18.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/releases\"\u003eorg.apache.parquet:parquet-variant\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet 1.18.1 RC1\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1-rc1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1-rc1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet 1.18.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMINOR: Fix error message in SimpleGroup.add() for Binary by \u003ca\nhref\u003d\"https://github.com/takezoe\"\u003e\u003ccode\u003e@​takezoe\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3385\"\u003eapache/parquet-java#3385\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] remove comment from pom.xml by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3382\"\u003eapache/parquet-java#3382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: \u003ccode\u003eci-before_install.sh\u003c/code\u003e should show wget errors and\nretry by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3381\"\u003eapache/parquet-java#3381\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: Upgrade spotless plugin by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3380\"\u003eapache/parquet-java#3380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] Move on from java8 for three core modules by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3379\"\u003eapache/parquet-java#3379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: \u003ccode\u003ejapicmp\u003c/code\u003e checks are failing after Java 11 release\nby \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3388\"\u003eapache/parquet-java#3388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: Bump version to 1.18.0-SNAPSHOT by \u003ca\nhref\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e@​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3389\"\u003eapache/parquet-java#3389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3372\"\u003eGH-3372\u003c/a\u003e:\nEnhance ColumnSizeCommand to sort by size by \u003ca\nhref\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e@​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3371\"\u003eapache/parquet-java#3371\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3399\"\u003eGH-3399\u003c/a\u003e:\nHint IDE the source code generated by thrift by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3400\"\u003eapache/parquet-java#3400\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3387\"\u003eGH-3387\u003c/a\u003e:\nbump aircompressor to mitigate CVE-2025-67721 by \u003ca\nhref\u003d\"https://github.com/olegbonar\"\u003e\u003ccode\u003e@​olegbonar\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3403\"\u003eapache/parquet-java#3403\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3383\"\u003eGH-3383\u003c/a\u003e:\nModernize mockito by \u003ca\nhref\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e@​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3384\"\u003eapache/parquet-java#3384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3404\"\u003eGH-3404\u003c/a\u003e:\nfix CI TestByteBitPacking512VectorLE.unpackValuesUsingVector randomly\noom by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3405\"\u003eapache/parquet-java#3405\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3401\"\u003eGH-3401\u003c/a\u003e:\nRemove redundant MAP_KEY_VALUE annotation at middle level of logical\ntype map by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3402\"\u003eapache/parquet-java#3402\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3406\"\u003eGH-3406\u003c/a\u003e:\nfix Float16 statistics handling for NaN and zero values by \u003ca\nhref\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e@​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3407\"\u003eapache/parquet-java#3407\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3215\"\u003eGH-3215\u003c/a\u003e:\nSort the list of org.apache.parquet.format.Encoding created … by \u003ca\nhref\u003d\"https://github.com/mbrannstrom\"\u003e\u003ccode\u003e@​mbrannstrom\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3413\"\u003eapache/parquet-java#3413\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump dependabot limit by \u003ca\nhref\u003d\"https://github.com/Fokko\"\u003e\u003ccode\u003e@​Fokko\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3416\"\u003eapache/parquet-java#3416\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.21.0 to 5.22.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3436\"\u003eapache/parquet-java#3436\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache:apache from 33 to 37 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3431\"\u003eapache/parquet-java#3431\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.33.2 to 4.34.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3441\"\u003eapache/parquet-java#3441\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.luben:zstd-jni from 1.5.7-3 to 1.5.7-7 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3442\"\u003eapache/parquet-java#3442\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-shade-plugin from 3.6.0 to 3.6.2\nby \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3430\"\u003eapache/parquet-java#3430\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.xerial.snappy:snappy-java from 1.1.10.7 to 1.1.10.8 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3426\"\u003eapache/parquet-java#3426\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.6.3 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3440\"\u003eapache/parquet-java#3440\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.parquet:parquet-pig from 1.15.0 to 1.15.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3420\"\u003eapache/parquet-java#3420\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-logging:commons-logging from 1.3.5 to 1.3.6 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3418\"\u003eapache/parquet-java#3418\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.re2j:re2j from 1.7 to 1.8 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3433\"\u003eapache/parquet-java#3433\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3429\"\u003eapache/parquet-java#3429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3411\"\u003eGH-3411\u003c/a\u003e\nExpose row group index via Parquet reader by \u003ca\nhref\u003d\"https://github.com/uros7251brick\"\u003e\u003ccode\u003e@​uros7251brick\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3412\"\u003eapache/parquet-java#3412\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.22.0 to 5.23.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3445\"\u003eapache/parquet-java#3445\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump net.openhft:zero-allocation-hashing from 0.27ea0 to 0.27ea1 by\n\u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3419\"\u003eapache/parquet-java#3419\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.tukaani:xz from 1.10 to 1.12 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3417\"\u003eapache/parquet-java#3417\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump it.unimi.dsi:fastutil from 8.5.15 to 8.5.18 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3422\"\u003eapache/parquet-java#3422\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-text from 1.13.1 to 1.15.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3438\"\u003eapache/parquet-java#3438\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3449\"\u003eGH-3449\u003c/a\u003e:\nFix BinaryStats int overflow by \u003ca\nhref\u003d\"https://github.com/Jiayi-Wang-db\"\u003e\u003ccode\u003e@​Jiayi-Wang-db\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3448\"\u003eapache/parquet-java#3448\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.34.0 to 4.34.1 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3453\"\u003eapache/parquet-java#3453\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.arrow:arrow-vector from 17.0.0 to 19.0.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3454\"\u003eapache/parquet-java#3454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3410\"\u003eGH-3410\u003c/a\u003e:\nBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca\nhref\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e@​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to\n0.25.4 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3437\"\u003eapache/parquet-java#3437\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.4 to\n0.25.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3473\"\u003eapache/parquet-java#3473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.5 to\n0.25.6 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3491\"\u003eapache/parquet-java#3491\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3492\"\u003eapache/parquet-java#3492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3011\"\u003eGH-3011\u003c/a\u003e:\nDeny further writes after InternalParquetRecordWriter is aborted by \u003ca\nhref\u003d\"https://github.com/LuciferYang\"\u003e\u003ccode\u003e@​LuciferYang\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3450\"\u003eapache/parquet-java#3450\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3461\"\u003eGH-3461\u003c/a\u003e:\nAvoid unnecessary debug logging overhead in record write hot path by \u003ca\nhref\u003d\"https://github.com/arouel\"\u003e\u003ccode\u003e@​arouel\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3462\"\u003eapache/parquet-java#3462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3408\"\u003eGH-3408\u003c/a\u003e\nAdd support for stale PR workflow by \u003ca\nhref\u003d\"https://github.com/ArnavBalyan\"\u003e\u003ccode\u003e@​ArnavBalyan\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/pull/3409\"\u003eapache/parquet-java#3409\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/blob/master/CHANGES.md\"\u003eorg.apache.parquet:parquet-variant\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch1\u003eParquet\u003c/h1\u003e\n\u003cp\u003eFrom 1.14.2 onwards, the Parquet project has migrated from Jira to\nGitHub, and the changelogs are now \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/releases\"\u003epublished under\nReleases\u003c/a\u003e.\u003c/p\u003e\n\u003ch3\u003eVersion 1.14.1\u003c/h3\u003e\n\u003cp\u003eRelease Notes - Parquet - Version 1.14.1\u003c/p\u003e\n\u003ch4\u003eBug\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2468\"\u003ePARQUET-2468\u003c/a\u003e\n- ParquetMetadata.toPrettyJSON throws exception on file read when\nLOG.isDebugEnabled()\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2498\"\u003ePARQUET-2498\u003c/a\u003e\n- Hadoop vector IO API doesn\u0027t handle empty list of ranges\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eVersion 1.14.0\u003c/h3\u003e\n\u003cp\u003eRelease Notes - Parquet - Version 1.14.0\u003c/p\u003e\n\u003ch4\u003eBug\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2260\"\u003ePARQUET-2260\u003c/a\u003e\n- Bloom filter bytes size shouldn\u0027t be larger than maxBytes size in the\nconfiguration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2266\"\u003ePARQUET-2266\u003c/a\u003e\n- Fix support for files without ColumnIndexes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2276\"\u003ePARQUET-2276\u003c/a\u003e\n- ParquetReader reads do not work with Hadoop version 2.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2300\"\u003ePARQUET-2300\u003c/a\u003e\n- Update jackson-core 2.13.4 to a version without CVE\nPRISMA-2023-0067\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2325\"\u003ePARQUET-2325\u003c/a\u003e\n- Fix parquet-cli\u0027s dictionary subcommand to work with\nFIXED_LEN_BYTE_ARRAY\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2329\"\u003ePARQUET-2329\u003c/a\u003e\n- Fix wrong help messages of parquet-cli subcommands\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2330\"\u003ePARQUET-2330\u003c/a\u003e\n- Fix convert-csv to show the correct position of the invalid\nrecord\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2332\"\u003ePARQUET-2332\u003c/a\u003e\n- Fix unexpectedly disabled tests to be executed\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2336\"\u003ePARQUET-2336\u003c/a\u003e\n- Add caching key to CodecFactory\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2342\"\u003ePARQUET-2342\u003c/a\u003e\n- Parquet writer produced a corrupted file due to page value count\noverflow\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2343\"\u003ePARQUET-2343\u003c/a\u003e\n- Fixes NPE when rewriting file with multiple rowgroups\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://issues.apache.org/jira/browse/PARQUET-2348\"\u003ePARQUET-2348\u003c/a\u003e\n- Recompression/Re-encrypt should rewrite bloomfilter\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/7c22cdba6792fa29c5bda74bf1f866a08d7572a9\"\u003e\u003ccode\u003e7c22cdb\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release apache-parquet-1.18.1-rc1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/4c04bf78c01e62ebc26e355e4995790acc89a2e3\"\u003e\u003ccode\u003e4c04bf7\u003c/code\u003e\u003c/a\u003e\nPrepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/4ae935328b030c9aa116bb6c0fd166ef5c66cd2f\"\u003e\u003ccode\u003e4ae9353\u003c/code\u003e\u003c/a\u003e\nBump jackson.version from 2.22.1 to 2.22.2 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3739\"\u003e#3739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/a3501b61622be52c9620c0ed93480417f27b5600\"\u003e\u003ccode\u003ea3501b6\u003c/code\u003e\u003c/a\u003e\n\u003ccode\u003eBytesInput.copy(BytesInput)\u003c/code\u003e should return a copy (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3729\"\u003e#3729\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/3fd0ae7684e5768723158fad296db1894a633e55\"\u003e\u003ccode\u003e3fd0ae7\u003c/code\u003e\u003c/a\u003e\nAdd parameter to enable reading KMS URL from key material (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3745\"\u003e#3745\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/afe34d8b04d82b6dace63901074d4d5f8e6b54e3\"\u003e\u003ccode\u003eafe34d8\u003c/code\u003e\u003c/a\u003e\nBump com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2\n(\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3740\"\u003e#3740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/1916eff07f1315003a59d55e24b97919e741f329\"\u003e\u003ccode\u003e1916eff\u003c/code\u003e\u003c/a\u003e\nBump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3744\"\u003e#3744\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/b1b7ffcad5e72d8dd80905290a83d021e56332c5\"\u003e\u003ccode\u003eb1b7ffc\u003c/code\u003e\u003c/a\u003e\nBump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3725\"\u003e#3725\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/686bb10c93b9b4c3b9e106715f32f29ad2d47504\"\u003e\u003ccode\u003e686bb10\u003c/code\u003e\u003c/a\u003e\nBump it.unimi.dsi:fastutil from 8.5.18 to 8.5.19 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3684\"\u003e#3684\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/parquet-java/commit/663e9074c424262873cc8d35ead16da2c581522c\"\u003e\u003ccode\u003e663e907\u003c/code\u003e\u003c/a\u003e\nBump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 (\u003ca\nhref\u003d\"https://redirect.github.com/apache/parquet-java/issues/3704\"\u003e#3704\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.1...apache-parquet-1.18.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.apache.parquet:parquet-variant\u0026package-manager\u003dmaven\u0026previous-version\u003d1.17.1\u0026new-version\u003d1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjbonofre@apache.org\u003e"
    },
    {
      "commit": "187fe36ad34b6fb6f93d30371aec46c0c69c6949",
      "tree": "45fcc28371785cbace337395a232a4f374602e20",
      "parents": [
        "a9f144203f94784b5094170350507d4182602e01"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 17:08:08 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 17:08:08 2026 +0200"
      },
      "message": "MINOR: Bump dep.slf4j.version from 2.0.18 to 2.0.20 (#1296)\n\nBumps `dep.slf4j.version` from 2.0.18 to 2.0.20.\nUpdates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.20\n\nUpdates `org.slf4j:slf4j-jdk14` from 2.0.18 to 2.0.20\n\nUpdates `org.slf4j:jul-to-slf4j` from 2.0.18 to 2.0.20\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.20\n\nUpdates `org.slf4j:log4j-over-slf4j` from 2.0.18 to 2.0.20\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "a9f144203f94784b5094170350507d4182602e01",
      "tree": "d7d6adfe56f5835aa3e4b716d2bbc002ac93ceb9",
      "parents": [
        "6b466eb653d76e62d371396521b85ed80df21232"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 09:36:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 09:36:26 2026 +0200"
      },
      "message": "MINOR: Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-20 (#1297)\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)\nfrom 1.5.7-11 to 1.5.7-20.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/b15453120e8d41a48e1bcc7d5fc735cb544a9df4\"\u003e\u003ccode\u003eb154531\u003c/code\u003e\u003c/a\u003e\nDon\u0027t re-run jniCompile before packaging\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/a47b87f49731a25cfad016ca7082c6f47cd068ef\"\u003e\u003ccode\u003ea47b87f\u003c/code\u003e\u003c/a\u003e\nFaster perf test runs\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/6564a025eb83424deff8f7444742c672b0338ea2\"\u003e\u003ccode\u003e6564a02\u003c/code\u003e\u003c/a\u003e\nGetPrimitiveArrayCritical calls can be nested\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/82d7f902991087266e3d68f9efc4683689d750af\"\u003e\u003ccode\u003e82d7f90\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Don\u0027t jniCompile when packaging\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/acc7b2c96cc3e682412847a3e547a67583195cf8\"\u003e\u003ccode\u003eacc7b2c\u003c/code\u003e\u003c/a\u003e\nsimplify comments\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/9a643d6360fd6bdf2dd4fab837356b5a01f30483\"\u003e\u003ccode\u003e9a643d6\u003c/code\u003e\u003c/a\u003e\nkeep FrameProgressionBuffer off-heap\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/6d5439feddb1e2f8025025e7af5fd259852915a7\"\u003e\u003ccode\u003e6d5439f\u003c/code\u003e\u003c/a\u003e\nimprove getFrameProgression method performance \u0026amp; memory usage\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/518e870cc6df26a71ab908aa98e54a7c0e6769dc\"\u003e\u003ccode\u003e518e870\u003c/code\u003e\u003c/a\u003e\nimplement ZstdCompressCtx based on FFM API\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/d06179097e4146748b65aab0eccf813dbc4ae0f7\"\u003e\u003ccode\u003ed061790\u003c/code\u003e\u003c/a\u003e\nNext version is v1.5.7-20\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commit/5ddc98b62d94fff58607e1ca4e3d3bd7a6bc99da\"\u003e\u003ccode\u003e5ddc98b\u003c/code\u003e\u003c/a\u003e\nDon\u0027t jniCompile when packaging\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/compare/v1.5.7-11...v1.5.7-20\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6b466eb653d76e62d371396521b85ed80df21232",
      "tree": "a040170a73b11798c4b4ddabfa7b822bc29f4ba8",
      "parents": [
        "2fb338dad74fb371e3d3b02cba2fb4323d8a3643"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 08:41:15 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 08:41:15 2026 +0200"
      },
      "message": "MINOR: Bump com.google.guava:guava-bom from 33.6.0-jre to 33.7.1-jre (#1298)\n\nBumps [com.google.guava:guava-bom](https://github.com/google/guava) from\n33.6.0-jre to 33.7.1-jre.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/google/guava/releases\"\u003ecom.google.guava:guava-bom\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e33.7.1\u003c/h2\u003e\n\u003ch3\u003eMaven\u003c/h3\u003e\n\u003cpre lang\u003d\"xml\"\u003e\u003ccode\u003e\u0026lt;dependency\u0026gt;\n  \u0026lt;groupId\u0026gt;com.google.guava\u0026lt;/groupId\u0026gt;\n  \u0026lt;artifactId\u0026gt;guava\u0026lt;/artifactId\u0026gt;\n  \u0026lt;version\u0026gt;33.7.1-jre\u0026lt;/version\u0026gt;\n  \u0026lt;!-- or, for Android: --\u0026gt;\n  \u0026lt;version\u0026gt;33.7.1-android\u0026lt;/version\u0026gt;\n\u0026lt;/dependency\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch3\u003eJar files\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://repo1.maven.org/maven2/com/google/guava/guava/33.7.1-jre/guava-33.7.1-jre.jar\"\u003e33.7.1-jre.jar\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://repo1.maven.org/maven2/com/google/guava/guava/33.7.1-android/guava-33.7.1-android.jar\"\u003e33.7.1-android.jar\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eGuava requires \u003ca\nhref\u003d\"https://github.com/google/guava/wiki/UseGuavaInYourBuild#what-about-guavas-own-dependencies\"\u003eone\nruntime dependency\u003c/a\u003e, which you can download here:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://repo1.maven.org/maven2/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar\"\u003efailureaccess-1.0.3.jar\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eJavadoc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://guava.dev/releases/33.7.1-jre/api/docs/\"\u003e33.7.1-jre\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://guava.dev/releases/33.7.1-android/api/docs/\"\u003e33.7.1-android\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eJDiff\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://guava.dev/releases/33.7.1-jre/api/diffs/\"\u003e33.7.1-jre vs.\n33.7.0-jre\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://guava.dev/releases/33.7.1-android/api/diffs/\"\u003e33.7.1-android\nvs. 33.7.0-android\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://guava.dev/releases/33.7.1-android/api/androiddiffs/\"\u003e33.7.1-android\nvs. 33.7.1-jre\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChangelog\u003c/h3\u003e\n\u003cp\u003eGuava 33.7.1 removes the \u003ccode\u003eMulti-Release\u003c/code\u003e line from our jar\nmanifest, fixing an issue under Java 9 and 10 that was introduced to\n\u003ccode\u003eguava-jre\u003c/code\u003e in \u003ca\nhref\u003d\"https://github.com/google/guava/releases/tag/v33.7.0\"\u003eversion\n33.7.0\u003c/a\u003e. Sorry for the trouble.\u003c/p\u003e\n\u003ch2\u003e33.7.0\u003c/h2\u003e\n\u003ch3\u003eNewly introduced problem for Java 9 and Java 10 only\u003c/h3\u003e\n\u003cp\u003eGuava 33.7.0 includes a \u003ccode\u003eMulti-Release\u003c/code\u003e line in its jar\nmanifest, even though it is no longer a multi-release jar. This causes\n\u003ca href\u003d\"https://redirect.github.com/google/guava/issues/8614\"\u003esome\nproblems with tools from Java 9 and Java 10\u003c/a\u003e. The issue is fixed in\n\u003ca href\u003d\"https://github.com/google/guava/releases/tag/v33.7.1\"\u003eversion\n33.7.1\u003c/a\u003e. Sorry for the trouble.\u003c/p\u003e\n\u003ch3\u003eMaven\u003c/h3\u003e\n\u003cpre lang\u003d\"xml\"\u003e\u003ccode\u003e\u0026lt;dependency\u0026gt;\n  \u0026lt;groupId\u0026gt;com.google.guava\u0026lt;/groupId\u0026gt;\n  \u0026lt;artifactId\u0026gt;guava\u0026lt;/artifactId\u0026gt;\n  \u0026lt;version\u0026gt;33.7.0-jre\u0026lt;/version\u0026gt;\n  \u0026lt;!-- or, for Android: --\u0026gt;\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/google/guava/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "2fb338dad74fb371e3d3b02cba2fb4323d8a3643",
      "tree": "bcd235f1de25d3fe8a682109544292aa8d947d0f",
      "parents": [
        "c16f81ce136915ca270614ffdda9b700066aea0f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 07:51:25 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 07:51:25 2026 +0200"
      },
      "message": "MINOR: Bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.3 (#1299)\n\nBumps\n[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)\nfrom 3.8.0 to 3.10.3.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.10.3\u003c/h2\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eGenerate formatter defaults from version catalog. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3045\"\u003e#3045\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egson\u003c/code\u003e version \u003ccode\u003e2.13.2\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e2.14.0\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3045\"\u003e#3045\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ezjsonpatch\u003c/code\u003e version \u003ccode\u003e0.4.14\u003c/code\u003e\n-\u0026gt; \u003ccode\u003e0.4.16\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3045\"\u003e#3045\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejackson-dataformat-yaml\u003c/code\u003e version\n\u003ccode\u003e2.14.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.20.1\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3045\"\u003e#3045\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ektfmt\u003c/code\u003e version \u003ccode\u003e0.63\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e0.64\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2988\"\u003e2988\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ecleanthat\u003c/code\u003e version \u003ccode\u003e2.25\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e2.26\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2882\"\u003e#2882\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejackson\u003c/code\u003e version \u003ccode\u003e2.20.1\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e2.22.2\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2819\"\u003e#2819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejavaparser\u003c/code\u003e version \u003ccode\u003e3.27.1\u003c/code\u003e\n-\u0026gt; \u003ccode\u003e3.28.2\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3065\"\u003e#3065\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003epalantir-java-format\u003c/code\u003e version\n\u003ccode\u003e2.80.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.98.0\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3068\"\u003e#3068\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003escalafmt\u003c/code\u003e version \u003ccode\u003e3.8.1\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e3.11.5\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2173\"\u003e#2173\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egoogle-java-format\u003c/code\u003e version\n\u003ccode\u003e1.30.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e1.36.1\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3075\"\u003e#3075\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egherkin-utils\u003c/code\u003e version \u003ccode\u003e10.0.0\u003c/code\u003e\n-\u0026gt; \u003ccode\u003e12.0.2\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2979\"\u003e#2979\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix release signing by using Gradle\u0027s required eight-digit signing\nsubkey ID. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3105\"\u003e#3105\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix race when creating the npm install cache directory. ((\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3096\"\u003e#3096\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGrEclipse no longer emits expected OSGi and nested-jar warnings\nduring initialization. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2445\"\u003e#2445\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etypescript\u003c/code\u003e \u003ccode\u003eprettier()\u003c/code\u003e no longer emits a\nwarning when its parser is already set to \u003ccode\u003etypescript\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3098\"\u003e#3098\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;versionCatalog\u0026gt;\u003c/code\u003e preserves standalone comments at\nsection boundaries and the end of the file. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3048\"\u003e#3048\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;versionCatalog\u0026gt;\u003c/code\u003e preserves entries when comments\ncontain unmatched brackets, preserves commas inside quoted strings, and\nkeeps significant line boundaries in multiline entries. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3042\"\u003e#3042\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;versionCatalog\u0026gt;\u003c/code\u003e now reports unfinished entries\nas lints at their starting line. These fail formatting by default, so\nupgrading may expose catalog errors that previously caused silent data\nloss. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3042\"\u003e#3042\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eEclipse JDT formatter step no longer fails with\n\u003ccode\u003eNoClassDefFoundError\u003c/code\u003e or \u003ccode\u003eNoSuchMethodError\u003c/code\u003e when\nlombok is active as a JVM agent (e.g. \u003ccode\u003e-javaagent:lombok.jar\u003c/code\u003e\nin Eclipse/VS Code/Cursor). (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2795\"\u003e#2795\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.10.2\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;shortenFullyQualifiedTypes\u0026gt;\u003c/code\u003e now shortens\nfully-qualified types used in expression contexts (such as static method\ncalls, static fields, and enum constants) while avoiding imports that\nwould change how existing unqualified type references resolve. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3039\"\u003e#3039\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eEclipse JDT formatter step no longer fails with\n\u003ccode\u003eNoClassDefFoundError\u003c/code\u003e when lombok is active as a JVM agent\n(e.g. \u003ccode\u003e-javaagent:lombok.jar\u003c/code\u003e in Eclipse/VS Code/Cursor). (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2795\"\u003e#2795\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.10.1\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;prettier\u0026gt;\u003c/code\u003e and other npm-based steps no longer\nfail to start on npm 12 (\u003ccode\u003eEUNKNOWNCONFIG\u003c/code\u003e from\n\u003ccode\u003e--scripts-prepend-node-path\u003c/code\u003e). (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3024\"\u003e#3024\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.10.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNew \u003ccode\u003e\u0026lt;shortenFullyQualifiedTypes\u0026gt;\u003c/code\u003e step for Java,\nwhich replaces fully-qualified type names with their simple names and\nadds the imports they need. Best combined with\n\u003ccode\u003e\u0026lt;importOrder\u0026gt;\u003c/code\u003e and\n\u003ccode\u003e\u0026lt;removeUnusedImports\u0026gt;\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2945\"\u003e#2945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd embedded lockfiles to Eclipse JDT for every supported version\n(\u003ccode\u003e4.9\u003c/code\u003e through \u003ccode\u003e4.40\u003c/code\u003e), so \u003ccode\u003eeclipse()\u003c/code\u003e\nresolves from Maven Central instead of querying a P2 update site.\nVersions without an embedded lockfile still fall back to P2\nprovisioning. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/1996\"\u003e#1996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd support to apply alternate license header within same format (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/872\"\u003e#872\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd support to skip license header application based on source file\ncontent pattern (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/650\"\u003e#650\u003c/a\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eremoveUnusedImports\u003c/code\u003e no longer fails on Java\n\u003ccode\u003eimport module\u003c/code\u003e declarations. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2890\"\u003e#2890\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eConcurrent P2 provisioning no longer races Solstice\u0027s on-disk cache\n(affects Eclipse-based formatters under parallel builds). (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3004\"\u003e#3004\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDefault \u003ccode\u003egoogle-java-format\u003c/code\u003e remains \u003ccode\u003e1.28.0\u003c/code\u003e\non JVM 17; bumps to \u003ccode\u003e1.30.0\u003c/code\u003e on JVM 21+; require at least\n\u003ccode\u003e1.30.0\u003c/code\u003e on JVM 25+ for \u003ccode\u003eimport module\u003c/code\u003e\nsupport.\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003eeclipse\u003c/code\u003e version to latest\n\u003ccode\u003e4.39\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.40\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/1996\"\u003e#1996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDocument Maven skip properties \u003ccode\u003espotless.skip\u003c/code\u003e,\n\u003ccode\u003espotless.check.skip\u003c/code\u003e, and \u003ccode\u003espotless.apply.skip\u003c/code\u003e.\nGoal-specific skips now live on their own mojos so they no longer leak\nacross goals. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/3009\"\u003e#3009\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003eadocfmt\u003c/code\u003e version \u003ccode\u003e0.2.0\u003c/code\u003e -\u0026gt;\n\u003ccode\u003e0.3.1\u003c/code\u003e, which adds table formatting support\n(\u003ccode\u003e\u0026lt;formatTables\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026lt;tableLayout\u0026gt;\u003c/code\u003e,\n\u003ccode\u003e\u0026lt;tableMaxLineWidth\u0026gt;\u003c/code\u003e,\n\u003ccode\u003e\u0026lt;tableBlankLines\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.9.0\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/61e2016ee3ac82fb565b587e04408ae45dc5b709\"\u003e\u003ccode\u003e61e2016\u003c/code\u003e\u003c/a\u003e\nPublished maven/3.10.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/49e0b074905b6360848f9ab9c54e6f015911e301\"\u003e\u003ccode\u003e49e0b07\u003c/code\u003e\u003c/a\u003e\nPublished lib/4.10.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/b7a77486c6e6aad738b68ffce4075949680362d5\"\u003e\u003ccode\u003eb7a7748\u003c/code\u003e\u003c/a\u003e\nFix release signing key ID format (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3105\"\u003e#3105\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/be8005aae5d5e17c6a2819b2c54df5268c5cf4c5\"\u003e\u003ccode\u003ebe8005a\u003c/code\u003e\u003c/a\u003e\nDocument release signing correction (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3105\"\u003e#3105\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/073fe6199960d95f733dad9b4d9311c3148d4914\"\u003e\u003ccode\u003e073fe61\u003c/code\u003e\u003c/a\u003e\nUse short signing subkey ID for release publishing\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/8ac44c7aa8c08ca9b00e86d4dd59d589e7da8f09\"\u003e\u003ccode\u003e8ac44c7\u003c/code\u003e\u003c/a\u003e\nFix race when creating the npm install cache directory (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3096\"\u003e#3096\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/3f2d95561185486350c02471dab99a28585e7b45\"\u003e\u003ccode\u003e3f2d955\u003c/code\u003e\u003c/a\u003e\nUpdate dependency org.slf4j:slf4j-api to v2.0.20 (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3100\"\u003e#3100\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/0c70ca8904be526d40923f47b0fd8e9cfecfd33a\"\u003e\u003ccode\u003e0c70ca8\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027main\u0027 into fix/npm-cache-directory-race\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/bbf44a47b7cbdd2c4f55880f9767f79f36c9b6ee\"\u003e\u003ccode\u003ebbf44a4\u003c/code\u003e\u003c/a\u003e\nFix GrEclipse initialization warnings (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/3097\"\u003e#3097\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/b6bdcd0469e3c609f7d7017a4a462ed6ed7a31c9\"\u003e\u003ccode\u003eb6bdcd0\u003c/code\u003e\u003c/a\u003e\nUpdate dependency org.slf4j:slf4j-api to v2.0.20\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/diffplug/spotless/compare/maven/3.8.0...maven/3.10.3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c16f81ce136915ca270614ffdda9b700066aea0f",
      "tree": "1a64f766ffa856f0c09be5dd9f40480b1571a997",
      "parents": [
        "53a9ccd8f272bd576ec0524b704c1a1fdab20948"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Thu Oct 01 18:28:11 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 18:28:11 2026 +0200"
      },
      "message": "MINOR: [CI] Fix RC JNI builds on Windows (ArrowS3 link) and macOS (runner) (#1315)\n\n## What\u0027s Changed\n\nFix the `RC` workflow JNI builds, which have been failing on `main`\nsince the Arrow C++ `main` checkout changed.\n\n- **JNI Windows (`dataset/CMakeLists.txt`)**: Arrow C++ moved S3 into\nits own library (apache/arrow GH-50194). `arrow_dataset_jni` still calls\n`arrow::fs::EnsureS3Finalized()` but no longer linked the library\ndefining it, which failed with `LNK2019: unresolved external symbol`.\nLink `ArrowS3::arrow_s3_static` when the `ArrowS3` package is found, so\nbuilds against older Arrow C++ are unaffected.\n- **JNI macOS (`.github/workflows/rc.yml`)**: switch the runner from\n`macos-14` to `macos-15`. The Arrow C++ Brewfile installs `llvm`, which\nhas no Homebrew bottle for macOS 14, so `brew bundle` compiled LLVM from\nsource until the job hit the 1h timeout. `MACOSX_DEPLOYMENT_TARGET`\nstays at `14.0`."
    },
    {
      "commit": "53a9ccd8f272bd576ec0524b704c1a1fdab20948",
      "tree": "d50768ab00d0196d143bbfe21d11ae518a7ef21b",
      "parents": [
        "55868214cd4b3c1f1e7294b5d74155ba8cceeaaf"
      ],
      "author": {
        "name": "Sotaro Hikita",
        "email": "70102274+lawofcycles@users.noreply.github.com",
        "time": "Tue Sep 22 15:40:40 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 15:40:40 2026 +0900"
      },
      "message": "GH-1300: Use Locale.ROOT when building C Data Interface format strings (#1301)\n\n`Format.asString` built the `FixedSizeList` (`+w:%d`), `FixedSizeBinary`\n(`w:%d`) and `Decimal` (`d:%d,%d[,%d]`) format strings with\n`String.format` and no explicit `Locale`. `java.util.Formatter`\nlocalises the digits of `%d` with the default locale, so a JVM running\nunder `ar-EG`, `bn-BD`, `mr-IN` and similar locales exported `+w:٨`\ninstead of `+w:8`, which arrow-rs and other implementations reject.\n\nThis passes `Locale.ROOT` to the four calls and adds\n`FormatTest.testAsStringIgnoresDefaultLocale`, which sets the default\nlocale to `ar-EG` for the duration of the test and asserts the ASCII\noutput.\n\nCloses #1300."
    },
    {
      "commit": "55868214cd4b3c1f1e7294b5d74155ba8cceeaaf",
      "tree": "bb768296ba1a64c818da4f0d685398b5eb9c401a",
      "parents": [
        "d035fc8c5b4c414fa2e5eec44dc3c711b5e074f0"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Mon Sep 21 13:05:22 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 21 20:05:22 2026 +0900"
      },
      "message": "GH-1305: [CI] Drop x86_64 macOS from JNI builds (#1306)\n\n### Rationale for this change\n\nHomebrew treats x86_64 macOS as a [tier 3\nconfiguration](https://docs.brew.sh/Support-Tiers#tier-3) and rarely\nbuilds bottles for it. `brew bundle` doesn\u0027t build from source, so the\n`JNI macos-15-intel x86_64` job in the RC workflow aborts in `Install\ndependencies` with `no bottle available!` before anything is compiled.\n\nWe\u0027ve been patching this formula by formula:\n\n* #1269 skipped `aws-sdk-cpp` and gRPC.\n* #1270 skipped Node.js.\n\nAny new dependency added to `apache/arrow`\u0027s `cpp/Brewfile` can break\nthe job again the same way, and nightly RC runs go red on `main` when it\ndoes. We can\u0027t keep this job green on a configuration Homebrew doesn\u0027t\nsupport.\n\n#1269 noted that dropping the `macos-15-intel` entry needed its own\ndiscussion because it\u0027s user-facing. #1305 is that discussion.\n\n### What changes are included in this PR?\n\n`rc.yml`:\n\n* Removed the `macos-15-intel` / `x86_64` entry from the `jni-macos`\nmatrix.\n* `binaries` no longer extracts `jni-macos-x86_64.tar.gz` nor asserts\nthe four `jni/*/x86_64/*.dylib` files.\n* Dropped the `/usr/local` `python@XXX --overwrite` conflict loop. Its\ncomment already said it could go once we dropped `macos-15-intel`, since\n`macos-14` and later on arm64 use `/opt/homebrew`. `brew update` is\nkept.\n* Unwrapped the `pkg-config` uninstall from its `if [ \"$(uname -m)\" \u003d\n\"arm64\" ]` guard, which is now always true.\n* Trimmed the tier-3 justification from the `HOMEBREW_BUNDLE_BREW_SKIP`\ncomment. The skip list itself is unchanged: `aws-sdk-cpp` and gRPC are\nstill skipped so the bundled static ones are used, and Node.js is still\nskipped because the JNI build doesn\u0027t need it.\n\n`test.yml`:\n\n* Removed the `AMD64` / `macos-15-intel` entry from the `macos` test\nmatrix, leaving `AArch64` on `macos-latest`.\n\n`ci/scripts/jni_macos_build.sh` is untouched, so building the JNI\nlibraries locally on an Intel Mac still works.\n\n### Are these changes tested?\n\nYes, by CI. The remaining `JNI macos-14 aarch_64` job exercises the\nchanged `Install dependencies` step, and `binaries` exercises the\nchanged artifact extraction and verification.\n\n### Are there any user-facing changes?\n\nYes. Release JARs no longer bundle x86_64 macOS `.dylib` files for\n`arrow_cdata_jni`, `arrow_dataset_jni`, `arrow_orc_jni` and\n`gandiva_jni`. Intel Mac users of those modules will need to build the\nJNI libraries themselves. aarch64 macOS, x86_64 and aarch64 Linux, and\nx86_64 Windows are unaffected.\n\nCloses #1305."
    },
    {
      "commit": "d035fc8c5b4c414fa2e5eec44dc3c711b5e074f0",
      "tree": "edc1603e9cdfafd26c534388afe037464182c34d",
      "parents": [
        "91b4a2ca418ecb47cb8871d97588b19444337eb4"
      ],
      "author": {
        "name": "Abhishek Pathania",
        "email": "theabhishekpathania@gmail.com",
        "time": "Wed Sep 16 12:13:41 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 15:43:41 2026 +0900"
      },
      "message": "GH-1293: Use floor division when splitting epoch millis into day and time (#1294)\n\n## What\u0027s Changed\n\n`DateTimeUtils.getTimestampValue(long)` used `/` and `%` to split epoch\nmilliseconds into an epoch day and a time within that day. These\noperators round toward zero. For negative values that were not exactly\nmidnight, the existing code fixed the remainder but not the epoch day.\nThe two parts then referred to different days, so the timestamp came\nback one day late.\n\nFor example, `-618102000000` ms is 1950-06-01 01:00:00 UTC. The old\ndivision produced epoch day `-7153`, which is 1950-06-02, while the\nremainder was 01:00. The method returned 1950-06-02 01:00:00.\n\nThis affects DATE values before 1970 when\n`ArrowFlightJdbcDateVectorAccessor.getDate(Calendar)` applies a non-zero\ncalendar offset. The offset moves the value away from midnight and\nexposes the division bug.\n\nCloses #1293."
    },
    {
      "commit": "91b4a2ca418ecb47cb8871d97588b19444337eb4",
      "tree": "37c49ed32f8e947b305bd8b16b29e2c02f7b12b5",
      "parents": [
        "19a3ff5661590e5f294bb77453ce45a416121f7d"
      ],
      "author": {
        "name": "Hélder Gregório",
        "email": "helder.gregorio@dremio.com",
        "time": "Wed Sep 09 21:41:27 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 13:41:27 2026 +0900"
      },
      "message": "GH-1067: Close cached HDFS FileSystem instances (#1141)\n\n## What\u0027s Changed\n\n- This PR fixes JVM shutdown hangs after reading HDFS datasets through\nArrow Java.\n- FileSystemDatasetFactory now tracks hdfs:// URIs used to create the\nfactory. On close(), after releasing the native dataset factory, it\nbest-effort closes the matching Hadoop FileSystem instances.\n- The Hadoop cleanup is done via reflection so Arrow Java does not add a\nproduction dependency on Hadoop. Non-HDFS URIs are ignored.\n\nCloses #1067 ."
    },
    {
      "commit": "19a3ff5661590e5f294bb77453ce45a416121f7d",
      "tree": "8558d75b25a51764e0e819b8f6475054fc51ec3c",
      "parents": [
        "6a9bcf69d07dc773d5a5460bb4a99ce5e4da5a4c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Sep 09 07:35:17 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 07:35:17 2026 +0200"
      },
      "message": "MINOR: Bump com.gradle:common-custom-user-data-maven-extension from 2.3.0 to 2.4.0 (#1285)\n\nBumps\n[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)\nfrom 2.3.0 to 2.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/releases\"\u003ecom.gradle:common-custom-user-data-maven-extension\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.4.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[NEW] Detect Copilot via the \u003ccode\u003eCOPILOT_CLI\u003c/code\u003e and\n\u003ccode\u003eCOPILOT_AGENT\u003c/code\u003e environment variables, capturing the\n\u003ccode\u003eAI\u003c/code\u003e tag and \u003ccode\u003eAI agent\u003c/code\u003e value\n\u003ccode\u003eCopilot\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/fe6d769697b68c30b474260dcac4f29830078919\"\u003e\u003ccode\u003efe6d769\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release v2.4.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/91b48289e401252bae1368155043213d4a08f7eb\"\u003e\u003ccode\u003e91b4828\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/400\"\u003e#400\u003c/a\u003e\nfrom gradle/copilot-agent-detection\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/30c360f006d9aac9d2643cb98b1e1656a070510a\"\u003e\u003ccode\u003e30c360f\u003c/code\u003e\u003c/a\u003e\nDetect GitHub Copilot as an AI agent\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/2918beba01d393a587093f1b2c8286c7c853d5e2\"\u003e\u003ccode\u003e2918beb\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update dependency\norg.eclipse.sisu:org.eclipse.sisu.inject to ...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/a83ddea990a673d4ecd2c13b1a6f347322c6d600\"\u003e\u003ccode\u003ea83ddea\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/397\"\u003e#397\u003c/a\u003e\nfrom gradle/rebrand/gradle-com-to-develocity-ai\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/4774ec84ac09d3570d290c376d382d66c5555eb4\"\u003e\u003ccode\u003e4774ec8\u003c/code\u003e\u003c/a\u003e\nDrop trailing slash on bare develocity.ai URLs\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/71b2e001c437e731705176d36e7de36a3d9dd62c\"\u003e\u003ccode\u003e71b2e00\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update actions/checkout digest to 3d3c42e (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/398\"\u003e#398\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/58e6888097c28af26e4c247756b4c6247afbccff\"\u003e\u003ccode\u003e58e6888\u003c/code\u003e\u003c/a\u003e\nReplace stale gradle.com references with develocity.ai\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/a4e8baa2b38d6537c403a3f0aaa07923d89f3492\"\u003e\u003ccode\u003ea4e8baa\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update actions/setup-java digest to 03ad4de (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/396\"\u003e#396\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/6310084ba4152f792606acfe6146b45bcde2701c\"\u003e\u003ccode\u003e6310084\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update dependency org.apache.ivy:ivy to v2.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/395\"\u003e#395\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/compare/v2.3.0...v2.4.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.gradle:common-custom-user-data-maven-extension\u0026package-manager\u003dmaven\u0026previous-version\u003d2.3.0\u0026new-version\u003d2.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6a9bcf69d07dc773d5a5460bb4a99ce5e4da5a4c",
      "tree": "fdad40a331d6c85436aefda50ad30c62a32e74f7",
      "parents": [
        "ed01421e6ddd68bec00e42c1a308e8d74368af66"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Sep 07 11:05:29 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 11:05:29 2026 +0200"
      },
      "message": "MINOR: Bump org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85 (#1286)\n\nBumps\n[org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) from\n1.84 to 1.85.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md\"\u003eorg.bouncycastle:bcpkix-jdk18on\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eBouncy Castle Crypto Package - Release Notes\u003c/h1\u003e\n\u003ch2\u003e1.0 Introduction\u003c/h2\u003e\n\u003cp\u003eThe Bouncy Castle Crypto package is a Java implementation of\ncryptographic algorithms. The package is organised so that it contains a\nlight-weight API suitable for use in any environment (including the\nJ2ME) with the additional infrastructure to conform the algorithms to\nthe JCE framework.\u003c/p\u003e\n\u003ch2\u003e2.0 Release History\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003e2.1.1 Version\u003c/h3\u003e\n\u003cp\u003eRelease: 1.86\u003cbr /\u003e\nDate: 2026, TBD\u003c/p\u003e\n\u003ch3\u003e2.1.2 Defects Fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe high-level OpenPGP API (org.bouncycastle.openpgp.api) let a\nsubkey inherit the primary key\u0027s Key Flags when its own Subkey Binding\nsignature carried no Key Flags subpacket, which made the two capability\ndecisions taken for one subkey disagree.\nOpenPGPCertificate.OpenPGPComponentKey.isSigningKey() reads the\neffective flags, which fell back to the primary key\u0027s direct-key or\nprimary user ID self-signature, so a subkey bound with no flags of its\nown counted as signing-capable; verifyEmbeddedPrimaryKeyBinding reads\nthe binding signature\u0027s own flags, found no signing capability there,\nand so skipped the embedded Primary Key Binding (cross-certification)\nsignature that RFC 9580 sec. 5.2.1.8 and sec. 10.1.3 require of a subkey\nthat can issue signatures. A data signature made by such a subkey was\ntherefore attributed to the certificate and reported valid by\nOpenPGPSignature.OpenPGPDocumentSignature.isValid() with the\ncross-certification requirement never applied, where GnuPG refuses the\nsame certificate and message as not cross-certified. An attacker holding\na third party\u0027s public signing subkey - which is public material - could\nbind it to their own primary key with a Subkey Binding signature they\nare able to make, carrying no Key Flags and no embedded Primary Key\nBinding signature, which they cannot make without the subkey\u0027s private\nkey, and have that party\u0027s genuine signatures verify as valid under the\nattacker\u0027s own identity: misattribution of a real signature rather than\na forgery of a new one, since the signature still has to be one the\nsubkey actually made. Key Flags are a statement about the key the\ncarrying signature refers to (RFC 9580 sec. 5.2.3.29), so a subkey no\nlonger inherits them from the certificate-wide signatures of the primary\nkey: a Subkey Binding signature that omits the subpacket now leaves the\nsubkey with no capabilities rather than the primary\u0027s, which makes the\nflags the cross-certification check consults the same flags every other\ndecision consults. Preferences and the other subpackets a direct-key\nsignature carries are inherited as before, and the primary key itself -\nwhose flags legitimately come from its direct-key or user ID\nself-signature - is unaffected. The low-level PGPSignature /\nPGPPublicKeyRing API performs no binding checks by design and is\nunchanged.\u003c/li\u003e\n\u003cli\u003eThe high-level OpenPGP API (org.bouncycastle.openpgp.api) used a\nversion 6 key that carried no valid Direct Key signature, falling back\nto the primary user ID binding as it correctly does for a version 4 key.\nRFC 9580 sec. 5.2.3.10 requires the opposite: \u0026quot;An implementation\nMUST ensure that a valid Direct Key signature is present before using a\nversion 6 key. This prevents certain attacks where an adversary strips a\nself-signature specifying a Key Expiration Time or certain\npreferences.\u0026quot; The certificate grammar says the same structurally,\nthe Direct Key signature being mandatory in the version 6 structure of\nsec. 10.1.1 and optional in the version 4 one of sec. 10.1.3. Because a\nversion 6 certificate carries its key expiration, features and algorithm\npreferences on the Direct Key signature - the convention the RFC\nrecommends and the one OpenPGPKeyGenerator follows, its user ID\ncertification carrying no expiration at all - removing that single\nsignature packet from a published certificate silently dropped the\nexpiration along with the preferences and features:\nOpenPGPCertificate.getSignatureChainFor fell back to the user ID\nbinding, the primary key was still reported bound, and\ngetEncryptionKeys() and getSigningKeys() went on returning the subkeys\nof a key whose owner had set it to expire. The primary key fingerprint\nis unchanged by the removal, so a relying party pinning the key by\nfingerprint still treats it as the same key, and no private key or hash\ncollision is involved; the natural moment for the strip is the key\nrefresh that RFC 9580 names as the reason to refetch a key at all - to\nlearn about changes in expiration, features, preferences and revocation\n- which is exactly the update it defeats. This is a downgrade rather\nthan a forgery, nothing being attributed to a key that did not authorise\nit, and the concerning direction is encryption, to a key meant to have\nbeen retired. OpenPGPCertificate.isBoundBy now requires a valid Direct\nKey self-signature on a version 6 primary key before any component of\nthe certificate - the primary key, its subkeys or its identities - is\ntreated as bound, so a version 6 certificate stripped of it offers no\nkeys at all rather than an unexpiring set. Version 4 certificates are\nunaffected: there the key expiration legitimately lives on the user ID\nself-signature and the fallback is correct, so it stays. The\nrevocation-only version 6 certificate of sec. 10.1.2, which legitimately\ncarries no Direct Key signature, is unaffected as well - its key was\nalready refused as revoked, and reading the revocation does not go\nthrough the binding check.\u003c/li\u003e\n\u003cli\u003eThe lightweight LMSSigner and HSSSigner refused a key wrapped in\nParametersWithRandom, which is how BcContentSignerBuilder passes a key\nwhenever setSecureRandom() has been called - so\nBcHssLmsContentSignerBuilder built a working signer until a random was\nset and then failed with \u0026quot;Incorrect Key Parameters\u0026quot;, and the\ntwo signers themselves raised ClassCastException on the same input. All\nthree now unwrap it, as the promoted ML-DSA and SLH-DSA signers already\ndid. The random is accepted and not used: LMS derives its message\nrandomiser C from the key\u0027s seed and the one-time index, so it is\ndeterministic and cannot repeat while q does not. Note SP 800-208 sec.\n6.1 asks for C to come from an approved random bit generator, which this\nimplementation does not do; that is unchanged here, and a supplied\nrandom is now ignored rather than refused.\u003c/li\u003e\n\u003cli\u003eLMS signature verification did not apply two of the checks RFC 8554\nsec. 5.4.2 requires before a signature is processed. Step 2g refuses a\nsignature whose LMS typecode is not the one from the public key, and\nwithout it the path computation took its height and tree digest from the\nparameter set the signature named rather than the key\u0027s, so a signature\nclaiming a height-25 parameter set drove a 25-level computation against\na height-5 key. Step 2i refuses a leaf number q outside the tree, and\nwithout it an out-of-range q flowed into the node arithmetic and was\nleft for the candidate-root comparison to catch. Neither was a forgery -\nthe domain separation between D_LEAF and D_INTR and the final comparison\nsaw to that - but both are attacker-chosen work the specification says\nto refuse up front. Both are now checked, and a signature failing either\nis still reported as not verifying rather than thrown out of\nSignature.verify(). The catch around the signature decode in LMSSigner\nand HSSSigner has also been narrowed to the decode itself, as the\ncorresponding SPI was corrected to do for github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2408\"\u003e#2408\u003c/a\u003e:\npast the parse the engine reports an inconsistent signature by returning\nfalse rather than by throwing, so the wider catch caught nothing while\nstanding ready to turn a future internal error into a quiet false.\u003c/li\u003e\n\u003cli\u003eThe LMS and HSS key parameter classes now apply at construction the\nchecks their decoders apply, so a key built directly cannot be one the\ndecoder would refuse. LMSPrivateKeyParameters accepted an identifier of\nany length although the decoder reads exactly 16 bytes - such a key\nencoded but could not be read back - and left q, maxQ and the seed\nlength unchecked; the seed is now required to be at least m bytes at\ndecode as well, where a one-byte seed had been decoding silently and\nthen deriving every one-time key from it. HSSPrivateKeyParameters\nchecked neither its level count nor that it had been given a component\nkey per level and a chaining signature per level below the root, and\nthen indexed both lists, so a mismatch surfaced as\nIndexOutOfBoundsException - or, where a level happened to match, as a\nnull chaining signature that only failed at signing time; the level is\nnow checked after the reset that fills it in, since a null is legitimate\non the way in. LMSPrivateKeyParameters.getInstance(byte[], byte[])\nadopted the public key supplied beside the private one without comparing\nthem, so a mismatched public key was simply reported by getPublicKey();\nit now cross-checks the identifier, both parameter sets and, where the\ntree cache already holds it, the root, as the HSS entry point does. The\ndecoders also now report a bad version or seed length as IOException\nrather than IllegalStateException, so a caller can catch one type for a\nmalformed key, and the package-private LM-OTS public key decoder no\nlonger declares throws Exception or dereferences an unrecognised\ntypecode. The deprecated org.bouncycastle.pqc.crypto.lms copies carry\nthe decoder corrections.\u003c/li\u003e\n\u003cli\u003eIn the LMS JCE layer, LMSKeyGenParameterSpec.fromNames knew all\ntwenty LMS parameter-set names but only four of the sixteen LM-OTS ones,\nso none of the SP 800-208 n24 or SHAKE sets could be named; all sixteen\nare now present. KeyPairGenerator.initialize(int, SecureRandom) reports\nInvalidParameterException, which is what the JCA specifies and which\nextends the IllegalArgumentException it raised before, so existing\ncatches still match. BCLMSPrivateKey.getIndex now takes the exhaustion\ncheck and the index read under the key\u0027s own monitor rather than as two\nseparate calls, and two unused fields have gone from LMSSignatureSpi.\nNote that the LMS Signature claims its one-time key at the first\nupdate() rather than at sign(), so a Signature that is initialised and\nupdated and then abandoned spends an index without producing a signature\n- the safe direction for a one-time scheme, and now documented on the\nSPI.\u003c/li\u003e\n\u003cli\u003eEvery other key pair generator that refuses a key size did the same\nthing the LMS one did above. KeyPairGenerator.initialize(int,\nSecureRandom) is documented to raise InvalidParameterException when the\nkey size is not one the generator supports, and thirty of them raised a\nbare IllegalArgumentException instead, so a caller following the JCA and\ncatching the documented type saw an exception escaping rather than a\nrefusal. The ML-DSA, ML-KEM, SLH-DSA, Classic McEliece, FrodoKEM, NTRU\nand composite signature and KEM generators in the BC provider, and every\ngenerator in BCPQC, now raise InvalidParameterException - NewHope\nincluded, where the value is a key size it will not take rather than a\nmode of initialisation it does not offer. InvalidParameterException\nextends IllegalArgumentException, so callers written against the old\nbehaviour go on catching it unchanged. The two RSA generators are\ncorrected as well, and differently: theirs is a key size below a floor\nrather than a mode of initialisation they do not offer, and the refusal\nis raised by the lightweight RSAKeyGenerationParameters, which cannot\nname a java.security exception at all, so the RSA KeyPairGeneratorSpi\nnow translates it - keeping the message verbatim and the original\nexception as the cause, through a new\nSecurityExceptions.invalidParameterException factory, since\nInvalidParameterException has no constructor that takes one. Of the 304\nKeyPairGenerator services the two providers register, 299 now refuse a\nnonsense key size the way the JCA defines it and five accept it as a\nstrength they can work with, with none left raising a bare\nIllegalArgumentException; that is asserted as a sweep over both\nproviders rather than per algorithm, so a generator added later is\ncovered without the test being touched. The jdk1.3 provider overlays of\nthe four generators that have one carry the same change, and the jdk1.3\nSecurityExceptions overlay gains the new factory along with the\ninvalidAlgorithmParameterException one it had been missing.\u003c/li\u003e\n\u003cli\u003eKeyPairGenerator.initialize(AlgorithmParameterSpec, SecureRandom)\nhad the same shape of problem as the int overload above, and only 44 of\nthe 304 services the two providers register reported an unusable spec as\nthe InvalidAlgorithmParameterException that method declares. The\ntwenty-three PQC generators that resolve a parameter set by name - cmce,\nfrodokem, mldsa, mlkem, slhdsa, aimer, bike, faest, falcon, haetae, hqc,\nmayo, mqom, ntru, ntruplus, both ntruprime variants, qruov, saber,\nsdith, smaugt, snova and sqisign, 230 services between them -\ncase-folded the name they got back from the spec without checking it, so\na spec with no getName() method, and a null spec, produced a\nNullPointerException from inside the fold; their own \u0026quot;is this name\none I know\u0026quot; branch, which does report the declared exception, was\nunreachable. The two composite generators, whose parameter set is fixed\nby the algorithm name so that null is the only spec they accept, refused\nevery other one with IllegalArgumentException. RSA answered correctly\nfor a spec of the wrong type but not for one of the right type carrying\nvalues its lightweight parameters will not take - an even public\nexponent, or a key size below the floor - which is now translated the\nsame way the int overload\u0027s is. All 304 services now report the declared\nexception, with the composites still taking the null spec that is right\nfor them; note that InvalidAlgorithmParameterException is a checked\nexception and not an IllegalArgumentException, so a caller that was\ncatching what these threw before has to catch the declared type\ninstead.\u003c/li\u003e\n\u003cli\u003eAn HSS private key claimed the two records of its position under two\ndifferent monitors. The top-level index and the bottom component key\u0027s\none-time index q are independent records of the same position - the\ndecoder requires them to agree, see the entry below - but\ngenerateLMSContext incremented the index under the HSS key\u0027s own\nmonitor, released it, and only then claimed q under the component key\u0027s.\nA getEncoded() issued in between saw the index advanced and q not, and\nproduced an encoding this implementation\u0027s own decoder rejects; and two\nthreads meeting at a bottom-tree boundary could both pass the exhaustion\ntest, take consecutive top-level indices and claim the same q, after\nwhich one of them was refused with \u0026quot;ots private key exhausted\u0026quot;\nby a key still reporting usages remaining, a top-level index had been\nspent with no signature made, and the two records stayed one apart for\nthe rest of the key\u0027s life in that process - so it could no longer be\nencoded, cloned or sharded, and getIndex() and getUsagesRemaining()\nmisreported by one. No one-time key was reused: the component key\u0027s\nclaim is itself atomic, and the divergence runs index ahead of leaves,\nso the effect was on the key\u0027s usability rather than on the signatures\nit had made. Both records are now claimed under the one monitor, and the\ncomponent key is claimed before the index is incremented so that an\nexhausted one leaves both untouched. The deprecated\norg.bouncycastle.pqc.crypto.lms copy carries the same correction.\u003c/li\u003e\n\u003cli\u003eTimeStampToken parsed the attacker-controlled TSTInfo content of a\ntime-stamp token (org.bouncycastle.tsp.TimeStampToken, reached from\nTimeStampResponse(byte[]) and (InputStream)) inside a try that caught\nonly CMSException, so a well-formed RFC 3161 TimeStampResp whose\nembedded token carried a malformed TSTInfo - a SEQUENCE with fewer\nelements than the five mandatory fields, a non-SEQUENCE, truncated DER,\nor an unknown context tag - let an IllegalArgumentException or a\nNoSuchElementException escape the constructor\u0027s declared throws\nTSPException, IOException contract. A token signed by no signers or by\nmore than one raised a bare IllegalArgumentException from the same\nconstructor, before that try, for the same reason. Both are now reported\nas TSPException, matching the package-private\nTimeStampResponse(DLSequence) constructor and the existing\ngetSignedAttributes guard in the same method; the signer-count refusal\nis a TSPValidationException, as the neighbouring check on the content\ntype already was. Related, and the cause of the NoSuchElementException:\nasn1.tsp.TSTInfo read its five mandatory fields off the sequence with no\nbound on how many elements were actually there, so a short SEQUENCE left\nthe enumeration to run out rather than being refused, and an oversize\none was accepted with its extra elements absorbed into the optional\nslots. Decode now requires the five to ten elements RFC 3161 sec. 2.4.2\ngives the type, which is what the sibling Accuracy and ArchiveTimeStamp\ndecoders already did, so the failure is the IllegalArgumentException\nthat getInstance is expected to raise (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2415\"\u003e#2415\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eNeither the HSS nor the XMSS^MT private key decoder checked its\ndeclared index against the traversal state stored beside it, although\nthe two are independent records of the same position in the key and so\ncan be compared. For HSS the records are the top-level index and the\ncomponent keys\u0027 one-time indices q; for XMSS^MT they are the global\nindex and the per-layer BDS states. A stored key whose index had been\nrolled back while its state stayed advanced - a partial write, a restore\nfrom backup, a buggy storage layer - was therefore accepted, and it then\nsigned a second message under a one-time key the key had already used,\nproducing a signature that verified, so nothing anywhere surfaced the\nreuse. RFC 8554 sec. 1 and RFC 8391 sec. 1.1 both require each one-time\nkey to be used exactly once, and this is the failure those requirements\nexist to prevent; the single-tree XMSS decoder has tied its BDS state to\nits index since that state was first validated, and this brings the two\nmulti-tree schemes into line. HSS decode now requires the declared index\nto equal the position the component q values imply - a level above the\nlast contributes (q - 1) leaves of the levels beneath it, since its q\nhas already advanced past the subtree it signed - and XMSS^MT decode now\nrequires each present layer\u0027s BDS index to equal the leaf index that\nlayer derives from the global index, allowing the one position where a\nlayer has moved into a new subtree and its state legitimately still\ncarries the previous subtree\u0027s final index. A layer with no state yet is\nunaffected, since those are built lazily at signing time. Related, and\nthe same shape of omission: an XMSS or XMSS^MT private key encoding\ncarries the tree root twice - the key\u0027s own root field and the root node\nof the BDS state stored beside it, which for XMSS^MT is the top layer\u0027s\n- and the two were never compared either. A corrupted root was accepted\nand then poisoned every signature the key made, because the root is\nhashed into the message digest: the signature did not verify and nothing\nindicated why. Decode now requires the two copies to agree. The BDS node\nvalues themselves are not checkable the way the LMS tree cache above is\n- a BDS authentication path, stack, retain or keep node does not have\nits children stored alongside it, so recomputing one means building a\nsubtree, which is the work the state exists to avoid. Both checks are\ninteger comparisons over the levels of the key, too small to measure\nagainst the surrounding decode, and both were verified not to reject any\nlegitimate key by walking every index a key can reach: the full key\nspace of the two-level HSS and the h\u003d4/d\u003d2, h\u003d6/d\u003d2, h\u003d6/d\u003d3, h\u003d9/d\u003d3\nand h\u003d8/d\u003d4 XMSS^MT parameter sets, plus a three-level HSS key across a\nsubtree boundary and an HSS shard. Since those node values cannot be\nrecomputed, the encoded state now carries a checksum over itself\ninstead, with the owning key\u0027s public seed hashed in front of it. Any\ncorruption of the stored state is refused at decode rather than being\nloaded and then producing signatures that silently do not verify, and\nbecause the public seed is bound in, a state transplanted between two\nkeys of the same parameter set is refused too, even though it is\ninternally consistent and arrives with its own matching root. The public\nseed is bound rather than the secret seed or the PRF key deliberately:\nthe state\u0027s own root and index are inside the encoding and so are\nalready covered, hashing secret material would make the stored checksum\na commitment to it for no gain in detection, and the PRF key does not\ninfluence the state at all. \u003cstrong\u003eThis is an error-detecting code and\nnot integrity protection\u003c/strong\u003e - anyone able to rewrite the stored\nkey recomputes it, so it establishes that the state is unchanged since\nit was written, never that it was correct when written, and the\nallocation bounds on the encoding remain the guard against a crafted\none. It costs one SHA-256 over the state, measured at 5 to 8\nmicroseconds each way for the h\u003d10 and h\u003d16 parameter sets, and 32 bytes\nof encoding. The state encoding was added earlier in this same cycle and\nhas not been released, so the checksum is simply part of it rather than\na new version: a state written by a 1.86 beta is rejected, which is\nrecovered from by re-exporting the key. The deprecated\norg.bouncycastle.pqc.crypto.lms copy carries the HSS check as well\n(github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2414\"\u003e#2414\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eThe S/MIME example smoke test in the misc module\n(org.bouncycastle.mail.smime.examples.test.AllTests) drove\nSendSignedAndEncryptedMail against smtp.gmail.com, and that example\nfinishes with Transport.send() under JavaMail\u0027s default settings, which\nhave no connect timeout. Where outbound port 25 is refused the failure\nwas swallowed and the test passed; where it is silently dropped, as on\nmany home networks, the connect blocked and ./gradlew build hung in\n:misc:test indefinitely with \u0026quot;0 tests completed\u0026quot;. The test now\ndelivers to an SMTP stub on a loopback port, with connect / read / write\ntimeouts as a backstop, and asserts the message arrived (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2407\"\u003e#2407\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eComposite ML-KEM encapsulation took the traditional component public\nkey bytes it feeds the KEM combiner from the recipient key\u0027s own\nencoding, while decapsulation recomputes the point from the private key\nand so always produced an uncompressed one. Section 4 of\ndraft-ietf-lamps-pq-composite-kem requires an EC component to be carried\nas an uncompressed point, but a component key that encodes itself\ncompressed - a BC EC key whose point format has been set through\norg.bouncycastle.jce.interfaces.ECPointEncoder, or a key from a provider\nthat preserves a compressed encoding - was passed through as it came.\nBoth sides then combined a different tradPK and derived different shared\nsecrets, with no error reported on either: encapsulation and\ndecapsulation both succeeded and the recipient simply could not decrypt.\nThe EC component is now normalised to an uncompressed point wherever the\nengine serialises one, which covers the ephemeral key that forms the\nciphertext as well. X25519 and X448 components have a single encoding\nand were unaffected, as were EC keys left in their default\n(uncompressed) format, whose shared secrets are unchanged.\nCompositePublicKey.getEncoded() took its component bytes the same way,\nso such a key also encoded to a composite key other implementations\nreject and whose bytes changed across an encode / decode / encode round\ntrip - 1238 bytes rather than 1270 for MLKEM768-ECDH-P256, and for the\ncomposite ML-DSA keys sharing that method, 2006 rather than 2038 for\nMLDSA65-ECDSA-P256. It now normalises the component the same way. This\nis a write-side change only: a composite key carrying a compressed EC\ncomponent is still decoded, since the component key factories accept\neither form, and continues to verify signatures as before - it simply\nre-encodes in the normalised form. The shared normalisation is\norg.bouncycastle.jcajce.provider.asymmetric.util.ECUtil.getUncompressedSubjectPublicKeyBytes.\u003c/li\u003e\n\u003cli\u003eComposite ML-KEM encapsulation threw a NullPointerException, wrapped\nin an IllegalStateException out of KeyGenerator.generateKey(), when the\nSecureRandom it was given was null - which\njavax.crypto.KEM.newEncapsulator() documents as a request for the\nprovider\u0027s default, and which KeyGenerator.init(spec, null) passes\nstraight through. The three RSA-OAEP composites draw the traditional\nshared secret from that random directly, so they were the ones affected;\nthe ECDH and X25519 / X448 composites escaped only because their\ncomponent KeyPairGenerators default a random of their own.\nCompositeMLKEMEngine now defaults one through\nCryptoServicesRegistrar.getSecureRandom() on first use, as the composite\nKEM Cipher\u0027s wrap path already did, and as the KEM generators corrected\nearlier in this cycle now do. Related, the engine now also clears the\nML-KEM component\u0027s shared secret alongside the traditional one on both\nthe encapsulate and decapsulate paths - the copy handed back by\ngetEncoded() was left in the heap - as section 3.5 of\ndraft-ietf-lamps-pq-composite-kem requires.\u003c/li\u003e\n\u003cli\u003eCompositePublicKey.getAlgorithm() and\nCompositePrivateKey.getAlgorithm() returned null for all twelve\nComposite ML-KEM (draft-ietf-lamps-pq-composite-kem) parameter sets.\nBoth classes resolved the name through the composite signature index\nonly, which holds the composite ML-DSA OIDs, so a composite KEM key pair\n- generated, parsed from a certificate, or read from PKCS#8 - reported\nno algorithm at all, and the standard JCA idiom of reconstructing a key\nwith KeyFactory.getInstance(key.getAlgorithm()) raised a\nNullPointerException. The lookup now falls back to the composite KEM\nindex, so the name returned is the one the provider registers the\nalgorithm under (e.g. MLKEM768-X25519-SHA3-256), matching the composite\nML-DSA behaviour. The same single-index assumption made the\nCompositePublicKey(SubjectPublicKeyInfo) and\nCompositePrivateKey(PrivateKeyInfo) constructors reject a composite KEM\nkey with \u0026quot;unable to create CompositePublicKey from\nSubjectPublicKeyInfo\u0026quot;; they now dispatch to the composite KEM key\nfactory for those OIDs. Keys obtained through KeyFactory or through\nBouncyCastleProvider.getPublicKey / getPrivateKey were unaffected and\nare unchanged (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2404\"\u003e#2404\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eThe org.bouncycastle.jcajce.spec.KEMKDFSpec constructor stored a\nnull otherInfo as given, so getOtherInfo() returned null, and three of\nthe KDF branches KdfUtil.makeKeyBytes dispatches to - KMAC-128, KMAC-256\nand SHAKE-256 - read the otherInfo length without a guard and threw\nNullPointerException out of the KEM operation, where the KDF2, KDF3 and\nHKDF branches tolerate a null through KDFParameters / HKDFParameters.\nThe Builder of every spec in the package already mapped null to empty,\nso no provider path reached it, but the constructor is protected on a\npublic class and KdfUtil is documented for callers building their own\nKEM integration; the deprecated KEMParameterSpec passes a null itself\nand escaped only because it also pins the KDF to null. The constructor\nnow stores empty for a null, so getOtherInfo() never returns null, and a\nnull and an explicitly empty otherInfo derive the same key.\u003c/li\u003e\n\u003cli\u003eQR-UOV signature verification accepted a signature encoding that was\nnot canonical, so the encoding of a signature was not unique even after\nthe trailing-byte fix of github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2403\"\u003e#2403\u003c/a\u003e.\nEach F_q element of the signature is stored in ceil(log2 q) bits, one\nmore bit pattern than the field has elements: q itself is representable\nand is arithmetically congruent to zero, so an element written as q\nverified exactly as the same element written as zero would, and the bits\npadding the last element out to the byte boundary were never read at\nall. Every zero element of a signature therefore carried a second\nencoding, and for the q \u003d 7 parameter sets roughly one element in seven\nis zero - a single qruov_5_q7_L10 signature measured 256 spare bits, so\non the order of 2^256 distinct byte strings verified for the one message\nand key. Verification now rejects any element outside [0, q) and any set\npadding bit; a signature produced by this or by the reference\nimplementation is unaffected, as the KAT vectors of every parameter set\nconfirm. (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2403\"\u003e#2403\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSNOVA signature verification ignored four bits inside the signature\nfor any parameter set whose solution is an odd number of GF(16) nibbles\n- the SNOVA_24_5_5, SNOVA_25_8_3, SNOVA_29_6_5 and SNOVA_66_15_3\nfamilies, sixteen of the forty-four parameter sets. The last byte of the\nencoded solution carries a single nibble and the signer leaves the top\nfour bits zero, but the decoder did not read them, so sixteen distinct\nbyte strings verified for one signature. This is the same non-unique\nencoding github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2403\"\u003e#2403\u003c/a\u003e\nclosed for bytes following the signature, applied inside it; the\nverifier now requires those bits to be zero. (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2403\"\u003e#2403\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSnovaPrivateKeyParameters did not validate the length of the private\nkey encoding handed to it - the only one of the five schemes of github\n\u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2403\"\u003e#2403\u003c/a\u003e\nthat did not - and SnovaParameters.getPrivateKeyLength() reported the\nexpanded (\u0026quot;ESK\u0026quot;) length even for a parameter set whose private\nkey is the seed pair. A private key encoding reaches this constructor\nstraight from a PKCS#8 blob, so a wrong length went undetected: a\nseed-form key with extra bytes appended was accepted and signed under a\ndifferent derived key, and a short expanded-form key sized the signer\u0027s\ndecode buffer negatively, throwing NegativeArraySizeException out of\ngenerateSignature() rather than being reported at construction. Related,\nthe signing retry loop could not terminate: the vinegar values are\nderived from a single-byte counter, so only 256 distinct linear systems\ncan be tried, and an expanded-form private key that is not a real\ncentral map is singular for all of them - generateSignature() then span\nforever rather than failing. The length is now checked at construction,\ngetPrivateKeyLength() reports the length that parameter set\u0027s private\nkey actually has, and the retry loop gives up after its 256 attempts as\nMAYO\u0027s does.\u003c/li\u003e\n\u003cli\u003eMayoSigner and MayoKeyPairGenerator did not clear several buffers\nholding secret key material that the MAYO reference implementation\nexplicitly clears. Signing left the secret oil space O, the expanded L \u003d\n(P1 + P1^t) * O + P2, and the M / VPV / Ox intermediates of the central\nmap in place, having gone to the trouble of clearing eleven other\nbuffers; key generation left the expanded seed, whose tail is the\nencoded oil space, and the P1 * O + P2 half of P; and the row-echelon\nstep left the packed echelon form of the secret linear system and its\npivot rows. Separately, if all 256 attempts at solving for the signature\nhad given a rank-deficient system, signing emitted a signature built\nfrom the failed attempt\u0027s state instead of reporting the failure the\nreference returns, and AIMerSigner.generateSignature returned an empty\narray on failure, which a caller would hand on as though it were a\nsignature. Both now throw.\u003c/li\u003e\n\u003cli\u003eFive PQC signature schemes - MAYO, SNOVA, QR-UOV, SQIsign and AIMer\n- returned the NIST crypto_sign \u0026quot;sm\u0026quot; signed-message envelope\nfrom generateSignature() rather than the signature. That envelope is an\nartefact of the reference KAT harness, which records the message\nalongside the signature so a vector file can be self-contained; it is\nnot part of any of the five specifications, and no other BC signer emits\nit (Falcon\u0027s KAT test rebuilds the equivalent envelope in the test,\nwhich is where it belongs). Two consequences followed, both reaching the\nJCA Signature services of every parameter set of the five schemes in\nBouncyCastlePQCProvider. First, since the message was appended to the\nsignature, verification had to skip whatever followed the signature\nproper, and it did so by checking only that the buffer was long enough -\nso any number of trailing bytes could be added to a valid signature, or\nthe appended message replaced with unrelated data, and it still\nverified. A signature encoding was therefore not unique: anyone holding\none valid signature could produce unlimited distinct byte strings that\nall verified for the same message and key, which breaks any use that\ntreats the signature bytes as an identifier, deduplicates on them, or\nrecords them as evidence. Second, the envelope propagated into\neverything built on the operator layer: because ContentSigner hands the\nsignature straight into the structure being signed, every X.509\ncertificate, CRL, CMS SignedData and TLS CertificateVerify BC produced\nwith one of these algorithms carried a verbatim copy of the signed data\ninside its own signature field - a self-signed MAYO-1 certificate came\nto 3567 bytes where the same certificate is now 2020 - which no other\nimplementation can parse as a signature, and which in a detached CMS\nsignature meant the \u0026quot;detached\u0026quot; signature carried the content.\ngenerateSignature() now returns the bare signature, and\nverifySignature() requires exactly the parameter set\u0027s signature length,\nso appended or truncated data is rejected rather than ignored.\n\u003cstrong\u003eThis is a behavioural change for signatures produced by an\nearlier release\u003c/strong\u003e - MAYO and SNOVA from 1.84, QR-UOV, SQIsign and\nAIMer from 1.85 - which are no longer accepted in the envelope form they\nwere emitted in; the signature bytes themselves are unchanged, so a\nstored value can be recovered by taking the leading signature-length\nbytes, or for AIMer, whose envelope was message || signature rather than\nsignature || message, the trailing ones. The KAT tests now rebuild the\nenvelope before comparing against the vector files, which continue to\nrecord it. Note that AIMer\u0027s verification had already been made\nlength-exact during this cycle (see the entry below relating to github\n\u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2401\"\u003e#2401\u003c/a\u003e),\nso of the five only its envelope remained (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2403\"\u003e#2403\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eThe MLS implementation did not bind an X.509 credential to the\nLeafNode\u0027s signature_key. LeafNode.verify() checked a leaf\u0027s signature\nagainst the signature_key declared in the leaf itself, while the X.509\ncredential\u0027s certificate chain was stored but never parsed or checked,\nso the certificate\u0027s public key was never required to match\nsignature_key (RFC 9420 sec. 5.3). A leaf could therefore carry one\nparty\u0027s certificate while being signed by an unrelated key and still be\naccepted under that party\u0027s identity through KeyPackage.verify() and the\nGroup leaf-validation path. LeafNode.verify() now requires the\nend-entity certificate\u0027s subject public key, in the cipher suite\u0027s\nsignature encoding, to equal signature_key for an X.509 credential, and\nrejects the leaf otherwise - including an empty chain or a certificate\nwhose key type does not match the cipher suite; certificate-chain and\nidentity validation to a trust anchor remain the application\u0027s\nresponsibility per RFC 9420 sec. 5.3.1. A public\norg.bouncycastle.mls.codec.Certificate(byte[]) constructor and a\nCredential.getCertificates() accessor are added so callers can build and\ninspect X.509 credentials. Basic credentials are unaffected.\u003c/li\u003e\n\u003cli\u003eThe SecureRandom supplied to\norg.bouncycastle.cms.jcajce.JceCMSContentEncryptorBuilder.setSecureRandom()\ndid not drive the content IV / nonce for any algorithm other than RC2.\nEnvelopedDataHelper.generateParameters passed the caller\u0027s SecureRandom\nto the AlgorithmParameterGenerator only in the RC2_CBC branch; every\nother content-encryption algorithm - AES-CBC, AES-GCM, AES-CCM,\nCamellia, ARIA, SEED and the rest - reached pGen.generateParameters() on\nan uninitialised generator, so the IV / nonce was drawn from a default\nSecureRandom and setSecureRandom() was silently ignored (the builder\u0027s\njavadoc states that random is used for IV/nonce generation). The\ngenerator is now initialised with the supplied random on the general\npath as well, so a caller who provides a specific randomness source -\nfor a controlled or FIPS-approved DRBG, say - has it honoured for the\ncontent IV / nonce. The session-key generation path was unaffected and\nalready used the supplied random. Because the content IV / nonce now\ncomes from the supplied SecureRandom, the org.bouncycastle.crypto.util\nJournalingSecureRandom / JournaledAlgorithm reproducible-encryption\nsupport records it in the transcript: a resumed session reproduces the\nIV / nonce by regenerating it from the replayed randomness - build the\nresuming encryptor from the content-algorithm OID - rather than by\nreusing the AlgorithmIdentifier captured from the first encryption,\nwhich no longer keeps the transcript aligned.\u003c/li\u003e\n\u003cli\u003eThe NTRU LPRime, NTRU+ and SMAUG-T KEM generators threw a\nNullPointerException when constructed with a null SecureRandom, where\nevery other KEM generator - including NTRU LPRime\u0027s own SNTRU Prime\ncounterpart in the same package - defaults one through\nCryptoServicesRegistrar.getSecureRandom(). This is reachable from the\nlightweight API directly, and from javax.crypto.KEM, whose\nnewEncapsulator() documents a null random as a request for the\nprovider\u0027s default.\u003c/li\u003e\n\u003cli\u003eFrodoKEMEngine kept a single SHAKE instance in a field, so an engine\nreached concurrently produced wrong results. It is reached that way\nthrough org.bouncycastle.crypto.kems.FrodoKEMExtractor, which holds one\nengine for its lifetime: two threads extracting through one extractor\ninterleaved the digest\u0027s absorb and squeeze phases, yielding shared\nsecrets that silently did not match the sender\u0027s, or an\nIllegalStateException of \u0026quot;attempt to absorb while squeezing\u0026quot;\nfrom inside extractSecret. The digest is now built per call, as\nCMCEEngine\u0027s already was, which makes an extractor safe to share.\nEncapsulation was unaffected, since FrodoKEMGenerator builds an engine\nper call. Results for any single-threaded use are unchanged - the\nreference KAT vectors are byte-identical.\u003c/li\u003e\n\u003cli\u003eThe BCJSSE provider carried the TLS 1.2 coupling between the\nsupported_groups extension and ECDSA over into TLS 1.3: an ECDSA\nsignature scheme was treated as usable - offered in the\nsignature_algorithms and signature_algorithms_cert extensions, and\neligible when selecting the local credentials - only while the\ncorresponding curve was among the named groups enabled for key exchange,\nboth per context (a group unavailable for key agreement disabled the\nscheme outright) and per connection (the curve had to be in the\nsupported_groups list about to be sent). RFC 8446 sec. 4.2.7 scopes\nsupported_groups to key exchange only, with signature algorithms\nnegotiated independently (sec. 4.2.3), so this incorrect restriction in\nTLS 1.3 has been removed. Ed25519, Ed448 and the RSA schemes were\nunaffected (as well as typical deployments using a default configuration\nfor named groups).\u003c/li\u003e\n\u003cli\u003eThe bcmail module descriptor did not declare its\njavax.mail/javax.activation dependences, so a modular (module-path)\nconsumer of the jar hit IllegalAccessError/module-resolution failures\nwhen the S/MIME classes touched the mail API. The descriptor now\nrequires them optionally (requires static) under all four module names\nthose libraries are known by - the automatic names mail and activation\ncarried by the javax.mail:mail / javax.activation:activation artifacts,\nand the explicit names java.mail and java.activation carried by the\nnewer com.sun.mail / com.sun.activation ones - a hard requires on any\none name would break users of the others (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2389\"\u003e#2389\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eFour type-coercion helpers in the OER / IEEE 1609.2 (ITS) decoder\ntested the wrong type in the identity fast path that lets a\ngetInstance() factory return an argument that is already of the target\ntype. org.bouncycastle.oer.its.ieee1609dot2.basetypes.UINT32.getInstance\nand org.bouncycastle.oer.its.etsi102941.basetypes.Version.getInstance\nguarded on UINT8 - a sibling of UINT32 under UintBase, and unrelated to\nVersion - so passing a UINT8 threw ClassCastException, while passing an\nactual UINT32 or Version missed the fast path and fell through to\nASN1Integer.getInstance, which rejects them: neither factory accepted\nits own type.\norg.bouncycastle.oer.its.etsi103097.EtsiTs103097DataEncryptedUnicast.getInstance\nguarded on its sibling EtsiTs103097DataEncrypted and then cast to the\nunicast type, so an EtsiTs103097DataEncrypted threw ClassCastException.\norg.bouncycastle.oer.OEROptional.getObject(Class) called\nvalue.getClass().isInstance(type) with the arguments transposed, which\nis always false because the argument is a java.lang.Class, so the cast\npath was dead and every optional field was resolved reflectively,\nfailing with IllegalStateException for a target type with no static\ngetInstance. Each guard now names the type it returns, matching the\nsibling UINT8 / UINT16 / UINT64 and EtsiTs103097DataEncrypted factories\n(github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2373\"\u003e#2373\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eDefaultAlgorithmNameFinder and DefaultSignatureNameFinder had no\nentries at all for the ShangMi algorithms, so an SM2 signature\nAlgorithmIdentifier that DefaultSignatureAlgorithmIdentifierFinder\nitself produces came back named only by its OID string -\ngetAlgorithmName(GMObjectIdentifiers.sm2sign_with_sm3) returned\n\u0026quot;1.2.156.10197.1.501\u0026quot; and hasAlgorithmName returned false.\nBoth finders now name sm2sign_with_sm3 as SM3WITHSM2 and\nsm2sign_with_sha256 as SHA256WITHSM2, and DefaultAlgorithmNameFinder\nadditionally names the sm3 digest. All three resolve through the BC\nprovider, as Signature and MessageDigest respectively. The remaining GM\narc - the SM4 cipher modes, the sm2encrypt variants, and the SM1 / SM6 /\nSSF33 ciphers BC does not implement - is still unnamed (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2377\"\u003e#2377\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eThe RFC 4998 evidence-record classes compared the digest\nAlgorithmIdentifier named by a time-stamp authority with the one their\nown DigestCalculator uses, and did so with AlgorithmIdentifier.equals(),\nwhich compares the encodings. A TSA that names SHA-256 with an explicit\nNULL parameters field - DigiCert among them - therefore failed against\nBC\u0027s own calculator, which names it with the parameters absent, and\nERSArchiveTimeStampGenerator.generateArchiveTimeStamp rejected the\nresponse with \u0026quot;time stamp imprint for wrong algorithm\u0026quot;. Both\nspellings name the same digest and RFC 5754 sec. 2 requires a receiver\nto accept either, while requiring that identifiers be generated with the\nparameters absent, which BC already does. The three affected comparisons\n- the two in ERSArchiveTimeStampGenerator and the digest check in\nERSEvidenceRecord.renew - now use the new\nAlgorithmIdentifier.areEquivalent, which matches on the algorithm and\ntreats an absent parameters field and NULL as the same, and the\nconsistency check across an evidence record\u0027s archive time stamp chain\nuses it too. An identifier carrying an actual parameter structure is\nnever equivalent to one carrying none (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2379\"\u003e#2379\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eEDIPartyName.toASN1Primitive emitted the nameAssigner and partyName\nDirectoryStrings without their context tags, so an EDIPartyName built\nthrough its public constructor could not be parsed back by\nEDIPartyName.getInstance, which correctly requires them. RFC 5280 sec.\n4.2.1.6 tags both members [0] and [1], and those tags are explicit\ndespite the module\u0027s IMPLICIT TAGS because DirectoryString is a CHOICE,\nwhich X.680 does not allow to be tagged implicitly - the decoder already\nhad this right. The encoder now matches it. Note the type was added\nduring the 1.85 cycle and GeneralName validates its ediPartyName\nalternative through it, so a GeneralName carrying an untagged\nediPartyName - including one BC itself produced - is rejected where 1.84\npassed it through unexamined; the untagged form is not read leniently\n(github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2380\"\u003e#2380\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRSASSA-PSS could not be used with a RIPEMD digest through the JCA\nAPI. Nothing registered the RIPEMD PSS signatures, so\nSignature.getInstance(\u0026quot;RIPEMD160WITHRSAANDMGF1\u0026quot;) raised\nNoSuchAlgorithmException, and the generic RSASSA-PSS route with an\nexplicit PSSParameterSpec failed too:\norg.bouncycastle.jcajce.provider.util.DigestFactory.getDigest returned\nnull for a RIPEMD name, and isSameDigest - an allow-list of the SHA\nfamilies and MD5 - reported two identical RIPEMD names as different\ndigests, so the spec was rejected with \u0026quot;digest algorithm for MGF\nshould be the same as for PSS parameters\u0026quot;. isSameDigest now answers\ntrue for equal names whatever the digest, which also covers Whirlpool,\nSM3, GOST3411 and anything else outside that allow-list; DigestFactory\nrecognises RIPEMD128, RIPEMD160 and RIPEMD256 by name and OID; the three\nPSS signatures are registered with MGF1 over the same digest and a salt\nof the digest length; and DefaultSignatureAlgorithmIdentifierFinder\ngains the matching RIPEMD*WITHRSAANDMGF1 entries with their\nRSASSA-PSS-params, so the operator/JcaContentSignerBuilder path works as\nwell. Note BC continues to require the PSS hash and the MGF1 hash to be\nthe same, which RFC 8017 does not itself demand (github \u003ca\nhref\u003d\"https://redirect.github.com/bcgit/bc-java/issues/2381\"\u003e#2381\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eThe opt-in key-size validation on CMS key-transport recipients\n(org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true))\nnever ran for a message using RFC 9709 CEK derivation\n(id-alg-cek-hkdf-sha256): the branch that should have selected the\nactual content-encryption algorithm carried in the KDF\nAlgorithmIdentifier\u0027s parameters compared the encrypted-key byte array\nagainst the id-alg-cek-hkdf-sha256 object identifier - a comparison that\nis always false - so the check fell through to a key-size lookup on the\nouter KDF OID, which has no registered key size, and silently checked\nnothing. A key-transport EnvelopedData/AuthEnvelopedData whose\ntransported (and HKDF-derived) content-encryption key did not match the\nkey size of the advertised content-encryption algorithm was therefore\naccepted even with validation enabled. The recipient now dispatches on\nthe content-encryption AlgorithmIdentifier\u0027s algorithm OID, so key-size\nvalidation of RFC 9709 messages checks the recovered key against the\ninner content-encryption algorithm. Messages with a matching key size,\nnon-HKDF messages, and recipients that do not enable validation are\nunaffected.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/bcgit/bc-java/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.bouncycastle:bcpkix-jdk18on\u0026package-manager\u003dmaven\u0026previous-version\u003d1.84\u0026new-version\u003d1.85)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ed01421e6ddd68bec00e42c1a308e8d74368af66",
      "tree": "d57d11b463472faa73ff36ba313c3e97e92563f4",
      "parents": [
        "d708b4429ebc68ba2273cf64d925cf3cc70f84c2"
      ],
      "author": {
        "name": "Pedro Matias",
        "email": "pedro.matias@dremio.com",
        "time": "Sun Sep 06 17:16:02 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 18:16:02 2026 +0200"
      },
      "message": "GH-1271: [Flight] Reject port 0 in NettyClientBuilder (#1282)\n\n## What\u0027s changed\n\nPort validation in `NettyClientBuilder.build()` is tightened to\nexplicitly disallow port 0, as it is not a valid destination port number\nfor a client.\nTests that made use of port 0 were updated to use a valid port under the\nnew validation.\n\n## Are these changes tested?\nYes. `ConnectionTest.testUnencryptedConnectionProvidingInvalidPort` was\nexpanded to cover more invalid ports, including port 0.\n\nThis change was created with AI assistance (Claude Code). All lines were\nmanually reviewed by a human. The output is not copyrightable subject\nmatter.\n\nCloses #1271.\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "d708b4429ebc68ba2273cf64d925cf3cc70f84c2",
      "tree": "6b2559ff1585f602cc6181fd25ae867a14e45797",
      "parents": [
        "e2dc2b738a1c09ca97b69924cb3b1f236dc1673a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 03 20:52:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 20:52:55 2026 +0200"
      },
      "message": "MINOR: [CI] Bump actions/setup-java from 5 to 6 (#1273)\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5\nto 6.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edist: Migrate from Zulu Discovery API to Azul Metadata API by \u003ca\nhref\u003d\"https://github.com/jameswald\"\u003e\u003ccode\u003e@​jameswald\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1010\"\u003eactions/setup-java#1010\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add .mvn/extensions.xml to Maven cache key pattern by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1041\"\u003eactions/setup-java#1041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1078\"\u003eactions/setup-java#1078\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMap Zulu x86 architecture to i686 for Azul Metadata API by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1079\"\u003eactions/setup-java#1079\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRename jdkFile input to jdk-file with deprecated alias by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1083\"\u003eactions/setup-java#1083\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInfer distribution from asdf .tool-versions vendor prefix by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1084\"\u003eactions/setup-java#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Maven compiler problem matcher for javac diagnostics by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1086\"\u003eactions/setup-java#1086\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: expose cache-primary-key output (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/597\"\u003e#597\u003c/a\u003e)\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1088\"\u003eactions/setup-java#1088\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify V6 ESM migration is not a user-facing breaking change\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1090\"\u003eactions/setup-java#1090\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport multi-field Java versions like \u003ccode\u003e18.0.1.1\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1092\"\u003eactions/setup-java#1092\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: document seeding the Maven cache for plugin dependencies by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1094\"\u003eactions/setup-java#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify Maven cache paths and key hash inputs by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1096\"\u003eactions/setup-java#1096\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport pinning java-version as \u0026quot;latest\u0026quot; by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1093\"\u003eactions/setup-java#1093\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1101\"\u003eactions/setup-java#1101\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1103\"\u003eactions/setup-java#1103\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1105\"\u003eactions/setup-java#1105\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/checkout from 6 to 7 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1106\"\u003eactions/setup-java#1106\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​types/node\u003c/code\u003e from 26.1.0 to\n26.1.1 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1104\"\u003eactions/setup-java#1104\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Cover Tencent Kona JDK 25 by \u003ca\nhref\u003d\"https://github.com/johnshajiang\"\u003e\u003ccode\u003e@​johnshajiang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1108\"\u003eactions/setup-java#1108\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1102\"\u003eactions/setup-java#1102\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePreserve Maven toolchains across repeated setup-java runs (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1099\"\u003e#1099\u003c/a\u003e)\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1111\"\u003eactions/setup-java#1111\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Support Liberica NIK (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/878\"\u003e#878\u003c/a\u003e)\nby \u003ca href\u003d\"https://github.com/asm0dey\"\u003e\u003ccode\u003e@​asm0dey\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1112\"\u003eactions/setup-java#1112\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection (zizmor alert \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/118\"\u003e#118\u003c/a\u003e)\nin e2e-versions.yml by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1114\"\u003eactions/setup-java#1114\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix template injection in e2e-versions.yml (zizmor alert \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/122\"\u003e#122\u003c/a\u003e)\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1120\"\u003eactions/setup-java#1120\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDisable persisted checkout credentials in e2e workflow by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1115\"\u003eactions/setup-java#1115\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: Update recommended configuration for GPG signing by \u003ca\nhref\u003d\"https://github.com/wetneb\"\u003e\u003ccode\u003e@​wetneb\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/608\"\u003eactions/setup-java#608\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCache Maven and Gradle wrapper distributions separately from the\ndependency cache by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1097\"\u003eactions/setup-java#1097\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate cache-dependency-path e2e workflow and add maven/sbt\ncoverage by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1124\"\u003eactions/setup-java#1124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse gpg.passphraseEnvName instead of the deprecated gpg.passphrase\nserver by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1123\"\u003eactions/setup-java#1123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExtract repeated directory-check assertions into check-dir.sh helper\nby \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1127\"\u003eactions/setup-java#1127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConsolidate duplicate jobs in e2e-versions workflow by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1125\"\u003eactions/setup-java#1125\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse YAML anchors to reduce boilerplate in e2e-versions workflow by\n\u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1126\"\u003eactions/setup-java#1126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdated msft json for now by \u003ca\nhref\u003d\"https://github.com/jmjaffe37\"\u003e\u003ccode\u003e@​jmjaffe37\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1129\"\u003eactions/setup-java#1129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument missing action inputs in README by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1130\"\u003eactions/setup-java#1130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1128\"\u003eactions/setup-java#1128\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd an option to disable Java problem matchers by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1133\"\u003eactions/setup-java#1133\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update setup-java examples by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1131\"\u003eactions/setup-java#1131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify credential environment variable inputs by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1134\"\u003eactions/setup-java#1134\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/eslint-plugin\u003c/code\u003e\nfrom 8.63.0 to 8.64.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1135\"\u003eactions/setup-java#1135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump actions/setup-python from 6 to 7 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1143\"\u003eactions/setup-java#1143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1142\"\u003eactions/setup-java#1142\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump \u003ccode\u003e@​typescript-eslint/parser\u003c/code\u003e from\n8.64.0 to 8.65.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1138\"\u003eactions/setup-java#1138\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1136\"\u003eactions/setup-java#1136\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1137\"\u003eactions/setup-java#1137\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): fix npm audited vulnerabilities by \u003ca\nhref\u003d\"https://github.com/mhoffrog\"\u003e\u003ccode\u003e@​mhoffrog\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1140\"\u003eactions/setup-java#1140\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix formatting issues in README.md by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1144\"\u003eactions/setup-java#1144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemediate npm audit findings and rebuild distributions by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1145\"\u003eactions/setup-java#1145\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSet GRAALVM_HOME for GraalVM distributions by \u003ca\nhref\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e@​brunoborges\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/pull/1146\"\u003eactions/setup-java#1146\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/dd06d9cba3e5552c54d9f8ea23572deb30010f7c\"\u003e\u003ccode\u003edd06d9c\u003c/code\u003e\u003c/a\u003e\nPrepare documentation for v6 release (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1253\"\u003e#1253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/59b3450628e54f250d3a3bfd413cd68b83bce8ed\"\u003e\u003ccode\u003e59b3450\u003c/code\u003e\u003c/a\u003e\nchore(deps): combine open Dependabot npm updates (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1252\"\u003e#1252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/b96213d9d21fbd1dd447987fe15dd75fce7f7726\"\u003e\u003ccode\u003eb96213d\u003c/code\u003e\u003c/a\u003e\nSet default signature verification for supported distributions (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1246\"\u003e#1246\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/1dbac3c9e137b6d4d280bae1ae4e9902bb4ce1b9\"\u003e\u003ccode\u003e1dbac3c\u003c/code\u003e\u003c/a\u003e\ndocs: expose contributing guide to GitHub (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1245\"\u003e#1245\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/11741d6cfaf82354eb314633583a9ce43399238b\"\u003e\u003ccode\u003e11741d6\u003c/code\u003e\u003c/a\u003e\nci: constrain cache e2e job modes (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1244\"\u003e#1244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/ff99aa1c87709f29685194226dae7d9b476c594f\"\u003e\u003ccode\u003eff99aa1\u003c/code\u003e\u003c/a\u003e\nFix Oracle macOS E2E version (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1243\"\u003e#1243\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/416c6d1e8ab4ffb67a533d502fd7b21f70c5d9ee\"\u003e\u003ccode\u003e416c6d1\u003c/code\u003e\u003c/a\u003e\nAdd Red Hat Build of OpenJDK support (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1241\"\u003e#1241\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/5f75b27283990add95cd9c4ceaca74d789324bf7\"\u003e\u003ccode\u003e5f75b27\u003c/code\u003e\u003c/a\u003e\nAdd Maven dependency-resolution repositories (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1240\"\u003e#1240\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/a42a52cfb590b0682db41c911da5dc7798ba620e\"\u003e\u003ccode\u003ea42a52c\u003c/code\u003e\u003c/a\u003e\nAdd multiple Maven server credentials (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1239\"\u003e#1239\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-java/commit/fb4abd7a7075173ac733c41f723ac0c47c41ad17\"\u003e\u003ccode\u003efb4abd7\u003c/code\u003e\u003c/a\u003e\ntest: cover JDK 26 from SDKMAN (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-java/issues/1238\"\u003e#1238\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/setup-java/compare/v5...v6\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-java\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5\u0026new-version\u003d6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e2dc2b738a1c09ca97b69924cb3b1f236dc1673a",
      "tree": "10c9aa527b747fd6361104bfa333f07bc6bb1a00",
      "parents": [
        "371b73d4279fbca2b891f350a79dd9ec715efac6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 03 20:52:37 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 20:52:37 2026 +0200"
      },
      "message": "MINOR: Bump commons-codec:commons-codec from 1.22.0 to 1.22.1 (#1278)\n\nBumps\n[commons-codec:commons-codec](https://github.com/apache/commons-codec)\nfrom 1.22.0 to 1.22.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt\"\u003ecommons-codec:commons-codec\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Commons Codec 1.22.1 Release Notes\u003c/h2\u003e\n\u003cp\u003eThe Apache Commons Codec team is pleased to announce the release of\nApache Commons Codec 1.22.1.\u003c/p\u003e\n\u003cp\u003eThe Apache Commons Codec component contains encoders and decoders for\nformats such as Base16, Base32, Base64, digest, and Hexadecimal. In\naddition to these\nwidely used encoders and decoders, the codec package also maintains a\ncollection of phonetic encoding utilities.\u003c/p\u003e\n\u003cp\u003eThis is a feature and maintenance release. Java 8 or later is\nrequired.\u003c/p\u003e\n\u003ch2\u003eFixed Bugs\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid\ncustom alphabets. Thanks to Ruiqi Dong, Gary Gregory.\u003c/li\u003e\n\u003cli\u003eCODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when\nencoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.\u003c/li\u003e\n\u003cli\u003eCODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec\nthat cannot decode its own output. Thanks to Ruiqi Dong, Gary\nGregory.\u003c/li\u003e\n\u003cli\u003eCODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode\ntable to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.\u003c/li\u003e\n\u003cli\u003eCODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec\nthat cannot decode its own output. Thanks to Ruiqi Dong, Gary\nGregory.\u003c/li\u003e\n\u003cli\u003eCODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe\nsets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary\nGregory.\u003c/li\u003e\n\u003cli\u003eCODEC-338: PercentCodec loses literal \u0027+\u0027 when plusForSpace is\nenabled. Thanks to Ruiqi Dong, Gary Gregory.\u003c/li\u003e\n\u003cli\u003eCODEC-337: Digest ALL reuses System.in, so only the first algorithm\nsees the real input (\u003ca\nhref\u003d\"https://redirect.github.com/apache/commons-codec/issues/431\"\u003e#431\u003c/a\u003e).\nThanks to Ruiqi Dong, Gary Gregory.\u003c/li\u003e\n\u003cli\u003e\n\u003cpre\u003e\u003ccode\u003e Fix Base64.toIntegerBytes(BigInteger) for zero edge case\n([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to\nGary Gregory.\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cpre\u003e\u003ccode\u003e Add messages when throwing NullPointerException. Thanks to\nGary Gregory.\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cpre\u003e\u003ccode\u003e Add messages when throwing NullPointerException. Thanks to\nGary Gregory.\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cpre\u003e\u003ccode\u003e\nStringEncoderComparator.StringEncoderComparator(StringEncoder) now fails\nfast on null input. Thanks to Gary Gregory.\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cpre\u003e\u003ccode\u003e Bump org.apache.commons:commons-parent from 98 to 103.\nThanks to Gary Gregory.\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cpre\u003e\u003ccode\u003e Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to\nGary Gregory.\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eFor complete information on Apache Commons Codec, including\ninstructions on how to submit bug reports,\npatches, or suggestions for improvement, see the Apache Commons Codec\nwebsite:\u003c/p\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://commons.apache.org/proper/commons-codec/\"\u003ehttps://commons.apache.org/proper/commons-codec/\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eDownload page: \u003ca\nhref\u003d\"https://commons.apache.org/proper/commons-codec/download_codec.cgi\"\u003ehttps://commons.apache.org/proper/commons-codec/download_codec.cgi\u003c/a\u003e\u003c/p\u003e\n\u003chr /\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/dc8f6c832a30f524bf12a5ae7ab013e4ad7c088f\"\u003e\u003ccode\u003edc8f6c8\u003c/code\u003e\u003c/a\u003e\nPrepare for the release candidate 1.22.1 RC1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/8203c1c5bb4342e2fbf258556cac4826eae7ca11\"\u003e\u003ccode\u003e8203c1c\u003c/code\u003e\u003c/a\u003e\nPrepare for the next release candidate\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/5647fe2a66b3e74f044f414ad10d92407ede9396\"\u003e\u003ccode\u003e5647fe2\u003c/code\u003e\u003c/a\u003e\nStringEncoderComparator.StringEncoderComparator(StringEncoder) now\nfails\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/00c27a9c0636f15a0ba1d0bdc1f00fb8d9cee0fd\"\u003e\u003ccode\u003e00c27a9\u003c/code\u003e\u003c/a\u003e\nReduce vertical whitespace\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/568f2d7d7cf24ff0074eec29e21868ce9fe24236\"\u003e\u003ccode\u003e568f2d7\u003c/code\u003e\u003c/a\u003e\nRemove unused method\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/316fb15f3aa1e810a27fcc858d7c0e7ba0a4d724\"\u003e\u003ccode\u003e316fb15\u003c/code\u003e\u003c/a\u003e\nRemove unused method\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/bf6b543c1d49bf36d9ee10de1a1472dc5d677b10\"\u003e\u003ccode\u003ebf6b543\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 7.0.0 to 7.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/e14cdfe55f4837b63daca367374ce996ad87fc5a\"\u003e\u003ccode\u003ee14cdfe\u003c/code\u003e\u003c/a\u003e\nExtract redundant code.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/3351e63155fa41fbfcb0744efa960adce1529798\"\u003e\u003ccode\u003e3351e63\u003c/code\u003e\u003c/a\u003e\nAdd messages when throwing NullPointerException.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/commons-codec/commit/f22dab7ea52e8bd07dfa84a6f37ce915d1536b1c\"\u003e\u003ccode\u003ef22dab7\u003c/code\u003e\u003c/a\u003e\nUpdate SCM tag\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/apache/commons-codec/compare/rel/commons-codec-1.22.0...rel/commons-codec-1.22.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcommons-codec:commons-codec\u0026package-manager\u003dmaven\u0026previous-version\u003d1.22.0\u0026new-version\u003d1.22.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "371b73d4279fbca2b891f350a79dd9ec715efac6",
      "tree": "7ac12194a4f5c6ed8a6e40079f62daffc22e15c7",
      "parents": [
        "df0627dfd371989885352780805e629bc06588d5"
      ],
      "author": {
        "name": "Robert Kruszewski",
        "email": "github@robertk.io",
        "time": "Mon Aug 31 14:40:46 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 31 15:40:46 2026 +0200"
      },
      "message": "MINOR: Reject non zero offset on array import (#1263)\n\n## What\u0027s Changed\n\nInstead of silently accepting the array and pretending the import went\nfine reject arrays where offset is non 0. Add mention to the docs that\nthis is not supported\n\nThis is documentation and negative case for #251\n\n---------\n\nSigned-off-by: Robert Kruszewski \u003cgithub@robertk.io\u003e\nCo-authored-by: JB Onofré \u003cjb.onofre@dremio.com\u003e"
    },
    {
      "commit": "df0627dfd371989885352780805e629bc06588d5",
      "tree": "44f72fb38f56c20827075e45ee8547694f6c03e1",
      "parents": [
        "4e8faf74a3081663b68634d5ab33d81c52c46319"
      ],
      "author": {
        "name": "Pedro Matias",
        "email": "pedro.matias@dremio.com",
        "time": "Mon Aug 31 04:20:35 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 30 20:20:35 2026 -0700"
      },
      "message": "GH-577: Use JVM proxy settings in Netty client (#1027)\n\n### What\u0027s Changed\nThe Flight SQL JDBC driver ignored JVM proxy settings\n(`-Dhttps.proxyHost`, `-Dhttps.proxyPort`). Connections would always go\ndirectly to the target host, bypassing any configured proxy.\n\nSwitched to `NettyChannelBuilder.forAddress(host, port)` for the\nTCP-based schemes. This causes gRPC to go through `ProxySelector`, which\npicks up the standard JVM proxy properties.\n\n### Are these changes tested?\nYes. \n\nAdded a test to `ConnectionTest` that installs a recording\n`ProxySelector` as the JVM default, opens a JDBC connection, and asserts\nthat `ProxySelector.select() `was called. This directly validates that\nthe driver participates in JVM proxy detection without requiring a real\nproxy server.\n\nThis change was created with AI assistance (Claude Code). All lines were\nmanually reviewed by a human. The output is not copyrightable subject\nmatter.\n\nCloses #577.\n\n---------\n\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "4e8faf74a3081663b68634d5ab33d81c52c46319",
      "tree": "b21aa845cb7fd5bbc4fd0f05a615c858d224789e",
      "parents": [
        "f7a7829b294f46ad713ff043f5e2e2a9cd382958"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Mon Aug 31 02:30:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 31 09:30:38 2026 +0900"
      },
      "message": "MINOR: Don\u0027t install Homebrew\u0027s Node.js for JNI macOS build (#1270)\n\nThe `JNI macos-15-intel x86_64` job currently fails on `main` and on\nevery open PR while installing dependencies:\n\n```\n\u003d\u003d\u003e Installing node\nError: node: no bottle available!\nThis is a Tier 3 configuration:\n  https://docs.brew.sh/Support-Tiers#tier-3\nInstalling node has failed!\n`brew bundle` failed! 1 Brewfile dependency failed to install\n```\n\n`apache/arrow`\u0027s `cpp/Brewfile` lists `brew \"node\"`, and Homebrew treats\nx86_64 macOS as a tier 3 configuration and no longer builds a bottle for\nit. `brew bundle` doesn\u0027t build from source, so the step aborts before\nanything is built.\n\nWe don\u0027t need Node.js for the JNI build, so this skips installing it via\n`HOMEBREW_BUNDLE_BREW_SKIP`, the same way #1269 did for `aws-sdk-cpp`\nand gRPC.\n\nFailing runs for reference:\n\n* `main`:\nhttps://github.com/apache/arrow-java/actions/runs/33283736388/job/99183221397\n* PR #1263:\nhttps://github.com/apache/arrow-java/actions/runs/33297775855/job/99221106761"
    },
    {
      "commit": "f7a7829b294f46ad713ff043f5e2e2a9cd382958",
      "tree": "81f6c3a2a190a1637a558dec667ced2eddd862c9",
      "parents": [
        "a11339d1bdea4ec398df223907625f6b7c83ab59"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sun Aug 30 00:46:37 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 30 07:46:37 2026 +0900"
      },
      "message": "MINOR: Don\u0027t install Homebrew\u0027s aws-sdk-cpp and gRPC for JNI macOS build (#1269)\n\n### Rationale for this change\n\nThe `JNI macos-15-intel x86_64` job in the RC workflow fails in `Install\ndependencies`, before anything is built:\n\n```\n##[error]aws-sdk-cpp: no bottle available!\n##[error]grpc: no bottle available!\nThis is a Tier 3 configuration:\n  https://docs.brew.sh/Support-Tiers#tier-3\n`brew bundle` failed! 2 Brewfile dependencies failed to install\n```\n\nHomebrew treats x86_64 macOS as a [tier 3\nconfiguration](https://docs.brew.sh/Support-Tiers#tier-3) and rarely\npublishes bottles for it. `brew bundle` doesn\u0027t build from source, so\n`arrow/cpp/Brewfile` can no longer be installed as-is there.\n\nThis breaks `main` too, not just PRs, so nightly RC runs are red.\n\n### What changes are included in this PR?\n\nWe don\u0027t use Homebrew\u0027s `aws-sdk-cpp` and gRPC anyway:\n\n* The JNI macOS build uses the `ninja-release-jni-macos` preset, which\nsets `ARROW_DEPENDENCY_USE_SHARED\u003dOFF`.\n* Homebrew provides only shared libraries for `aws-sdk-cpp` and gRPC.\n* So both are uninstalled just after `brew bundle` to ensure the bundled\nones are used.\n\nWe skip installing them with `HOMEBREW_BUNDLE_BREW_SKIP` instead of\ninstalling and uninstalling them. This also makes the `macos-14`\n`aarch_64` job a bit faster because it no longer installs two formulae\nit immediately removes.\n\n`brew uninstall aws-sdk-cpp` needs `|| :` now because it\u0027s no longer\ninstalled by `brew bundle`. It\u0027s still called because it may be\npre-installed on GitHub Actions runner images.\n\nNote that this keeps building the x86_64 macOS shared libraries.\nDropping the `macos-15-intel` entry would remove `.dylib` files for\nx86_64 macOS from our release JARs, which needs a separate discussion.\n\n### Are these changes tested?\n\nYes, by CI. The `JNI macos-15-intel x86_64` and `JNI macos-14 aarch_64`\njobs in this PR exercise the changed step.\n\n### Are there any user-facing changes?\n\nNo."
    },
    {
      "commit": "a11339d1bdea4ec398df223907625f6b7c83ab59",
      "tree": "a0c40a6c19e5cc369359a6b06655814c2db2ae77",
      "parents": [
        "3a1498b5c060dd359a5aa79e6d6c8d8997cfe013"
      ],
      "author": {
        "name": "Jan Kadlec",
        "email": "52755107+hkad98@users.noreply.github.com",
        "time": "Fri Aug 28 07:52:57 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 22:52:57 2026 -0700"
      },
      "message": "GH-44: Clear signature columns before re-populating in ArrowFlightStatement#executeFlightInfoQuery (#1135)\n\n## Rationale\n\n`ArrowFlightStatement#executeFlightInfoQuery` appends the dataset\nschema columns to the statement\u0027s `Meta.Signature` without clearing\nthem, so the column list doubles on every invocation. When the\n`FlightInfo` has at least one endpoint, `populateData` overwrites\n`signature.columns` from the actual stream schema and hides the\nduplication. With an empty endpoint list, that overwrite never\nruns. Avatica then refuses the metadata with `Cannot have more columns\nwith the same name`.\n\nThis is a regression introduced in 15.0.0 by the prepared-statement\nparameter binding work in\n[GH-33475](https://github.com/apache/arrow/pull/38404), which made\n`handle.signature` mutable and shared across the `prepareAndExecute` →\n`executeFlightInfoQuery` path.\n\nCloses #44."
    },
    {
      "commit": "3a1498b5c060dd359a5aa79e6d6c8d8997cfe013",
      "tree": "7a25c7d83f7b6bf982fed06c7226bb48baed133c",
      "parents": [
        "ec6eb67500223f951448c113c2dad4b32855ca17"
      ],
      "author": {
        "name": "David Li",
        "email": "li.davidm96@gmail.com",
        "time": "Thu Aug 27 20:43:08 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 13:43:08 2026 +0200"
      },
      "message": "MINOR: Update google-java-format and test Java 25 in CI (#1265)\n\n## What\u0027s Changed\n\n- Test Java 25 (LTS) instead of Java 23\n- Update google-java-format since it broke on Java 25\n- Reformat code\n- Deduplicate/make argLine config consistent\n- Update flags and docs for Java 25"
    },
    {
      "commit": "ec6eb67500223f951448c113c2dad4b32855ca17",
      "tree": "24a4e05165497f591c72215ddc8ed9c7bc77727c",
      "parents": [
        "c85a554d5b9e4e5c08b4703e5d41de5352bcda7c"
      ],
      "author": {
        "name": "yujin5701",
        "email": "yoojin3117@ewhain.net",
        "time": "Thu Aug 27 11:44:27 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 26 19:44:27 2026 -0700"
      },
      "message": "GH-477: Fix Flight JDBC DATE(MILLISECOND) parameter binding (#1219)\n\n## What\u0027s Changed\n\nThis fixes Flight JDBC prepared statement binding for Arrow\n`DATE(MILLISECOND)` parameters.\n\nAvatica represents JDBC `DATE` values as days since the Unix\nepoch.  The Flight JDBC parameter binder already writes that\nvalue correctly for `DateDayVector`, but it was also writing\nthe same day value directly into `DateMilliVector`, which\nexpects milliseconds since the Unix epoch.\n\nThis now converts epoch days to epoch milliseconds before\nwriting to `DateMilliVector`.\n\nTested with `ArrowFlightPreparedStatementTest`.\n\nCloses #477."
    },
    {
      "commit": "c85a554d5b9e4e5c08b4703e5d41de5352bcda7c",
      "tree": "9fd07930c40134a10d6297dafd07e257f74bc318",
      "parents": [
        "63a17fcfb70b0fcf6ea84bc3c0f52aa371cd457a"
      ],
      "author": {
        "name": "Goutam Adwant",
        "email": "8672451+goutamadwant@users.noreply.github.com",
        "time": "Tue Aug 25 18:27:11 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 18:27:11 2026 -0700"
      },
      "message": "GH-1190: Reserve view slots for empty view vector values (#1192)\n\n## What\u0027s Changed\n\nFixes `BaseVariableWidthViewVector.handleSafe` so `setSafe` reserves a\nfull 16-byte view slot for the target index even when the value length\nis zero.\n\nCloses #1190."
    },
    {
      "commit": "63a17fcfb70b0fcf6ea84bc3c0f52aa371cd457a",
      "tree": "d6722252b08e6428774d5d527d5a5b20d7e69ef2",
      "parents": [
        "94b0d71e3cff7dfdc4293a8517b0debdf7c856e7"
      ],
      "author": {
        "name": "Dan Homola",
        "email": "dan.homola@hotmail.cz",
        "time": "Wed Aug 26 02:30:28 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 17:30:28 2026 -0700"
      },
      "message": "GH-1257: cover arrow-memory-netty-buffer-patch in BOM (#1258)\n\n## What\u0027s Changed\n\nThis package was missing in the BOM leaving it open to becoming out of\nsync with the rest of the packages.\n\nCloses #1257."
    },
    {
      "commit": "94b0d71e3cff7dfdc4293a8517b0debdf7c856e7",
      "tree": "dbf5748f5af7c5a5de3ff4b00a6904b7e1119737",
      "parents": [
        "180e4ec538809f800af3f984cfabf922a7cf5aa0"
      ],
      "author": {
        "name": "Pedro Matias",
        "email": "pedro.matias@dremio.com",
        "time": "Wed Aug 26 00:31:03 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 16:31:03 2026 -0700"
      },
      "message": "GH-1117: Use updated handle in prepared stmt (#1120)\n\n## What\u0027s Changed\nWhen a server sent an updated handle for a prepared statement after\nparameters were bound,\nthe client would use the new handle for the subsequent call to\n`GetFlightInfo` and then discard it. Any other\nfuture requests for that prepared statement would use the original\nhandle.\n\nWith these changes, the updated handle is stored and reused for future\nrequests.\n\nThis change was created with AI assistance (Claude Code). All lines were\nmanually reviewed by a human. The output is not copyrightable subject\nmatter.\n\nCloses #1117."
    },
    {
      "commit": "180e4ec538809f800af3f984cfabf922a7cf5aa0",
      "tree": "f63d9923816cad5132f02a5ed8fab8d5d1f19114",
      "parents": [
        "522b0a26b69024197ccb619d1d220701338b854c"
      ],
      "author": {
        "name": "Pedro Matias",
        "email": "pedro.matias@dremio.com",
        "time": "Wed Aug 26 00:22:49 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 16:22:49 2026 -0700"
      },
      "message": "GH-1039: [Flight] Fix ClassCastException when building FlightClient with domain socket location (#1121)\n\n## What\u0027s Changed\n\nFix a `ClassCastException` on`FlightClient.builder().build()` when\nconnecting via a Unix domain socket on Linux (epoll) or macOS (kqueue),\nby casting to the Netty interface `Channel` instead of the\nserver-specific `ServerChannel`.\n  \nAlso adds netty-transport-native-epoll (Linux) and\nnetty-transport-native-kqueue (macOS) as test-scoped dependencies in\nflight-core via OS-activated profiles, so the existing\n`TestServerOptions#domainSocket` test actually runs instead of being\nskipped everywhere.\n\nThis change was created with AI assistance (Claude Code). All lines were\nmanually reviewed by a human. The output is not copyrightable subject\nmatter.\n\nCloses #1039."
    },
    {
      "commit": "522b0a26b69024197ccb619d1d220701338b854c",
      "tree": "03762075c3b73789ed48d3d22b71e6efa8ac336b",
      "parents": [
        "fe7d3eb4548566718e2de6ad14a1421969183c74"
      ],
      "author": {
        "name": "Dan Homola",
        "email": "dan.homola@hotmail.cz",
        "time": "Tue Aug 25 13:48:08 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 04:48:08 2026 -0700"
      },
      "message": "MINOR: actually throw in PooledByteBufAllocatorL (#1259)\n\n## What\u0027s Changed\n\nThere was a check in that class that looks like it throws an exception,\nbut actually does not. This means that when that branch is hit, instead\nof an actionable error, the user gets a ClassCastException like\n\n```\njava.lang.ClassCastException: class io.netty.buffer.PooledDirectByteBuf cannot be cast to class io.netty.buffer.PooledUnsafeDirectByteBuf (io.netty.buffer.PooledDirectByteBuf and io.netty.buffer.PooledUnsafeDirectByteBuf are in unnamed module of loader org.springframework.boot.loader.launch.LaunchedClassLoader@5e9f23b4)\n```\n\nActually throwing the exception prevents this and should not break\nanything: there is still an exception being thrown, just a different\ntype.\n\nAlso, make getNormalBufferCount actually return the count, not the size."
    },
    {
      "commit": "fe7d3eb4548566718e2de6ad14a1421969183c74",
      "tree": "95f96a4d9a6ae255cb1172bfc5569f43ffac0754",
      "parents": [
        "3e47560c773b1bab9d13d446ea69869c782e4666"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 20:39:56 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 20:39:56 2026 -0700"
      },
      "message": "MINOR: Bump io.grpc:grpc-bom from 1.82.1 to 1.83.1 (#1224)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "3e47560c773b1bab9d13d446ea69869c782e4666",
      "tree": "fab5d1724a2714fd8d7cae8fbe1cd383345b2cdc",
      "parents": [
        "4b594b6ae2908212c7962966ddbfedea5dd32e7e"
      ],
      "author": {
        "name": "YangJie",
        "email": "yangjie01@baidu.com",
        "time": "Tue Aug 25 11:39:26 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 20:39:26 2026 -0700"
      },
      "message": "GH-1098: Fix always-true precondition check in LargeListVector.setValueCount (#1099)\n\n## What\u0027s Changed\n\nFix the precondition check in `LargeListVector.setValueCount()` where\n`||` made the condition always true (`childValueCount \u003c\u003d\nInteger.MAX_VALUE || childValueCount \u003e\u003d Integer.MIN_VALUE` is a\ntautology for any `long` value), allowing silent data corruption when\n`childValueCount` exceeds `Integer.MAX_VALUE` or is negative.\n\nChanges:\n- Replace `||` with `\u0026\u0026` and `Integer.MIN_VALUE` with `0` to correctly\nbound `childValueCount` to `[0, Integer.MAX_VALUE]`, consistent with\n`LargeListViewVector`\n- Add rejection tests for negative and overflow `childValueCount`\n- Add positive boundary tests for zero, valid, and `Integer.MAX_VALUE`\nvalues\n\nCloses #1098."
    },
    {
      "commit": "4b594b6ae2908212c7962966ddbfedea5dd32e7e",
      "tree": "0af47151b24a199d8452d92d4901fa890912f391",
      "parents": [
        "196b58abc745194f55a6091bec78065bc045ff84"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 20:09:08 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 20:09:08 2026 -0700"
      },
      "message": "MINOR: Bump error_prone_core.version from 2.42.0 to 2.50.0 (#1183)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: David Li \u003cli.davidm96@gmail.com\u003e"
    },
    {
      "commit": "196b58abc745194f55a6091bec78065bc045ff84",
      "tree": "ca8d5f635ed56e9c770be473fff1af82733ce052",
      "parents": [
        "59e847b61910a5eb3d2c6372f696ca03ff619dac"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 19:00:09 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 19:00:09 2026 -0700"
      },
      "message": "MINOR: Bump io.netty:netty-bom from 4.2.15.Final to 4.2.17.Final (#1223)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "59e847b61910a5eb3d2c6372f696ca03ff619dac",
      "tree": "9aeac0456c3a4fcafee65844377f8860147f2e7d",
      "parents": [
        "83761a8b2fe78b5d4f26b68b739873836ef1e58c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 18:59:18 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 18:59:18 2026 -0700"
      },
      "message": "MINOR: [CI] Bump docker/login-action from 4.4.0 to 4.6.0 (#1254)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "83761a8b2fe78b5d4f26b68b739873836ef1e58c",
      "tree": "bf1c8e742848a13e0bc68df074b999571a499d26",
      "parents": [
        "1d8daed30705f67c4a9195efabd9859c90392e60"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 18:58:16 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 18:58:16 2026 -0700"
      },
      "message": "MINOR: Bump com.google.api.grpc:proto-google-common-protos from 2.72.0 to 2.74.0 (#1222)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "1d8daed30705f67c4a9195efabd9859c90392e60",
      "tree": "e01b06ab1255b676acbaadd47144ba9f0708b237",
      "parents": [
        "d49d0a6ac9cd3ad7abd51e8b9eec4e03b9bbe37f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 18:56:10 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 18:56:10 2026 -0700"
      },
      "message": "MINOR: [CI] Bump actions/setup-python from 6 to 7 (#1251)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d49d0a6ac9cd3ad7abd51e8b9eec4e03b9bbe37f",
      "tree": "ab5f46fda0a675bfd652fd290ec6bed153a941d1",
      "parents": [
        "6210b48745789b385c350bc1e368ad55eda3e899"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 18:44:17 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 18:44:17 2026 -0700"
      },
      "message": "MINOR: Bump logback.version from 1.5.37 to 1.6.3 (#1221)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6210b48745789b385c350bc1e368ad55eda3e899",
      "tree": "76a93a9995dfc7092f9fd74eb62d137b5dfc8dbc",
      "parents": [
        "f43c4b8652bac15b7356a4d5e733932c00e1cd8e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 24 18:40:59 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 18:40:59 2026 -0700"
      },
      "message": "MINOR: Bump dep.junit.jupiter.version from 6.1.1 to 6.1.3 (#1220)\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "f43c4b8652bac15b7356a4d5e733932c00e1cd8e",
      "tree": "0ffd1872e71ae85b6c9f046b7740de7f449f0c61",
      "parents": [
        "fa20039f39a7deacf5624ba8a6ee10e9d31e98ce"
      ],
      "author": {
        "name": "David Li",
        "email": "li.davidm96@gmail.com",
        "time": "Tue Aug 25 07:33:24 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 15:33:24 2026 -0700"
      },
      "message": "GH-1242: fix macOS and Windows RC CI (#1264)\n\n## What\u0027s Changed\n\n- We need to use the latest Arrow, as it fixes some of the build config\naround bundled dependencies.\n- Because we build against the bundled Protobuf, we also need to point\nat the bundled Abseil. This is fragile, as we\u0027re poking at the build\nsetup of arrow-cpp.\n\nCloses #1242.\nCloses #1243.\n\nAssisted-by: GPT-5.6 Sol \u003ccodex@openai.com\u003e"
    },
    {
      "commit": "fa20039f39a7deacf5624ba8a6ee10e9d31e98ce",
      "tree": "a9180cb8442d29f7cc4fd19af558655b3bdd14a7",
      "parents": [
        "85d7ef30ee5f623cf3442dd989df09c3c5754ad2"
      ],
      "author": {
        "name": "David Li",
        "email": "li.davidm96@gmail.com",
        "time": "Fri Aug 14 10:57:43 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 10:57:43 2026 +0900"
      },
      "message": "GH-1241: Bump vcpkg version to stay in sync with apache/arrow (#1260)\n\nThis fixes the CI for Linux.\n\nCloses #1241."
    },
    {
      "commit": "85d7ef30ee5f623cf3442dd989df09c3c5754ad2",
      "tree": "6bc52d6d14c1618a5f7257241d58a85c02bea47a",
      "parents": [
        "06170242bde2f492e068235efdd2183a3cbd87d7"
      ],
      "author": {
        "name": "Sandesh Kumar",
        "email": "sandeshkr419@gmail.com",
        "time": "Thu Aug 06 17:29:51 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 09:29:51 2026 +0900"
      },
      "message": "GH-1239: Fix memory leak when C Data import hits allocator limit mid-array (#1240)\n\n`ReferenceCountedArrowArray.unsafeAssociateAllocation` calls `retain()`\nbefore `wrapForeignAllocation`. If `wrapForeignAllocation` throws\n(allocator over its limit), the retain is never balanced, the reference\ncount stays elevated, and the C Data release callback never fires —\nleaking the producer\u0027s native memory.\n\n**Fix:** call `retain()` after `wrapForeignAllocation` returns. Same\nbehavior on the success path; on failure the existing `finally` in\n`ArrayImporter.importArray` drives the count to zero and fires the\nrelease callback.\n\n**Test:** `ImportOutOfMemoryTest` — exports a batch from a \"producer\"\nallocator, tries to import it into a too-small consumer, and asserts the\nproducer drains to zero after the OOM. Fails on the original code,\npasses with the fix.\n\nFixes: https://github.com/apache/arrow-java/issues/1239\n\n---------\n\nSigned-off-by: Sandesh Kumar \u003ckusandes@amazon.com\u003e\nCo-authored-by: Sandesh Kumar \u003ckusandes@amazon.com\u003e"
    },
    {
      "commit": "06170242bde2f492e068235efdd2183a3cbd87d7",
      "tree": "de1ddf07d8121651fab9f40f4ab9f903ba29484c",
      "parents": [
        "21b6a05154b7713b12ace4c0ba3572ba5cc8fe66"
      ],
      "author": {
        "name": "Hélder Gregório",
        "email": "helder.gregorio@dremio.com",
        "time": "Sat Jul 25 14:35:09 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 25 22:35:09 2026 +0900"
      },
      "message": "GH-1244: Move integration tests to separate workflow (#1245)\n\n## What\u0027s Changed\n\nMove the `integration` job from `test.yml` into its own\n`integration.yml` workflow.\n\nThe new workflow uses top-level `paths` filters, so integration tests\nrun only when changes affect relevant code or build inputs.\nThis should also help to reduce the amount of runner time. Topic\ninitially triggered in the [mailing\nlist](https://lists.apache.org/thread/drf0o5kzg1zfmok7gc09k8qz8hh9ymvh)\n\nCloses #1244"
    },
    {
      "commit": "21b6a05154b7713b12ace4c0ba3572ba5cc8fe66",
      "tree": "0ecf4517d4fee870a9196f94049cff3d4857905c",
      "parents": [
        "7f1f9f588af610b842ee1c3bccf6afbd528ae4db"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Jul 21 10:19:32 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 10:19:32 2026 +0900"
      },
      "message": "MINOR: [CI] Bump actions/setup-python from 6 to 7 (#1235)\n\nBumps [actions/setup-python](https://github.com/actions/setup-python)\nfrom 6 to 7.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1330\"\u003eactions/setup-python#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin SHA commits and update docs with latest versions by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1338\"\u003eactions/setup-python#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the pip-install input by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1336\"\u003eactions/setup-python#1336\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix to Classify stderr warning messages as warnings instead of\nerrors in annotations by \u003ca\nhref\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate and retry manifest fetch to prevent silent failures by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1332\"\u003eactions/setup-python#1332\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrade\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump certifi from 2020.6.20 to 2024.7.4 in\n/\u003cstrong\u003etests\u003c/strong\u003e/data by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1328\"\u003eactions/setup-python#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove EOL Python versions and Bumps numpy text fixture by \u003ca\nhref\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1333\"\u003eactions/setup-python#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancement\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd RHEL support and include Linux distro in cache keys by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1323\"\u003eactions/setup-python#1323\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix pip cache error handling on Windows by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1040\"\u003eactions/setup-python#1040\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency update\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade minimatch from 3.1.2 to 3.1.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1281\"\u003eactions/setup-python#1281\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions dependencies by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write\ndenied by \u003ca\nhref\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependency versions and test workflow configuration by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1322\"\u003eactions/setup-python#1322\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate advanced-usage.md by \u003ca\nhref\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0\"\u003ehttps://github.com/actions/setup-python/compare/v6.2.0...v6.3.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade dependencies to Node 24 compatible versions by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1259\"\u003eactions/setup-python#1259\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003e\u003ccode\u003e5fda3b9\u003c/code\u003e\u003c/a\u003e\nPin SHA commits and update docs with latest versions (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1338\"\u003e#1338\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e\"\u003e\u003ccode\u003e4ab7e95\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1337\"\u003e#1337\u003c/a\u003e\nfrom actions/philip-gai/bump-actions-cache-6-2-0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c\"\u003e\u003ccode\u003e0f3a009\u003c/code\u003e\u003c/a\u003e\nRemove the pip-install input (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1336\"\u003e#1336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932\"\u003e\u003ccode\u003ef8cf429\u003c/code\u003e\u003c/a\u003e\nMigrate to ESM and upgrade dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1330\"\u003e#1330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5\"\u003e\u003ccode\u003e54baeea\u003c/code\u003e\u003c/a\u003e\nValidate and retry manifest fetch to prevent silent failures (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1332\"\u003e#1332\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5\"\u003e\u003ccode\u003ec709277\u003c/code\u003e\u003c/a\u003e\nAnnotation code fix (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a\"\u003e\u003ccode\u003e6849080\u003c/code\u003e\u003c/a\u003e\nremove EOL Python versions and Bumps numpy text fixture (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1333\"\u003e#1333\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e\"\u003e\u003ccode\u003e0903b46\u003c/code\u003e\u003c/a\u003e\nBump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data\n(\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1328\"\u003e#1328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6...v7\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-python\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6\u0026new-version\u003d7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "7f1f9f588af610b842ee1c3bccf6afbd528ae4db",
      "tree": "79062682f370af205e6f19fce81b691284bfd173",
      "parents": [
        "a9f0086090e649b83c89ea864c82ed7fcc84ab2f"
      ],
      "author": {
        "name": "Hélder Gregório",
        "email": "helder.gregorio@dremio.com",
        "time": "Thu Jul 09 14:42:25 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 09 15:42:25 2026 +0200"
      },
      "message": "GH-1188: Reduce test workflow waste (#1189)\n\n## Summary\n\nThis PR reduces wasted GitHub Actions time in the `Test` workflow by\nremoving redundant rebuilds, improving caching, and skipping integration\nwork when it is not relevant.\n\n## What changed\n\n- Removed `clean` from `ci/scripts/test.sh` so the test phase reuses the\nclasses compiled earlier in the job instead of deleting and recompiling\nthem.\n- Narrowed the Maven/Docker cache key to POM changes, so source-only\nedits do not invalidate the dependency cache.\n- Enabled Maven dependency caching on the macOS and Windows test jobs.\n- Added `pull-requests: read` so the integration job can inspect changed\nfiles.\n\nCloses #1188 \n\nNote: The changes on this PR were highlighted and addressed with AI\nassistance"
    },
    {
      "commit": "a9f0086090e649b83c89ea864c82ed7fcc84ab2f",
      "tree": "18627eff3fa8271dbc17bc61d29529153eab9cc5",
      "parents": [
        "915428751b8871406268aeb27bd2f055dcfba6bf"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 22:19:02 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 22:19:02 2026 +0200"
      },
      "message": "MINOR: Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2 to 5.4.0 (#1208)\n\nBumps\n[com.squareup.okhttp3:okhttp-jvm](https://github.com/square/okhttp) from\n5.3.2 to 5.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/square/okhttp/blob/master/CHANGELOG.md\"\u003ecom.squareup.okhttp3:okhttp-jvm\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 5.4.0\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003e2026-06-08\u003c/em\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNew: Add superpowers to interceptors. Interceptors can now override\nanything settable on\n\u003ccode\u003eOkHttpClient.Builder\u003c/code\u003e, such as the cache, connection pool,\nsocket factory, and DNS. We expect\nthis will allow most users to use interceptors everywhere, insted of\nmixing and matching\ninterceptors with custom \u003ccode\u003eCall.Factory\u003c/code\u003e wrappers.\u003c/li\u003e\n\u003cli\u003eFix: Limit each HTTP/2 response to 256 KiB of total headers.\u003c/li\u003e\n\u003cli\u003eUpgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is\nused by the optional\n\u003ccode\u003eokhttp-coroutines\u003c/code\u003e artifact.\u003c/li\u003e\n\u003cli\u003eUpgrade: [GraalVM 25.0.3][graalvm_25].\u003c/li\u003e\n\u003cli\u003eUpgrade: [Okio 3.17.0][okio_3_17_0].\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5\"\u003e\u003ccode\u003e61423f4\u003c/code\u003e\u003c/a\u003e\nPrepare for release 5.4.0.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370\"\u003e\u003ccode\u003ed7e6eff\u003c/code\u003e\u003c/a\u003e\nUpdate eclipse.osgi to v3.24.200 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9480\"\u003e#9480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b\"\u003e\u003ccode\u003e7a35098\u003c/code\u003e\u003c/a\u003e\nUpdate bnd to v7.3.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9475\"\u003e#9475\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868\"\u003e\u003ccode\u003e0c5a45b\u003c/code\u003e\u003c/a\u003e\nUpdate dependency com.puppycrawl.tools:checkstyle to v13.5.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9468\"\u003e#9468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b\"\u003e\u003ccode\u003e113ad17\u003c/code\u003e\u003c/a\u003e\nUpdate dependency macos to v26 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9457\"\u003e#9457\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1\"\u003e\u003ccode\u003e84f601a\u003c/code\u003e\u003c/a\u003e\nUpdate shadow.plugin to v9.4.2 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9466\"\u003e#9466\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c\"\u003e\u003ccode\u003e7d463f4\u003c/code\u003e\u003c/a\u003e\nUpdate spotless.plugin to v8.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9464\"\u003e#9464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7\"\u003e\u003ccode\u003e3bf00f5\u003c/code\u003e\u003c/a\u003e\nUpdate plugin com.diffplug.spotless to v8.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9463\"\u003e#9463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9\"\u003e\u003ccode\u003ecfc45a3\u003c/code\u003e\u003c/a\u003e\nUpdate spotless.plugin to v8.5.1 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9456\"\u003e#9456\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34\"\u003e\u003ccode\u003e81c5006\u003c/code\u003e\u003c/a\u003e\nApply gradle lint correctly (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9459\"\u003e#9459\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "915428751b8871406268aeb27bd2f055dcfba6bf",
      "tree": "a2d1b30bd501a00b8b0bb4dd673f34f285715b1f",
      "parents": [
        "f2594c99cc98923ad5949713d4519c5d4f24f4f6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 16:00:46 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 16:00:46 2026 +0200"
      },
      "message": "MINOR: Bump logback.version from 1.5.34 to 1.5.37 (#1209)\n\nBumps `logback.version` from 1.5.34 to 1.5.37.\nUpdates `ch.qos.logback:logback-classic` from 1.5.34 to 1.5.37\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-classic\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.37\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-26 Release of logback version 1.5.37\u003c/strong\u003e\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e• Given the numerous vulnerabilities related to conditional\nconfiguration processing based on the evaluation of Java expressions\nusing the Janino library, support for such expressions has been removed.\nUsers are offered the an \u003ca\nhref\u003d\"https://logback.qos.ch/translator/services/conditionalConfigMigrator.html\"\u003eonline\nmigration service\u003c/a\u003e or the \u003ccode\u003e\u0026lt;condition\u0026gt;\u003c/code\u003e element\nintroduced in version 1.5.20. See the \u003ca\nhref\u003d\"https://logback.qos.ch/manual/configuration.html#conditional\"\u003erelevant\ndocumentation\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\nc1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag\nv_1.5.37. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.36\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-25 Release of logback version 1.5.36\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nreject certain references that are associated with ACE attacks. This\nissue was reported by \u0026quot;yulate\u0026quot; (\u003ca\nhref\u003d\"mailto:yulate531@gmail.com.com\"\u003eyulate531@gmail.com.com\u003c/a\u003e) and\nregistered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag\nv_1.5.36. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.35\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e026-06-23 Release of logback version 1.5.35\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nrejects unicode escape sequences (\\u and \\U). This closes a bypass of\nthe existing prohibition on the new operator in Janino-evaluated\nconditions. This issue was reported by IcySun (\u003ca\nhref\u003d\"mailto:icysun@qq.com\"\u003eicysun@qq.com\u003c/a\u003e) and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• Added \u003ccode\u003eConfiguratorRank.AUTHENTICATING\u003c/code\u003e (rank 100), the\nhighest configurator rank, for certified/authenticating configurators\ndiscovered via the ServiceLoader mechanism.\n\u003ccode\u003eContextInitializer\u003c/code\u003e now requires that at most one such\nconfigurator exist on the classpath; if more than one is found,\ninitialization aborts with an error.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eConsoleCharsetPropertyDefiner\u003c/code\u003e is no longer shipped.\nThe Java 21 multi-release compilation of logback-core has been disabled,\nwhich removes this class from the published artifact. Configurations\nthat referenced\n\u003ccode\u003ech.qos.logback.core.property.ConsoleCharsetPropertyDefiner\u003c/code\u003e\nwill need an alternative approach for console charset detection.\u003c/p\u003e\n\u003cp\u003e• The logback-examples module is now included in artifacts published\nto Maven Central.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eJoranConfigurator.makeAnotherInstance()\u003c/code\u003e and\n\u003ccode\u003eDefaultJoranConfigurator.performMultiStepConfigurationFileSearch()\u003c/code\u003e\nare now protected, allowing derived configurators to override these\nmethods.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n08bd1598d565d83444f72983935e7da4746783b7 associated with the tag\nv_1.5.35. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048\"\u003e\u003ccode\u003ec1df7f5\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.37\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5\"\u003e\u003ccode\u003ea189967\u003c/code\u003e\u003c/a\u003e\nremove conditional based on janino\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446\"\u003e\u003ccode\u003eaaa9052\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.37-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888\"\u003e\u003ccode\u003e9b94c37\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.36\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb\"\u003e\u003ccode\u003ee6a8280\u003c/code\u003e\u003c/a\u003e\nprevent attacks using disallowed references\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f\"\u003e\u003ccode\u003e24c4b63\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.36-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7\"\u003e\u003ccode\u003e08bd159\u003c/code\u003e\u003c/a\u003e\npreapre release 1.5.35\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0\"\u003e\u003ccode\u003e37d256b\u003c/code\u003e\u003c/a\u003e\nindentation changes only\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3\"\u003e\u003ccode\u003ed3d7307\u003c/code\u003e\u003c/a\u003e\nminor comment\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0\"\u003e\u003ccode\u003efa0411a\u003c/code\u003e\u003c/a\u003e\nradomize file location\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ch.qos.logback:logback-core` from 1.5.34 to 1.5.37\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-core\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.37\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-26 Release of logback version 1.5.37\u003c/strong\u003e\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e• Given the numerous vulnerabilities related to conditional\nconfiguration processing based on the evaluation of Java expressions\nusing the Janino library, support for such expressions has been removed.\nUsers are offered the an \u003ca\nhref\u003d\"https://logback.qos.ch/translator/services/conditionalConfigMigrator.html\"\u003eonline\nmigration service\u003c/a\u003e or the \u003ccode\u003e\u0026lt;condition\u0026gt;\u003c/code\u003e element\nintroduced in version 1.5.20. See the \u003ca\nhref\u003d\"https://logback.qos.ch/manual/configuration.html#conditional\"\u003erelevant\ndocumentation\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\nc1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag\nv_1.5.37. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.36\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-25 Release of logback version 1.5.36\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nreject certain references that are associated with ACE attacks. This\nissue was reported by \u0026quot;yulate\u0026quot; (\u003ca\nhref\u003d\"mailto:yulate531@gmail.com.com\"\u003eyulate531@gmail.com.com\u003c/a\u003e) and\nregistered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag\nv_1.5.36. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.35\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e026-06-23 Release of logback version 1.5.35\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• The \u0027condition\u0027 attribute in \u003ccode\u003e\u0026lt;if\u0026gt;\u003c/code\u003e elements now\nrejects unicode escape sequences (\\u and \\U). This closes a bypass of\nthe existing prohibition on the new operator in Janino-evaluated\nconditions. This issue was reported by IcySun (\u003ca\nhref\u003d\"mailto:icysun@qq.com\"\u003eicysun@qq.com\u003c/a\u003e) and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-13006\"\u003eCVE-2026-13006\u003c/a\u003e.\n\u003cstrong\u003ePlease note that version 1.5.37 provides the full fix to this\nvulnerability.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• Added \u003ccode\u003eConfiguratorRank.AUTHENTICATING\u003c/code\u003e (rank 100), the\nhighest configurator rank, for certified/authenticating configurators\ndiscovered via the ServiceLoader mechanism.\n\u003ccode\u003eContextInitializer\u003c/code\u003e now requires that at most one such\nconfigurator exist on the classpath; if more than one is found,\ninitialization aborts with an error.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eConsoleCharsetPropertyDefiner\u003c/code\u003e is no longer shipped.\nThe Java 21 multi-release compilation of logback-core has been disabled,\nwhich removes this class from the published artifact. Configurations\nthat referenced\n\u003ccode\u003ech.qos.logback.core.property.ConsoleCharsetPropertyDefiner\u003c/code\u003e\nwill need an alternative approach for console charset detection.\u003c/p\u003e\n\u003cp\u003e• The logback-examples module is now included in artifacts published\nto Maven Central.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eJoranConfigurator.makeAnotherInstance()\u003c/code\u003e and\n\u003ccode\u003eDefaultJoranConfigurator.performMultiStepConfigurationFileSearch()\u003c/code\u003e\nare now protected, allowing derived configurators to override these\nmethods.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\n08bd1598d565d83444f72983935e7da4746783b7 associated with the tag\nv_1.5.35. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048\"\u003e\u003ccode\u003ec1df7f5\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.37\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5\"\u003e\u003ccode\u003ea189967\u003c/code\u003e\u003c/a\u003e\nremove conditional based on janino\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446\"\u003e\u003ccode\u003eaaa9052\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.37-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888\"\u003e\u003ccode\u003e9b94c37\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.36\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb\"\u003e\u003ccode\u003ee6a8280\u003c/code\u003e\u003c/a\u003e\nprevent attacks using disallowed references\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f\"\u003e\u003ccode\u003e24c4b63\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.36-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7\"\u003e\u003ccode\u003e08bd159\u003c/code\u003e\u003c/a\u003e\npreapre release 1.5.35\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0\"\u003e\u003ccode\u003e37d256b\u003c/code\u003e\u003c/a\u003e\nindentation changes only\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3\"\u003e\u003ccode\u003ed3d7307\u003c/code\u003e\u003c/a\u003e\nminor comment\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0\"\u003e\u003ccode\u003efa0411a\u003c/code\u003e\u003c/a\u003e\nradomize file location\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.37\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjbonofre@apache.org\u003e"
    },
    {
      "commit": "f2594c99cc98923ad5949713d4519c5d4f24f4f6",
      "tree": "adc38b27930d2b7b57fc847f8bd10a1c506b2a90",
      "parents": [
        "59010e63bb58c702ccdbcf6f7e0fb047bf8c8f73"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 14:32:02 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 14:32:02 2026 +0200"
      },
      "message": "MINOR: [CI] Bump docker/login-action from 4.2.0 to 4.4.0 (#1210)\n\nBumps [docker/login-action](https://github.com/docker/login-action) from\n4.2.0 to 4.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/docker/login-action/releases\"\u003edocker/login-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.4.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip empty \u003ccode\u003eregistry-auth\u003c/code\u003e secret mask by \u003ca\nhref\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1035\"\u003edocker/login-action#1035\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and\n\u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1077.0 \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1034\"\u003edocker/login-action#1034\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/docker/login-action/compare/v4.3.0...v4.4.0\"\u003ehttps://github.com/docker/login-action/compare/v4.3.0...v4.4.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve names in esbuild bundle by \u003ca\nhref\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e@​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1022\"\u003edocker/login-action#1022\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​aws-sdk/client-ecr\u003c/code\u003e and\n\u003ccode\u003e@​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1076.0 \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/999\"\u003edocker/login-action#999\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1030\"\u003edocker/login-action#1030\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​docker/actions-toolkit\u003c/code\u003e from 0.90.0 to 0.92.0 in\n\u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1004\"\u003edocker/login-action#1004\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1027\"\u003edocker/login-action#1027\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​sigstore/core\u003c/code\u003e from 3.1.0 to 3.2.1 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1023\"\u003edocker/login-action#1023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​sigstore/verify\u003c/code\u003e from 3.1.0 to 3.1.1 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1029\"\u003edocker/login-action#1029\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump http-proxy-agent and https-proxy-agent to 9.1.0 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1017\"\u003edocker/login-action#1017\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.1 to 5.2.0 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1028\"\u003edocker/login-action#1028\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump sigstore from 4.1.0 to 4.1.1 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1031\"\u003edocker/login-action#1031\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.5 to 0.2.7 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1002\"\u003edocker/login-action#1002\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.24.1 to 6.27.0 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1020\"\u003edocker/login-action#1020\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.3 to 7.3.6 in \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/pull/1019\"\u003edocker/login-action#1019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/docker/login-action/compare/v4.2.0...v4.3.0\"\u003ehttps://github.com/docker/login-action/compare/v4.2.0...v4.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0\"\u003e\u003ccode\u003eaf1e73f\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/issues/1034\"\u003e#1034\u003c/a\u003e\nfrom docker/dependabot/npm_and_yarn/aws-sdk-dependen...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b\"\u003e\u003ccode\u003eda722bd\u003c/code\u003e\u003c/a\u003e\n[dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a\"\u003e\u003ccode\u003e2916ad6\u003c/code\u003e\u003c/a\u003e\nbuild(deps): bump the aws-sdk-dependencies group across 1 directory with\n2 up...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903\"\u003e\u003ccode\u003eca0a662\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/issues/1035\"\u003e#1035\u003c/a\u003e\nfrom crazy-max/fix-registry-auth-empty-mask\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80\"\u003e\u003ccode\u003ec455755\u003c/code\u003e\u003c/a\u003e\nchore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438\"\u003e\u003ccode\u003e4835190\u003c/code\u003e\u003c/a\u003e\nskip empty registry-auth secret mask\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004\"\u003e\u003ccode\u003e992421c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/issues/1033\"\u003e#1033\u003c/a\u003e\nfrom docker/dependabot/github_actions/docker/bake-ac...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/b249b43765525dd7951068267a34cf63f22ab4f0\"\u003e\u003ccode\u003eb249b43\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/docker/login-action/issues/1032\"\u003e#1032\u003c/a\u003e\nfrom docker/dependabot/github_actions/docker/bake-ac...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/1b67977736863551a88ff218642a2d7628b10520\"\u003e\u003ccode\u003e1b67977\u003c/code\u003e\u003c/a\u003e\nbuild(deps): bump docker/bake-action from 7.2.0 to 7.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/docker/login-action/commit/9d49d6a3234c78daa10c3c12183ef7b6caa8e69e\"\u003e\u003ccode\u003e9d49d6a\u003c/code\u003e\u003c/a\u003e\nbuild(deps): bump docker/bake-action/subaction/matrix\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/login-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4.2.0\u0026new-version\u003d4.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "59010e63bb58c702ccdbcf6f7e0fb047bf8c8f73",
      "tree": "8fa212ce2373a8fceaca7468aeb282f00d97ef3d",
      "parents": [
        "afd688e024753c75854e707748fe5ad4411d3361"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 14:31:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 14:31:03 2026 +0200"
      },
      "message": "MINOR: Bump checker.framework.version from 4.2.0 to 4.2.1 (#1211)\n\nBumps `checker.framework.version` from 4.2.0 to 4.2.1.\nUpdates `org.checkerframework:checker-qual` from 4.2.0 to 4.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/releases\"\u003eorg.checkerframework:checker-qual\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eChecker Framework 4.2.1\u003c/h2\u003e\n\u003ch2\u003eVersion 4.2.1 (2026-07-01)\u003c/h2\u003e\n\u003ch3\u003eClosed issues\u003c/h3\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7726\"\u003e#7726\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md\"\u003eorg.checkerframework:checker-qual\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 4.2.1 (2026-07-01)\u003c/h2\u003e\n\u003ch3\u003eClosed issues\u003c/h3\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7726\"\u003e#7726\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/ef8cecd00663136e5bb4d6d3d32f936d500f519c\"\u003e\u003ccode\u003eef8cecd\u003c/code\u003e\u003c/a\u003e\nnew release 4.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/5d046116bece9b5ebb359fab260c2d17988a5e41\"\u003e\u003ccode\u003e5d04611\u003c/code\u003e\u003c/a\u003e\nPrep for release.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/0907ddc90cd25f32e5bf8922d8277d0b41de7fc2\"\u003e\u003ccode\u003e0907ddc\u003c/code\u003e\u003c/a\u003e\nUse \u003ccode\u003e@MonotonicNonNull\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/6a7d71c8cbba0c3c14547d4c06ddb500d15c71d2\"\u003e\u003ccode\u003e6a7d71c\u003c/code\u003e\u003c/a\u003e\nGradle formatting\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/c10d86a0c787c2e5ca95a2c5bb9f4c598b23504e\"\u003e\u003ccode\u003ec10d86a\u003c/code\u003e\u003c/a\u003e\nUpdate plugin com-gradleup-shadow to v9.4.3 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7778\"\u003e#7778\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/ec79d1f81a434153c13e0fb83692119304cf2908\"\u003e\u003ccode\u003eec79d1f\u003c/code\u003e\u003c/a\u003e\nUpdate Gradle to v9.6.1 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7779\"\u003e#7779\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/f95a2e030e54bae2e26a5e7fa47177acceb4ef6b\"\u003e\u003ccode\u003ef95a2e0\u003c/code\u003e\u003c/a\u003e\nMore examples for \u003ccode\u003e-AresourceLeakIgnoredExceptions\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7774\"\u003e#7774\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/79948a2df22a82425a3a17b70b6d784c812d7d5d\"\u003e\u003ccode\u003e79948a2\u003c/code\u003e\u003c/a\u003e\nUpdate Gradle to v9.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7775\"\u003e#7775\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/e013552e6274b87c9f5dd1c768b4dd12a828707f\"\u003e\u003ccode\u003ee013552\u003c/code\u003e\u003c/a\u003e\nUpdate actions/checkout action to v7 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7776\"\u003e#7776\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/4ba90c265ca8ee0ad4da7ce67af275ee6c7c40e1\"\u003e\u003ccode\u003e4ba90c2\u003c/code\u003e\u003c/a\u003e\nUpdate plugin com-diffplug-spotless to v8.7.0 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7773\"\u003e#7773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/compare/checker-framework-4.2.0...checker-framework-4.2.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `org.checkerframework:checker` from 4.2.0 to 4.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/releases\"\u003eorg.checkerframework:checker\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eChecker Framework 4.2.1\u003c/h2\u003e\n\u003ch2\u003eVersion 4.2.1 (2026-07-01)\u003c/h2\u003e\n\u003ch3\u003eClosed issues\u003c/h3\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7726\"\u003e#7726\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md\"\u003eorg.checkerframework:checker\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 4.2.1 (2026-07-01)\u003c/h2\u003e\n\u003ch3\u003eClosed issues\u003c/h3\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7726\"\u003e#7726\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/ef8cecd00663136e5bb4d6d3d32f936d500f519c\"\u003e\u003ccode\u003eef8cecd\u003c/code\u003e\u003c/a\u003e\nnew release 4.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/5d046116bece9b5ebb359fab260c2d17988a5e41\"\u003e\u003ccode\u003e5d04611\u003c/code\u003e\u003c/a\u003e\nPrep for release.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/0907ddc90cd25f32e5bf8922d8277d0b41de7fc2\"\u003e\u003ccode\u003e0907ddc\u003c/code\u003e\u003c/a\u003e\nUse \u003ccode\u003e@MonotonicNonNull\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/6a7d71c8cbba0c3c14547d4c06ddb500d15c71d2\"\u003e\u003ccode\u003e6a7d71c\u003c/code\u003e\u003c/a\u003e\nGradle formatting\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/c10d86a0c787c2e5ca95a2c5bb9f4c598b23504e\"\u003e\u003ccode\u003ec10d86a\u003c/code\u003e\u003c/a\u003e\nUpdate plugin com-gradleup-shadow to v9.4.3 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7778\"\u003e#7778\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/ec79d1f81a434153c13e0fb83692119304cf2908\"\u003e\u003ccode\u003eec79d1f\u003c/code\u003e\u003c/a\u003e\nUpdate Gradle to v9.6.1 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7779\"\u003e#7779\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/f95a2e030e54bae2e26a5e7fa47177acceb4ef6b\"\u003e\u003ccode\u003ef95a2e0\u003c/code\u003e\u003c/a\u003e\nMore examples for \u003ccode\u003e-AresourceLeakIgnoredExceptions\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7774\"\u003e#7774\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/79948a2df22a82425a3a17b70b6d784c812d7d5d\"\u003e\u003ccode\u003e79948a2\u003c/code\u003e\u003c/a\u003e\nUpdate Gradle to v9.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7775\"\u003e#7775\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/e013552e6274b87c9f5dd1c768b4dd12a828707f\"\u003e\u003ccode\u003ee013552\u003c/code\u003e\u003c/a\u003e\nUpdate actions/checkout action to v7 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7776\"\u003e#7776\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/commit/4ba90c265ca8ee0ad4da7ce67af275ee6c7c40e1\"\u003e\u003ccode\u003e4ba90c2\u003c/code\u003e\u003c/a\u003e\nUpdate plugin com-diffplug-spotless to v8.7.0 (\u003ca\nhref\u003d\"https://redirect.github.com/typetools/checker-framework/issues/7773\"\u003e#7773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/typetools/checker-framework/compare/checker-framework-4.2.0...checker-framework-4.2.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "afd688e024753c75854e707748fe5ad4411d3361",
      "tree": "fb1f1c477fda798008fa83f6e2947d1d7cc335f8",
      "parents": [
        "1801a8a0937fb4aaac3654c66ec9109a6892666c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 14:29:40 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 14:29:40 2026 +0200"
      },
      "message": "MINOR: Bump com.gradle:develocity-maven-extension from 2.4.1 to 2.5.0 (#1212)\n\nBumps com.gradle:develocity-maven-extension from 2.4.1 to 2.5.0.\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.gradle:develocity-maven-extension\u0026package-manager\u003dmaven\u0026previous-version\u003d2.4.1\u0026new-version\u003d2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "1801a8a0937fb4aaac3654c66ec9109a6892666c",
      "tree": "240870f635e59c1bb4d454679184e217b897c7ea",
      "parents": [
        "e087824935d283d3636d8edb908a79df2de217c4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 14:28:19 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 14:28:19 2026 +0200"
      },
      "message": "MINOR: Bump com.gradle:common-custom-user-data-maven-extension from 2.2.0 to 2.3.0 (#1213)\n\nBumps\n[com.gradle:common-custom-user-data-maven-extension](https://github.com/gradle/common-custom-user-data-maven-extension)\nfrom 2.2.0 to 2.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/releases\"\u003ecom.gradle:common-custom-user-data-maven-extension\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[NEW] Capture Cursor as an AI agent via the\n\u003ccode\u003eCURSOR_AGENT\u003c/code\u003e environment variable\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/61a5a45a57981e2dd66b67b9fbc4fde626a02e02\"\u003e\u003ccode\u003e61a5a45\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release v2.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/398a231a48153a893b36e282ab72a8fa8c979161\"\u003e\u003ccode\u003e398a231\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update actions/setup-java digest to 1bcf9fb (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/389\"\u003e#389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/f66a5c678feaf0292a70b96466abc5d437a3993a\"\u003e\u003ccode\u003ef66a5c6\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/391\"\u003e#391\u003c/a\u003e\nfrom gradle/erichaagdev/capture-cursor-ai-agent\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/8311f5845f801278c52094b38ecb2e3e97052420\"\u003e\u003ccode\u003e8311f58\u003c/code\u003e\u003c/a\u003e\nCapture Cursor as an AI agent\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/0236fc861cfb0391b8bb6b5abfc4c7c5ca834cc0\"\u003e\u003ccode\u003e0236fc8\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update dependency\norg.eclipse.sisu:org.eclipse.sisu.inject to ...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/0d8c2c5201316f4747ff8eaa038d47ac465a54d9\"\u003e\u003ccode\u003e0d8c2c5\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update GitHub Actions to v7 (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/386\"\u003e#386\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/21ef159386fce25b750914e21c879496f7c01e7a\"\u003e\u003ccode\u003e21ef159\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update Maven dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/387\"\u003e#387\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/d9240f0c0626d1bb0b0ef5341186fb342e48f7db\"\u003e\u003ccode\u003ed9240f0\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update Maven dependencies to v0.11.0 (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/384\"\u003e#384\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/83935cce4e8aaab79a246cb1e27a14cc974ad64f\"\u003e\u003ccode\u003e83935cc\u003c/code\u003e\u003c/a\u003e\nAuto-merge GitHub Actions digest re-pins (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/385\"\u003e#385\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/commit/9d03ae646b229aaaf652be3e52eccdc579ef8a06\"\u003e\u003ccode\u003e9d03ae6\u003c/code\u003e\u003c/a\u003e\n[Renovate Bot] Update GitHub Actions to ad2b381 (\u003ca\nhref\u003d\"https://redirect.github.com/gradle/common-custom-user-data-maven-extension/issues/383\"\u003e#383\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/gradle/common-custom-user-data-maven-extension/compare/v2.2.0...v2.3.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.gradle:common-custom-user-data-maven-extension\u0026package-manager\u003dmaven\u0026previous-version\u003d2.2.0\u0026new-version\u003d2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e087824935d283d3636d8edb908a79df2de217c4",
      "tree": "02b471043fbe698fb909b56010552013ebcf8f04",
      "parents": [
        "9e100a3b7f681a64f11eb4405e9e43431caf3647"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 14:25:41 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 14:25:41 2026 +0200"
      },
      "message": "MINOR: Bump com.diffplug.spotless:spotless-maven-plugin from 3.6.0 to 3.8.0 (#1214)\n\nBumps\n[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)\nfrom 3.6.0 to 3.8.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.8.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for custom string format for license header copyright\nyear via \u003ccode\u003eyearStringFormat()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2965\"\u003e#2965\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;expandWildcardImports\u0026gt;\u003c/code\u003e no longer triggers a full\ntransitive dependency resolution on every build. Dependency resolution\nis now deferred until the step actually runs, so projects that do not\nuse \u003ccode\u003e\u0026lt;expandWildcardImports\u0026gt;\u003c/code\u003e (or that use version\nranges) are no longer penalized. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2983\"\u003e#2983\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.7.0\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;toggleOffOn\u0026gt;\u003c/code\u003e no longer disables lint-only steps\nsuch as \u003ccode\u003e\u0026lt;forbidWildcardImports\u0026gt;\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where\ncopyright year is surrounded by whitespace. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;flexmark\u0026gt;\u003c/code\u003e step now supports arbitrary formatter\noptions via \u003ccode\u003e\u0026lt;formatterOptions\u0026gt;\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003espotless-lib and spotless-lib-extra releases\u003c/h1\u003e\n\u003cp\u003eIf you are a Spotless user (as opposed to developer), then you are\nprobably looking for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis document is intended for Spotless developers.\u003c/p\u003e\n\u003cp\u003eWe adhere to the \u003ca\nhref\u003d\"https://keepachangelog.com/en/1.0.0/\"\u003ekeepachangelog\u003c/a\u003e format\n(starting after version \u003ccode\u003e1.27.0\u003c/code\u003e).\u003c/p\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[4.8.0] - 2026-06-29\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for custom string format for license header copyright\nyear via \u003ccode\u003eyearStringFormat()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2965\"\u003e#2965\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.7.0] - 2026-06-16\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflexmark\u003c/code\u003e step now supports arbitrary formatter options\nvia a \u003ccode\u003eformatterOptions\u003c/code\u003e map. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eFenceStep.preserveWithin\u003c/code\u003e now forwards lints from nested\nsteps while still suppressing lints inside preserved blocks. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSupport \u003ccode\u003ektfmt\u003c/code\u003e 0.63 and use its new builder API for\nformatting options to better avoid future breaking changes.\u003c/li\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where\ncopyright year is surrounded by whitespace. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003egreclipse\u003c/code\u003e version to latest\n\u003ccode\u003e4.35\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.39\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2924\"\u003e#2924\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.2] - 2026-05-27\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eP2Provisioner\u003c/code\u003e now passes cache directory overrides\ndirectly to Solstice. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eforbidWildcardImports\u003c/code\u003e and\n\u003ccode\u003eforbidModuleImports\u003c/code\u003e now detect imports that have leading\nwhitespace (indentation/tabs). (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2939\"\u003e#2939\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eversionCatalog\u003c/code\u003e step no longer splits long inline tables\nacross multiple lines — Gradle\u0027s TOML 1.0 parser cannot read multi-line\ninline tables. The \u003ccode\u003emaxLineLength\u003c/code\u003e option has been removed.\n(\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2948\"\u003e#2948\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eEclipseJdtFormtterStep\u003c/code\u003e now can conditionally set\ncompiler source/compliance options. Allows for better parsing of AST\nNode for newer language features and more correct sorting; e.g. records\nor seal classes. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFormatter\u003c/code\u003e no longer recomputes line-ending\nnormalization (\u003ccode\u003eLineEnding.toUnix\u003c/code\u003e) a second time for every\nformatter step that changes content, removing redundant O(n) work from\nthe core formatting loop. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2934\"\u003e#2934\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eexpandWildcardImports support pom type dependency. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2839\"\u003e#2839\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.1] - 2026-05-15\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eLicenseHeaderStep\u003c/code\u003e in \u003ccode\u003eSET_FROM_GIT\u003c/code\u003e year\nmode no longer invokes \u003ccode\u003egit log\u003c/code\u003e through \u003ccode\u003ebash -c\u003c/code\u003e\n/ \u003ccode\u003ecmd /c\u003c/code\u003e, eliminating a shell-injection vector when\nprocessing repositories that contain files whose names include shell\nmetacharacters.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.0] - 2026-05-14\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003escalafmt()\u003c/code\u003e now reads the version from the\n\u003ccode\u003eversion\u003c/code\u003e field in the scalafmt config file when no version\nis explicitly set in the plugin config, falling back to the built-in\ndefault only if neither is available. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2922\"\u003e#2922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eversionCatalog\u003c/code\u003e step for formatting and sorting\nGradle version catalog (\u003ccode\u003e.toml\u003c/code\u003e) files. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2916\"\u003e#2916\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ejavaparserVersion\u003c/code\u003e option to the Cleanthat step,\nallowing callers to override the JavaParser version pulled in\ntransitively by Cleanthat. (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/03d43ba2cdc81050e07b62646c08b22e39505368\"\u003e\u003ccode\u003e03d43ba\u003c/code\u003e\u003c/a\u003e\nPublished maven/3.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/8b80c1388017f9b390fd9681007ba58a8c5d77f7\"\u003e\u003ccode\u003e8b80c13\u003c/code\u003e\u003c/a\u003e\nPublished gradle/8.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/8ee6cf904ae77a4baec287132c69a63d4b5f4052\"\u003e\u003ccode\u003e8ee6cf9\u003c/code\u003e\u003c/a\u003e\nPublished lib/4.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/6c02c0bf3fa0914206b28b2e9abec5e2061273e4\"\u003e\u003ccode\u003e6c02c0b\u003c/code\u003e\u003c/a\u003e\nAdd missing changelog entry.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/264f4cc904ad85149a90822c0835c17a615cee8e\"\u003e\u003ccode\u003e264f4cc\u003c/code\u003e\u003c/a\u003e\nAdd regression test for forbidWildcardImports inside toggleOffOn (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2982\"\u003e#2982\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/6abb06449354899642d716dfb3daf67a888bac9b\"\u003e\u003ccode\u003e6abb064\u003c/code\u003e\u003c/a\u003e\nfix \u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2983\"\u003e#2983\u003c/a\u003e,\nexpandWildcardImports triggers a full transitive reso… (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2984\"\u003e#2984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/f4536d41caebdda8201cdb126832ea96a75e5afe\"\u003e\u003ccode\u003ef4536d4\u003c/code\u003e\u003c/a\u003e\nUpdate plugin spotbugs to v6.5.8 (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2987\"\u003e#2987\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/873454acbc24dd66a0d334f29b30d5dcb645cd0a\"\u003e\u003ccode\u003e873454a\u003c/code\u003e\u003c/a\u003e\nUpdate plugin spotbugs to v6.5.8\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/000b8a8f9f0398f60aeafee4d2fbd90a6a61b7f1\"\u003e\u003ccode\u003e000b8a8\u003c/code\u003e\u003c/a\u003e\nUpdate dependency org.junit.jupiter:junit-jupiter to v6.1.1 (\u003ca\nhref\u003d\"https://redirect.github.com/diffplug/spotless/issues/2985\"\u003e#2985\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/diffplug/spotless/commit/84ebcab6a588c0ae7ddb8d883f5f60947e488e0a\"\u003e\u003ccode\u003e84ebcab\u003c/code\u003e\u003c/a\u003e\nUpdate dependency org.junit.jupiter:junit-jupiter to v6.1.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/diffplug/spotless/compare/maven/3.6.0...maven/3.8.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.6.0\u0026new-version\u003d3.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "9e100a3b7f681a64f11eb4405e9e43431caf3647",
      "tree": "13813e7ef9575ea5601115b47aaab4a351d191bd",
      "parents": [
        "c7e8e75c9978c60234dbcbd31311ac3ee2975fa6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 14:21:40 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 14:21:40 2026 +0200"
      },
      "message": "MINOR: Bump com.squareup.okhttp3:mockwebserver3 from 5.3.2 to 5.4.0 (#1215)\n\nBumps\n[com.squareup.okhttp3:mockwebserver3](https://github.com/square/okhttp)\nfrom 5.3.2 to 5.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/square/okhttp/blob/master/CHANGELOG.md\"\u003ecom.squareup.okhttp3:mockwebserver3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 5.4.0\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003e2026-06-08\u003c/em\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNew: Add superpowers to interceptors. Interceptors can now override\nanything settable on\n\u003ccode\u003eOkHttpClient.Builder\u003c/code\u003e, such as the cache, connection pool,\nsocket factory, and DNS. We expect\nthis will allow most users to use interceptors everywhere, insted of\nmixing and matching\ninterceptors with custom \u003ccode\u003eCall.Factory\u003c/code\u003e wrappers.\u003c/li\u003e\n\u003cli\u003eFix: Limit each HTTP/2 response to 256 KiB of total headers.\u003c/li\u003e\n\u003cli\u003eUpgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is\nused by the optional\n\u003ccode\u003eokhttp-coroutines\u003c/code\u003e artifact.\u003c/li\u003e\n\u003cli\u003eUpgrade: [GraalVM 25.0.3][graalvm_25].\u003c/li\u003e\n\u003cli\u003eUpgrade: [Okio 3.17.0][okio_3_17_0].\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5\"\u003e\u003ccode\u003e61423f4\u003c/code\u003e\u003c/a\u003e\nPrepare for release 5.4.0.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370\"\u003e\u003ccode\u003ed7e6eff\u003c/code\u003e\u003c/a\u003e\nUpdate eclipse.osgi to v3.24.200 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9480\"\u003e#9480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b\"\u003e\u003ccode\u003e7a35098\u003c/code\u003e\u003c/a\u003e\nUpdate bnd to v7.3.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9475\"\u003e#9475\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868\"\u003e\u003ccode\u003e0c5a45b\u003c/code\u003e\u003c/a\u003e\nUpdate dependency com.puppycrawl.tools:checkstyle to v13.5.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9468\"\u003e#9468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b\"\u003e\u003ccode\u003e113ad17\u003c/code\u003e\u003c/a\u003e\nUpdate dependency macos to v26 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9457\"\u003e#9457\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1\"\u003e\u003ccode\u003e84f601a\u003c/code\u003e\u003c/a\u003e\nUpdate shadow.plugin to v9.4.2 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9466\"\u003e#9466\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c\"\u003e\u003ccode\u003e7d463f4\u003c/code\u003e\u003c/a\u003e\nUpdate spotless.plugin to v8.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9464\"\u003e#9464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7\"\u003e\u003ccode\u003e3bf00f5\u003c/code\u003e\u003c/a\u003e\nUpdate plugin com.diffplug.spotless to v8.6.0 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9463\"\u003e#9463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9\"\u003e\u003ccode\u003ecfc45a3\u003c/code\u003e\u003c/a\u003e\nUpdate spotless.plugin to v8.5.1 (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9456\"\u003e#9456\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34\"\u003e\u003ccode\u003e81c5006\u003c/code\u003e\u003c/a\u003e\nApply gradle lint correctly (\u003ca\nhref\u003d\"https://redirect.github.com/square/okhttp/issues/9459\"\u003e#9459\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/square/okhttp/compare/parent-5.3.2...parent-5.4.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.squareup.okhttp3:mockwebserver3\u0026package-manager\u003dmaven\u0026previous-version\u003d5.3.2\u0026new-version\u003d5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c7e8e75c9978c60234dbcbd31311ac3ee2975fa6",
      "tree": "74ec026afb086ffe6eb7b0325483d091bf893b54",
      "parents": [
        "9e863319b1e3bedda45dbb12d5989f6b1330f664"
      ],
      "author": {
        "name": "Aurélien Pupier",
        "email": "apupier@ibm.com",
        "time": "Mon Jul 06 08:50:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 08:50:26 2026 +0200"
      },
      "message": "MINOR: Restrict trigger push branch for GitHub Workflow (#1204)\n\nFeature branches rarely need their own CI runs: the code is already\ntested when a pull request is opened against a release branch. If the\npush trigger has no branch restriction and pull_request is also\nconfigured, every push to a branch with an open PR runs the workflow\ntwice: once for the push and once for the PR synchronisation.\n\nAlways give the push trigger an explicit list of branches: this stops\nbranches created from a release branch from inheriting its workflow\nruns.\n\nsee\nhttps://cwiki.apache.org/confluence/pages/viewpage.action?pageId\u003d430408443#GitHubActionsRecommendedPractices-Restrictthepushtriggertospecificbranches\n\n## What\u0027s Changed\n\nPlease fill in a description of the changes here.\n\n**This contains breaking changes.** \u003c!-- Remove this line if there are\nno breaking changes. --\u003e\n\nCloses #NNN.\n\nNote that I needed to recreate a PR as the previous one was closed\nhttps://github.com/apache/arrow-java/pull/1202#issuecomment-4864548916\n\nSigned-off-by: Aurélien Pupier \u003capupier@ibm.com\u003e"
    },
    {
      "commit": "9e863319b1e3bedda45dbb12d5989f6b1330f664",
      "tree": "e6805594e18da1bb85bcd0ef1e6dc108c01c8c71",
      "parents": [
        "8ce39730fe969b41c8620b02f3fa77c974d90784"
      ],
      "author": {
        "name": "Abdul Rawoof Khan",
        "email": "abdulr@bugqore.com",
        "time": "Mon Jul 06 06:39:33 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jul 05 18:09:33 2026 -0700"
      },
      "message": "GH-1206: validate decompressed length in Lz4CompressionCodec (#1207)\n\n## What\u0027s Changed\n\n`Lz4CompressionCodec.doDecompress` sizes the output buffer to the bytes\nit actually decompressed, but sets `writerIndex` to the length taken\nfrom the untrusted 8-byte prefix. A buffer whose prefix claims more than\nthe real output leaves the returned `ArrowBuf` with a `writerIndex` past\nits capacity, and consumers then read off-heap memory beyond the\nallocation. This adds the actual-vs-claimed length check the ZSTD codec\nalready does, so a mismatch throws instead of producing an over-long\nbuffer.\n\nCloses #1206."
    },
    {
      "commit": "8ce39730fe969b41c8620b02f3fa77c974d90784",
      "tree": "5d973e1be550c70f3d5258412c7624410a332679",
      "parents": [
        "04471f4f8900e0a91efe0d6ae717c3211aa5efbd"
      ],
      "author": {
        "name": "Jordan Epstein",
        "email": "32082339+jordepic@users.noreply.github.com",
        "time": "Thu Jul 02 18:16:18 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 02 16:16:18 2026 -0700"
      },
      "message": "GH-1179: Correct the size of var-width vector with \u003e0 start offset during vector append (#1180)\n\n## What\u0027s Changed\n\nFix VectorAppender data size computation for variable-width vectors with\nnon-zero start offsets\n\nWhen appending a variable width offset vector in DataFusion comet I was\nreceiving exceptions\ndue to allocating too much memory. This is because Comet passes variable\nwidth arrays back\nto Java where the initial offset vector entry is greater than 0. Prior\nto this change, arrow-java\ndetermines how many bytes to copy by just looking at the last offset\nentry in the buffer,\ncompletely disregarding the value of the first. If first \u003d 100 and last\n\u003d 200, Java will still\ncopy 200 bytes instead of 100. In this change we fix that.\n\nCloses #1179\n\n---------\n\nCo-authored-by: Jordan Epstein \u003cjordan.epstein@imc.com\u003e"
    },
    {
      "commit": "04471f4f8900e0a91efe0d6ae717c3211aa5efbd",
      "tree": "5ff551150a268a53420de6799a8bcbc7ad6d9f5a",
      "parents": [
        "bd8cd52fc8426b485a8b3e64997fb178c84c9de2"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jul 02 08:11:17 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 02 08:11:17 2026 +0200"
      },
      "message": "MINOR: Bump logback.version from 1.5.32 to 1.5.34 (#1171)\n\nBumps `logback.version` from 1.5.32 to 1.5.34.\nUpdates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-classic\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.34\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-01 Release of logback version 1.5.34\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• In case certain StackTraceElement values returned by the\nThrowable.getStackTrace method are null, StackTraceElementProxy\nsubstitutes a dummy instance instead of throwing an\nIllegalArgumentException. This resolves [issues \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003e#1040\u003c/a\u003e](\u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003eqos-ch/logback#1040\u003c/a\u003e),\nreported by Naotsugu Kobayashi.\u003c/p\u003e\n\u003cp\u003e• HardenedObjectInputStream will now throw an InvalidClassException\nduring deserialization attempts of Proxy classes. This change addresses\npotential deserialization whitelist bypass vulnerability reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-10532\"\u003eCVE-2026-10532\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\ne62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag\nv_1.5.34. This release was built using Java \u0026quot;21\u0026quot; 2023-10-17\nLTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.33\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-05-27 Release of logback version 1.5.33\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003ePropertiesConfiguratorModelHandler\u003c/code\u003e now registers\nproperties file URLs to the \u003ccode\u003eConfigurationWatchList\u003c/code\u003e when\nscan is enabled (via local scan\u003d\u0026quot;true\u0026quot; attribute or top-level\nconfiguration scan), ensuring changes are detected and reconfiguration\noccurs. This problem was reported in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1034\"\u003eissues/1034\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• When processing \u003ccode\u003e\u0026lt;conversionRule\u0026gt;\u003c/code\u003e elements and\nboth \u003ccode\u003eclass\u003c/code\u003e and \u003ccode\u003econverterClass\u003c/code\u003e attributes are\nspecified, silently use the class attribute without issuing a warning.\nHowever, if the attribute values differ, a warning will be issued. This\nchange was requested in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1031\"\u003eissues/1031\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eHardenedModelInputStream\u003c/code\u003e will no longer accept to\ndeserialize all classes located under the \u0026quot;java.lang\u0026quot; and\n\u0026quot;java.util\u0026quot; packages but a limited number of explicitly\nauthorized classes in those packages. This potential deserialization\nwhitelist bypass vulnerability was reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-9828\"\u003eCVE-2026-9828\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• SSL parameters for \u003ccode\u003eSSLSocketAppender\u003c/code\u003e now enable\nhostname verification by default. Moreover, the default protocol is now\n\u0026quot;TLSv1.2\u0026quot;. This potential vulnerability was reported by York\nShen.\u003c/p\u003e\n\u003cp\u003e• When printing the status message field,\n\u003ccode\u003eViewStatusMessagesServletBase\u003c/code\u003e now escapes special\ncharacters such as \u0026quot;\u0026amp;\u0026quot; as character entities. This\npotential vulnerability was reported by York Shen.\u003c/p\u003e\n\u003cp\u003e• A bit-wise identical binary of this version can be reproduced by\nbuilding from source code at commit\n124e8b49b55ac34d08743a0646bd463410192647 associated with the tag\nv_1.5.33. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe\"\u003e\u003ccode\u003ee62272a\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.34\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341\"\u003e\u003ccode\u003e1e9e926\u003c/code\u003e\u003c/a\u003e\nadd resolveProxyClassRejectsDynamicProxies unit test\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f\"\u003e\u003ccode\u003e2de5cbe\u003c/code\u003e\u003c/a\u003e\nadded StackTraceElementProxyTest, minor edits to AGENTS.md\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e\"\u003e\u003ccode\u003e0e9b927\u003c/code\u003e\u003c/a\u003e\nin case StackTraceElement is null use a substitute, fixing\nissues/1040\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818\"\u003e\u003ccode\u003ef7a0654\u003c/code\u003e\u003c/a\u003e\nprevent resolveProxyClass bypass\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0\"\u003e\u003ccode\u003e249b81f\u003c/code\u003e\u003c/a\u003e\ndocs are no longer distributed\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8\"\u003e\u003ccode\u003e1c3b26a\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.34-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647\"\u003e\u003ccode\u003e124e8b4\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.33\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3\"\u003e\u003ccode\u003ed8fd6f2\u003c/code\u003e\u003c/a\u003e\nescapeTags in message field when printing status messages\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4\"\u003e\u003ccode\u003e95edbeb\u003c/code\u003e\u003c/a\u003e\nhostnameVerification default to true in SSLParametersConfiguration,\nSSL.DEFAU...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ch.qos.logback:logback-core` from 1.5.32 to 1.5.34\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/releases\"\u003ech.qos.logback:logback-core\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLogback 1.5.34\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-06-01 Release of logback version 1.5.34\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• In case certain StackTraceElement values returned by the\nThrowable.getStackTrace method are null, StackTraceElementProxy\nsubstitutes a dummy instance instead of throwing an\nIllegalArgumentException. This resolves [issues \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003e#1040\u003c/a\u003e](\u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1040\"\u003eqos-ch/logback#1040\u003c/a\u003e),\nreported by Naotsugu Kobayashi.\u003c/p\u003e\n\u003cp\u003e• HardenedObjectInputStream will now throw an InvalidClassException\nduring deserialization attempts of Proxy classes. This change addresses\npotential deserialization whitelist bypass vulnerability reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-10532\"\u003eCVE-2026-10532\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• A bitwise identical binary of this version can be reproduced by\nbuilding from source code at commit\ne62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag\nv_1.5.34. This release was built using Java \u0026quot;21\u0026quot; 2023-10-17\nLTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003ch2\u003eLogback 1.5.33\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003e2026-05-27 Release of logback version 1.5.33\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003ePropertiesConfiguratorModelHandler\u003c/code\u003e now registers\nproperties file URLs to the \u003ccode\u003eConfigurationWatchList\u003c/code\u003e when\nscan is enabled (via local scan\u003d\u0026quot;true\u0026quot; attribute or top-level\nconfiguration scan), ensuring changes are detected and reconfiguration\noccurs. This problem was reported in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1034\"\u003eissues/1034\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• When processing \u003ccode\u003e\u0026lt;conversionRule\u0026gt;\u003c/code\u003e elements and\nboth \u003ccode\u003eclass\u003c/code\u003e and \u003ccode\u003econverterClass\u003c/code\u003e attributes are\nspecified, silently use the class attribute without issuing a warning.\nHowever, if the attribute values differ, a warning will be issued. This\nchange was requested in \u003ca\nhref\u003d\"https://redirect.github.com/qos-ch/logback/issues/1031\"\u003eissues/1031\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• \u003ccode\u003eHardenedModelInputStream\u003c/code\u003e will no longer accept to\ndeserialize all classes located under the \u0026quot;java.lang\u0026quot; and\n\u0026quot;java.util\u0026quot; packages but a limited number of explicitly\nauthorized classes in those packages. This potential deserialization\nwhitelist bypass vulnerability was reported by \u003ca\nhref\u003d\"https://github.com/york-shen\"\u003eYork Shen\u003c/a\u003e and registered as \u003ca\nhref\u003d\"https://www.cve.org/cverecord?id\u003dCVE-2026-9828\"\u003eCVE-2026-9828\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e• SSL parameters for \u003ccode\u003eSSLSocketAppender\u003c/code\u003e now enable\nhostname verification by default. Moreover, the default protocol is now\n\u0026quot;TLSv1.2\u0026quot;. This potential vulnerability was reported by York\nShen.\u003c/p\u003e\n\u003cp\u003e• When printing the status message field,\n\u003ccode\u003eViewStatusMessagesServletBase\u003c/code\u003e now escapes special\ncharacters such as \u0026quot;\u0026amp;\u0026quot; as character entities. This\npotential vulnerability was reported by York Shen.\u003c/p\u003e\n\u003cp\u003e• A bit-wise identical binary of this version can be reproduced by\nbuilding from source code at commit\n124e8b49b55ac34d08743a0646bd463410192647 associated with the tag\nv_1.5.33. Release built using Java \u0026quot;21\u0026quot; 2023-10-17 LTS build\n21.0.1.+12-LTS-29 under Linux Debian 11.6.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe\"\u003e\u003ccode\u003ee62272a\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.34\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341\"\u003e\u003ccode\u003e1e9e926\u003c/code\u003e\u003c/a\u003e\nadd resolveProxyClassRejectsDynamicProxies unit test\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f\"\u003e\u003ccode\u003e2de5cbe\u003c/code\u003e\u003c/a\u003e\nadded StackTraceElementProxyTest, minor edits to AGENTS.md\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e\"\u003e\u003ccode\u003e0e9b927\u003c/code\u003e\u003c/a\u003e\nin case StackTraceElement is null use a substitute, fixing\nissues/1040\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818\"\u003e\u003ccode\u003ef7a0654\u003c/code\u003e\u003c/a\u003e\nprevent resolveProxyClass bypass\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0\"\u003e\u003ccode\u003e249b81f\u003c/code\u003e\u003c/a\u003e\ndocs are no longer distributed\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8\"\u003e\u003ccode\u003e1c3b26a\u003c/code\u003e\u003c/a\u003e\nstart work on 1.5.34-SNAPSHOT\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647\"\u003e\u003ccode\u003e124e8b4\u003c/code\u003e\u003c/a\u003e\nprepare release 1.5.33\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3\"\u003e\u003ccode\u003ed8fd6f2\u003c/code\u003e\u003c/a\u003e\nescapeTags in message field when printing status messages\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4\"\u003e\u003ccode\u003e95edbeb\u003c/code\u003e\u003c/a\u003e\nhostnameVerification default to true in SSLParametersConfiguration,\nSSL.DEFAU...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/qos-ch/logback/compare/v_1.5.32...v_1.5.34\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "bd8cd52fc8426b485a8b3e64997fb178c84c9de2",
      "tree": "e791f723498094cf4f4f0a6e7e564732903beb54",
      "parents": [
        "fcba1b0345faed30621863af85a102c6d2fc1362"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 01 07:54:25 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 07:54:25 2026 +0200"
      },
      "message": "MINOR: Bump com.github.luben:zstd-jni from 1.5.7-10 to 1.5.7-11 (#1184)\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni)\nfrom 1.5.7-10 to 1.5.7-11.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/luben/zstd-jni/commits/v1.5.7-11\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.luben:zstd-jni\u0026package-manager\u003dmaven\u0026previous-version\u003d1.5.7-10\u0026new-version\u003d1.5.7-11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "fcba1b0345faed30621863af85a102c6d2fc1362",
      "tree": "30a9ef53c94159763b8c11d91dc1adc0cc57d7f7",
      "parents": [
        "301d3d8f889d3e4d1f45fc6e1707460ae5baaeb4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 01 07:51:48 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 07:51:48 2026 +0200"
      },
      "message": "MINOR: Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 (#1198)\n\nBumps\n[org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin)\nfrom 2.9.1 to 2.9.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/releases\"\u003eorg.cyclonedx:cyclonedx-maven-plugin\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.9.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: upgrade maven-dependency-analyzer/asm, support Java 25 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/630\"\u003e#630\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/shihyuho\"\u003e\u003ccode\u003e@​shihyuho\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.17.1 to 1.22.0 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/650\"\u003e#650\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/622\"\u003e#622\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: upgrade maven-dependency-analyzer/asm, support Java 25 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/630\"\u003e#630\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/shihyuho\"\u003e\u003ccode\u003e@​shihyuho\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🔧 Build\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eupdate scm urls (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/662\"\u003e#662\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/hboutemy\"\u003e\u003ccode\u003e@​hboutemy\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eswitch to Central Publishing Portal (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/659\"\u003e#659\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/hboutemy\"\u003e\u003ccode\u003e@​hboutemy\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-project-info-reports-plugin from\n3.8.0 to 3.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/655\"\u003e#655\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump plugin-tools.version from 3.15.0 to 3.15.2 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/654\"\u003e#654\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump io.takari.maven.plugins:takari-plugin-integration-testing from\n3.0.1 to 3.1.1 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/616\"\u003e#616\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-invoker-plugin from 3.7.0 to\n3.9.1 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/617\"\u003e#617\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump io.takari.maven.plugins:takari-plugin-testing from 3.0.0 to\n3.1.1 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/618\"\u003e#618\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-compiler-plugin from 3.13.0 to\n3.14.1 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/621\"\u003e#621\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6.0.1 to 6.0.2 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/639\"\u003e#639\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/setup-java from 4 to 5 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/620\"\u003e#620\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003euse shields.io badge (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/648\"\u003e#648\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/hboutemy\"\u003e\u003ccode\u003e@​hboutemy\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6.0.0 to 6.0.1 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/635\"\u003e#635\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 4.2.2 to 6.0.0 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/633\"\u003e#633\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: GH workflow permissions (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/606\"\u003e#606\u003c/a\u003e)\n\u003ca\nhref\u003d\"https://github.com/jkowalleck\"\u003e\u003ccode\u003e@​jkowalleck\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003esimplify compiler release configuration (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/518\"\u003e#518\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/hboutemy\"\u003e\u003ccode\u003e@​hboutemy\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump JamesIves/github-pages-deploy-action from 4.7.1 to 4.7.3 (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/590\"\u003e#590\u003c/a\u003e)\n@\u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade to Doxia 2: m-site-p and skin (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/593\"\u003e#593\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/hboutemy\"\u003e\u003ccode\u003e@​hboutemy\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eadd Reproducible Central report (\u003ca\nhref\u003d\"https://redirect.github.com/CycloneDX/cyclonedx-maven-plugin/pull/592\"\u003e#592\u003c/a\u003e)\n\u003ca href\u003d\"https://github.com/hboutemy\"\u003e\u003ccode\u003e@​hboutemy\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/0fe189d0cd2c80acb1f518e53fbb703456e6534a\"\u003e\u003ccode\u003e0fe189d\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release cyclonedx-maven-plugin-2.9.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/96c218c71646aa987d5778b9f0f035f40ff45239\"\u003e\u003ccode\u003e96c218c\u003c/code\u003e\u003c/a\u003e\nupdate scm urls\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/0fe08b4215263965690c0a0a022c1fdbc396cad8\"\u003e\u003ccode\u003e0fe08b4\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Bump JamesIves/github-pages-deploy-action from 4.7.3 to\n4.8.0\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/6779e48e4108e5c1881109f39ebda293311ec591\"\u003e\u003ccode\u003e6779e48\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Bump release-drafter/release-drafter from 6 to 7\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/955fead7657740f51b738de11961d4c1eb233bb3\"\u003e\u003ccode\u003e955fead\u003c/code\u003e\u003c/a\u003e\nswitch to Central Publishing Portal\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/50dbac7e4cd969764e2bfb8e971b0fcf5fcbebba\"\u003e\u003ccode\u003e50dbac7\u003c/code\u003e\u003c/a\u003e\nBump release-drafter/release-drafter from 6 to 7\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/d50bc582155e15a6a1560edab0f1e94d019601e1\"\u003e\u003ccode\u003ed50bc58\u003c/code\u003e\u003c/a\u003e\nBump org.apache.maven.plugins:maven-project-info-reports-plugin\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/1034644886969032df5552fd4132102baeca40c8\"\u003e\u003ccode\u003e1034644\u003c/code\u003e\u003c/a\u003e\nBump plugin-tools.version from 3.15.0 to 3.15.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/018ab8e4fdf3b73049497a76bea952983b88389f\"\u003e\u003ccode\u003e018ab8e\u003c/code\u003e\u003c/a\u003e\nBump commons-codec:commons-codec from 1.17.1 to 1.22.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/e3597051e8c6eb694e9ccd044b9b5a0829166add\"\u003e\u003ccode\u003ee359705\u003c/code\u003e\u003c/a\u003e\nBump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/CycloneDX/cyclonedx-maven-plugin/compare/cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.cyclonedx:cyclonedx-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d2.9.1\u0026new-version\u003d2.9.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "301d3d8f889d3e4d1f45fc6e1707460ae5baaeb4",
      "tree": "b7e5e585b9a28aaac8e427c7211c36cb988b3b2b",
      "parents": [
        "b0e51af855ef5befac903b1a6de3f535258ccd1b"
      ],
      "author": {
        "name": "Pedro Matias",
        "email": "pedro.matias@dremio.com",
        "time": "Tue Jun 30 05:41:30 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 21:41:30 2026 -0700"
      },
      "message": "GH-1063: Add is_update field to ActionCreatePreparedStatementResult (#1064)\n\n## What\u0027s Changed\n\nA new field, `optional bool is_update \u003d 4;`, was added to `message\nActionCreatePreparedStatementResult`. When this field is sent by the\nserver, its value indicates whether the proper network flow to execute\nthe query that the driver should follow uses\n`CommandPreparedStatementQuery` or `CommandPreparedStatementUpdate`.\n\n\nFor outdated servers that don\u0027t send the field, the driver maintains its\ncurrent behavior of using `CommandPreparedStatementQuery` when the\n`dataset_schema` is not empty, thus ensuring the backward compatibility\nof the new driver with old servers.\n\nThis change was created with AI assistance (Augment Code and Claude\ncode). All lines were manually reviewed by a human. The output is not\ncopyrightable subject matter.\n\n- Closes #1063\n\n---------\n\nCo-authored-by: David Li \u003cli.davidm96@gmail.com\u003e"
    },
    {
      "commit": "b0e51af855ef5befac903b1a6de3f535258ccd1b",
      "tree": "12f7b2dae1d96d7a8989a9546452029149132e2c",
      "parents": [
        "9122af2ad87c6f51d8ed9082ba2f0a122980ea2a"
      ],
      "author": {
        "name": "YangJie",
        "email": "yangjie01@baidu.com",
        "time": "Tue Jun 30 12:40:01 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 21:40:01 2026 -0700"
      },
      "message": "GH-1116: [Java] Fix compressed buffer prefix write and ZSTD dstCapacity (#1119)\n\n## What\n\nTwo fixes in the compression codec:\n\n1. **`AbstractCompressionCodec.compress()`: capture `writerIndex()`\nonce**\n\nThe previous code read `uncompressedBuffer.writerIndex()` at multiple\nsites — for the size comparison and again after `doCompress()` to\npopulate the 8-byte uncompressed-length prefix. Capture the value once\nat the top of `compress()` and reuse it for the empty-buffer check, the\nsize comparison, and the prefix, so all three consumers see the same\nvalue.\n\n2. **`ZstdCompressionCodec.doCompress()`: `dstCapacity` overstated by 8\nbytes**\n\n`Zstd.compressUnsafe(dst, dstSize, ...)` expects `dstSize` to be the\navailable space from `dst`. The code offsets `dst` by 8 bytes past the\nprefix but passed `8 + maxSize` instead of `maxSize`. The\n`compressBound()` headroom hides this in practice, but the parameter was\nsemantically wrong. Pass `maxSize`.\n\n## Tests\n\nCovered by the existing round-trip tests (`testEmptyBuffer`,\n`testReadWriteStream`, `testReadWriteFile`, etc.). I was not able to\nconstruct a minimal reproducer for the original `declaredUncompressed\u003d0`\nsymptom on the unfixed code, so both fixes are conservative correctness\nimprovements derived from code inspection rather than failing-then-green\nregression tests."
    },
    {
      "commit": "9122af2ad87c6f51d8ed9082ba2f0a122980ea2a",
      "tree": "b1c81463237e0c303c05b8c0b2626036aa5a5368",
      "parents": [
        "365a5f46d1fe437d2337d705dd6a0043f2ac1703"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 18:45:52 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 18:45:52 2026 +0200"
      },
      "message": "MINOR: Bump com.google.protobuf:protobuf-bom from 4.35.0 to 4.35.1 (#1186)\n\nBumps\n[com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf)\nfrom 4.35.0 to 4.35.1.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/protocolbuffers/protobuf/commits\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    }
  ],
  "next": "365a5f46d1fe437d2337d705dd6a0043f2ac1703"
}