)]}' { "log": [ { "commit": "3a207fa6e87c535b95eafca4cf5a6ef524d77df2", "tree": "438e1195bf6f95b32532111d10895bc9437b65a4", "parents": [ "28cb08c15543c8c2dd8d186db2029bfe760940a5" ], "author": { "name": "Manu Zhang", "email": "OwenZhang1990@gmail.com", "time": "Wed Oct 14 22:23:42 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 16:23:42 2026 +0200" }, "message": "AVRO-4360: [C++] Fix binary floating-point byte order (#4043)\n\nUse the little-endian IEEE 754 wire format required by Avro when\nencoding and decoding floats and doubles on big-endian hosts.\nAdd independent wire-byte regressions for signed zero, finite limits,\ninfinities and NaN payloads across fragmented streams.\n\nCo-authored-by: Codex \u003ccodex@openai.com\u003e" }, { "commit": "28cb08c15543c8c2dd8d186db2029bfe760940a5", "tree": "cb762dca3574e28184aaf0719a5952e6e9d82358", "parents": [ "209a3735ec330679790824da54b7558db55e4e7f" ], "author": { "name": "Zoltan Csizmadia", "email": "zcsizmadia@gmail.com", "time": "Thu Oct 01 07:36:21 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 07:36:21 2026 -0500" }, "message": "AVRO-4352: [C#] Add .NET 9.0 and .NET 10.0 support (#4009)\n\nTarget net8.0, net9.0 and net10.0 for executables and unit tests,\nreplacing the end-of-life net6.0 and net7.0. Class libraries keep\ntargeting netstandard2.0 and netstandard2.1.\n\nInstall the 8.0, 9.0 and 10.0 SDKs in the C#, CodeQL and Java interop\nworkflows and in the build Docker image, run perf and interop data\ngeneration on net10.0, and update the README target framework table." }, { "commit": "209a3735ec330679790824da54b7558db55e4e7f", "tree": "840a1e02dae12e25f2997012cb1a1318a96f52b2", "parents": [ "261dd30ab05e1dde8667b013ef1bc4f9ac2370e3" ], "author": { "name": "Gang Wu", "email": "ustcwg@gmail.com", "time": "Mon Sep 21 20:53:46 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 14:53:46 2026 +0200" }, "message": "AVRO-4351: [C++] Preserve primitive custom attributes (#4001)\n\nPreserve unknown properties when parsing and serializing primitive\nschema objects. This keeps extensions such as Iceberg\u0027s adjust-to-utc\nannotation intact across schema JSON round trips." }, { "commit": "261dd30ab05e1dde8667b013ef1bc4f9ac2370e3", "tree": "7dc8b1e01a2440fac86f21fbaacc9958e9e820ed", "parents": [ "d02512a5d7cc75c552ec1a7fcd50ed01b960911c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Aug 30 17:24:31 2026 +0000" }, "committer": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Tue Sep 15 13:23:56 2026 +0200" }, "message": "Bump actions/setup-java from 5 to 6\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: \u00276\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "d02512a5d7cc75c552ec1a7fcd50ed01b960911c", "tree": "0a6b31e333856418b495d07de2d87844194487ca", "parents": [ "a9b88f538c74d2347444fac60d7289abcf231a50" ], "author": { "name": "Stefano Vozza", "email": "svozza@gmail.com", "time": "Thu Aug 27 08:07:50 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 09:07:50 2026 +0200" }, "message": "AVRO-4350: [JavaScript] Restore underscore dependency (#3970)\n\n* AVRO-4350: Restore underscore dependency\n\n* AVRO-4350: Test package entry point" }, { "commit": "a9b88f538c74d2347444fac60d7289abcf231a50", "tree": "32e5852da9c1f86f8d310a0253aff5e2110e100e", "parents": [ "2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Mon Aug 24 17:11:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 17:11:33 2026 +0200" }, "message": "AVRO-4349: Add coding agent directories to .gitignore (#3968)" }, { "commit": "2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4", "tree": "783d6708f33f059a04120682aa1afacfa49ef523", "parents": [ "ff4c4b3fad9014b0923281bfff4ebbe99579504e" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Sun Aug 23 13:42:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 23 13:42:22 2026 +0200" }, "message": "AVRO-4348: Use infra-approved action for toolchain (#3953)\n\n* AVRO-4348: Use infra-approved action for toolchain\n\n* AVRO-4348: Add action to validate allowed-actions\n\n* Add license" }, { "commit": "ff4c4b3fad9014b0923281bfff4ebbe99579504e", "tree": "e2562aa5199c0f8ce11da40617b380da526c0b67", "parents": [ "326950f40c1172f7564c757b0e51c39883721083" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Sun Aug 23 13:23:06 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 23 13:23:06 2026 +0200" }, "message": "[site] Announce Avro release (#3945)\n\n* Announce Avro 1.12.2 release\n\n* doc: Note breaking change in Java SDK\n\n* doc: Provide clearer information on the Java breaking change" }, { "commit": "326950f40c1172f7564c757b0e51c39883721083", "tree": "e4ce0ff868816ba3d4ae3bb47708bdfd62ef0b2f", "parents": [ "cff8d11d0de6b3cfe8941775abcf151a801de1e2" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Mon Aug 17 16:37:02 2026 +0200" }, "committer": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Tue Aug 18 09:12:37 2026 +0200" }, "message": "AVRO-4332: [java] Enable and fix the dormant IdlUtils tests\n\nThe IdlUtils test class was never executed: Surefire only includes\nclasses matching **/Test** (name starting with \"Test\"), but the class\nwas named IdlUtilsTest, so its tests silently rotted since AVRO-3677.\n\nRename IdlUtilsTest to TestIdlUtils so the suite runs, and fix the\nproblems this uncovers:\n\n- byte[] values serialized to an empty string because the byte[]\n serializer discarded MAPPER.writeValueAsString(...) instead of\n writing to the generator; write the value to the generator.\n- The callToJson test helper had the same discard bug, so every\n *ToJson assertion previously compared against an empty string.\n- The happy-flow fixtures lived under org/apache/avro/util and were\n unreachable from the org.apache.avro.idl package; move them beside\n the test and regenerate them from the current writer output.\n- getMainSchema() now returns the record directly, so drop the\n obsolete union unwrapping in validateHappyFlowForSingleSchema.\n- Map/collection JSON expectations now include the \", \" separator the\n MAPPER emits.\n" }, { "commit": "cff8d11d0de6b3cfe8941775abcf151a801de1e2", "tree": "10daca2c22b21a4561ea0da0ba9c33bd52a434de", "parents": [ "87212a6d47247a30dff247d16386d722c56d4390" ], "author": { "name": "prygunovx", "email": "maksim.prygunov@gmail.com", "time": "Mon Aug 17 11:30:17 2026 +0200" }, "committer": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Tue Aug 18 09:12:37 2026 +0200" }, "message": "AVRO-4332: [java] Add support for enum default values in IDL serialization\n\nIdlUtils.writeSchema did not emit the enum default when serializing a\nschema to IDL, even though IdlReader parses it. As a result, an enum\ndefault was silently dropped when round-tripping a schema through IDL.\n\nAppend \"\u003d \u003cdefault\u003e;\" after the enum body when the schema has a default,\nmatching the IDL grammar (RBrace defaultSymbol\u003denumDefault?), and add\ntests covering the with-default, without-default and write-then-parse\nround-trip cases.\n" }, { "commit": "87212a6d47247a30dff247d16386d722c56d4390", "tree": "b171573f635488279549004b11c27798d28a781f", "parents": [ "d28835a446999db569cefa94dd819c7c036452a4" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Fri Aug 07 14:56:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 07 14:56:09 2026 +0200" }, "message": "AVRO-4241: [Java] Bound zero-byte collection elements per datum, not per collection (#3927)\n\n* AVRO-4241: [Java] Bound zero-byte collection elements per datum, not per collection\n\nThe heap-aware zero-byte-element allocation cap (null, a zero-length fixed, an\nall-zero-byte record, or a recursive schema broken with a 0 minimum) was enforced\nper collection: readArray/readCollection and the skip/fast-reader paths each\nstarted counting from zero. Because a container file carries its own schema, an\nattacker can declare a record with many array\u003cnull\u003e fields, each block\nindividually under the limit but jointly unbounded, so a tiny payload still drives\na huge aggregate allocation (e.g. ~16 array\u003cnull\u003e fields near the per-array cap\nexhaust the heap; a handful burn tens of seconds of CPU).\n\nTrack the cumulative zero-byte allocation per decode on a per-thread scope in\nSystemLimitException. GenericDatumReader.read and the static skip open the scope\n(scopes nest, so a delegated fast reader or a skipped writer field accumulates\ninto the enclosing datum budget instead of resetting it); only the outermost\nscope resets the running total. All zero-byte call sites (GenericDatumReader\nread/skip, FastReaderBuilder, ReflectDatumReader) now use the cumulative\ncheckMaxCollectionAllocation(long). Outside any scope the check falls back to the\nprevious per-collection behaviour, so no existing caller becomes stricter.\nPositive-size elements are unchanged: they remain bounded per collection by the\nbytes-remaining check, which consumes input as it advances.\n\nAdds regression tests for a multi-field record rejected cumulatively and a\nwithin-limit record that still decodes (and confirms the budget resets between\ndatums), on both the fast and classic reader paths.\n\n* AVRO-4241: [Java] Scope fast array reader so zero-byte cap is cumulative standalone\n\nOpen a collection-allocation scope around the fast array reader\u0027s\nblock-reading loop in a try/finally. When the fast reader is used\nstandalone via createDatumReader(...), without GenericDatumReader.read\nopening the outer datum scope, the zero-byte element cap is now\ncumulative across all array blocks instead of degrading to a per-block\nstateless check, so a large array\u003cnull\u003e-style array split across many\nblocks cannot bypass the cap. The scope nests into the outer datum\nscope on the normal path, and the finally guarantees it is always\nclosed so ThreadLocal state cannot leak into later decodes." }, { "commit": "d28835a446999db569cefa94dd819c7c036452a4", "tree": "7743f16d2351f820d92474b996e771325bb2976d", "parents": [ "c50ffa586a7a2f60fe8ed05489d4c7d3a578e092" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Fri Aug 07 14:54:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 07 14:54:54 2026 +0200" }, "message": "AVRO-4296: [python] Bound zero-byte collection elements per datum, not per collection (#3926)\n\nThe AVRO-4296 zero-byte-element cap (null, zero-length fixed, all-zero-byte\nrecords) was enforced per collection: read_array/read_map each started counting\nfrom zero. Because a container file carries its own schema, an attacker can\ndeclare a record with many array\u003cnull\u003e fields, each block individually under the\nlimit but jointly unbounded, so a tiny payload still drives a huge allocation\n(e.g. 16 array\u003cnull\u003e fields of ~10M each: an ~80 byte record that exhausts\nmemory, or 8 fields that burn tens of seconds of CPU).\n\nTrack the cumulative zero-byte element count on the DatumReader across a single\ndecoded datum, reset at the start of each top-level read() (the boundary\nDataFileReader uses per record), and check it in _ensure_collection_available.\nPositive-size elements are unchanged: they are naturally bounded per collection\nbecause decoding consumes input and the bytes-remaining check shrinks as the\nposition advances.\n\nAdds regression tests for a multi-field record that exceeds the cap in aggregate\nand for a within-limit record that still reads (and confirms the budget resets\nbetween datums)." }, { "commit": "c50ffa586a7a2f60fe8ed05489d4c7d3a578e092", "tree": "60ea8e22ef4986a1c67d4163000f2ece61906443", "parents": [ "e8c69083b8593b1be1539c2fc185f0b45b2e3ac2" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Fri Aug 07 09:14:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 07 09:14:14 2026 +0200" }, "message": "AVRO-4290: [python] Enforce a maximum decompressed block size (#3850)\n\n* AVRO-4290: [python] Enforce a maximum decompressed block size\n\nWhen reading a data file, each block is decompressed according to the\nfile\u0027s codec. A block with a very high compression ratio (or a malformed\nblock) could expand to far more memory than its compressed size. Enforce a\nconfigurable maximum decompressed size across the deflate, bzip2, snappy and\nzstandard codecs, mirroring the Java SDK\u0027s decompression limit (AVRO-4247).\nThe limit defaults to 200 MiB and can be overridden with the\nAVRO_MAX_DECOMPRESS_LENGTH environment variable; exceeding it raises\nAvroDecompressionSizeException.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4290: [python] Address review: avoid deflate copy; zstd check-before-extend\n\n- DeflateCodec.decompress accumulates into a bytearray so the flush() output is\n appended in place instead of creating an extra full-size copy of the already\n decompressed data.\n- ZstandardCodec.decompress checks len(uncompressed) + len(chunk) before\n extending, so the buffer never grows past the configured limit.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4290: [python] Verify bzip2 stream EOF and drain fully\n\nBZip2Codec.decompress now loops the BZ2Decompressor: it drains all buffered\noutput (bounded by the limit), verifies the stream reached EOF (rejecting a\ntruncated/corrupt block with InvalidAvroBinaryEncoding), and handles\nconcatenated bzip2 streams as bz2.decompress does. Add a truncated-block test.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4290: [python] Reject truncated deflate and short snappy blocks\n\nAddress review feedback:\n- DeflateCodec: after flushing the decompressor, verify decompressor.eof so a\n truncated/incomplete raw-deflate block is rejected with\n InvalidAvroBinaryEncoding (zlib.decompress used to raise for this; the\n decompressobj-based size cap otherwise silently accepted partial output).\n- SnappyCodec: validate the block length is \u003e\u003d 4 before reading length - 4\n bytes, raising a codec-specific InvalidAvroBinaryEncoding instead of falling\n through to the generic decoder error.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4290: [python] Add a truncated-deflate-block rejection test\n\nCover the new DeflateCodec behavior (raising InvalidAvroBinaryEncoding when the\nend-of-stream marker isn\u0027t reached) with a test that truncates a valid deflate\nblock and asserts decompress() rejects it, mirroring the bzip2 truncation test.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4290: [python] Bound the deflate flush() output too\n\nThe previous fix bounded decompress(data, limit+1) but then called\ndecompressor.flush() with no limit, so the residual output (from the\nunconsumed input left by max_length) could still expand unbounded. Drain the\nunconsumed_tail in a loop with a per-call max_length and pass a bounded length\nto flush(), so the accumulated output can never exceed the limit by more than\none byte before being rejected.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4290: [python] Clamp AVRO_MAX_DECOMPRESS_LENGTH to sys.maxsize\n\n_max_decompress_length() returned the raw parsed int. An absurdly large override\nis passed as max_length to zlib/bz2 decompress(), which raise OverflowError when\nit exceeds Py_ssize_t. Clamp to sys.maxsize so an oversized override is honored\nas \"effectively unbounded\" instead of producing a confusing OverflowError.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4290: [python] Avoid limit+1 Py_ssize_t overflow at sys.maxsize\n\nAfter clamping AVRO_MAX_DECOMPRESS_LENGTH to sys.maxsize, the deflate/bz2 paths\nstill computed `limit + 1` for the decompress() max_length, which overflows\nPy_ssize_t (and raises OverflowError) when limit \u003d\u003d sys.maxsize. Add\n_decompress_read_ceiling(), which returns limit + 1 normally but sys.maxsize\nwhen the limit is already sys.maxsize (no realistic block can exceed it), and\nuse it for the bounded read/flush in both paths.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8" }, { "commit": "e8c69083b8593b1be1539c2fc185f0b45b2e3ac2", "tree": "c39ded00687e0b2600b28f4ab808b0405e5eea4c", "parents": [ "23aad5216f874d0b7f3f2f43826cfb336747a970" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Thu Aug 06 18:24:13 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 06 18:24:13 2026 +0200" }, "message": "AVRO-4296: [python] Bound allocation when decoding length-prefixed values and collections (#3861)\n\nWhen decoding an array or map, DatumReader.read_array/read_map used the block\ncount read from the (potentially malformed or truncated) input directly as a\nloop counter, and the length-prefixed byte/string readers allocated from an\nunchecked length. A small payload could therefore declare a very large count or\nlength and drive an unbounded allocation before any element bytes were present.\n\nThis bounds those allocations, mirroring the Java SDK\u0027s two-limit approach:\n\n- Length-prefixed values and collection blocks are validated against the number\n of bytes actually remaining in the input (when the reader is seekable) before\n allocating, so a truncated payload fails fast instead of over-allocating.\n- Element types whose minimum encoded size is zero (null, a zero-length fixed,\n or a record whose fields are all zero-byte) cannot be bounded by the bytes\n remaining, so their cumulative count is capped by a separate configurable\n limit (AVRO_MAX_COLLECTION_ITEMS). A structural cap of Integer.MAX_VALUE - 8\n applies to all collections as defense in depth.\n\nIt also hardens related decode paths surfaced by this work: overlong/overflowing\nvarints are rejected, negative skips and out-of-range union/enum indices are\nrejected, sized-block skips validate their byte size, and bytes_remaining()\nrestores the reader position and degrades gracefully on non-seekable readers.\n\nReading malformed or truncated input now fails fast with a clear\nAvroCollectionSizeException or InvalidAvroBinaryEncoding; valid data reads\nunchanged." }, { "commit": "23aad5216f874d0b7f3f2f43826cfb336747a970", "tree": "b32f69cd0bb93c456232f707c2dfe665f6bea5b4", "parents": [ "9b210024dbbdd8c1c3ebaaabfb3917ef16a95ce8" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Thu Aug 06 17:52:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 06 17:52:46 2026 +0200" }, "message": "AVRO-4323: [Java] Bound DataFileStream block size against available input before allocating the block buffer (#3919)\n\n* AVRO-4323: [Java] Bound DataFileStream block size against available input\n\nWhen reading a data (container) file, DataFileStream validated the declared\nblock size only against the Integer range before allocating the block buffer.\nFor a malformed, corrupted, or truncated file the declared size can greatly\nexceed the bytes actually present, so the reader eagerly allocated a large\nbuffer before reading any block byte.\n\nReject a declared block size that exceeds the number of bytes remaining in the\ninput when that count is known (byte-array- or known-length-stream-backed\ndecoders), so reading a malformed file fails fast with a clear IOException.\nThe check is skipped when the remaining count is unknown (-1).\n\n* AVRO-4323: Address review: account for sync marker in block-size guard; close reader in test\n\nInclude the trailing sync-marker length (DataFileConstants.SYNC_SIZE) in the\nremaining-bytes check so a file truncated right before the sync marker is\nrejected before allocating the block buffer, and use try-with-resources in the\nregression test." }, { "commit": "9b210024dbbdd8c1c3ebaaabfb3917ef16a95ce8", "tree": "f16892fa5fe123a0486de0f0bb23df3687644a5f", "parents": [ "dadbc050d2a6dced410694fcadd09389af5e6b0f" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Thu Aug 06 17:52:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 06 17:52:36 2026 +0200" }, "message": "AVRO-4324: [Java] Align ReflectDatumReader.readArray with GenericDatumReader eager-allocation guards (#3920)\n\n* AVRO-4324: [Java] Guard ReflectDatumReader.readArray eager allocation\n\nReflectDatumReader.readArray allocated the backing Java array for the declared\narray block count (Array.newInstance) before reading any element, unlike\nGenericDatumReader.readArray which already validates the count against the bytes\nremaining and caps element types whose minimum encoded size is zero.\n\nApply the same guards (ensureAvailableCollectionBytes plus\ncheckMaxCollectionAllocation for zero-byte element types) before the eager\nallocation, so a malformed or truncated record mapped to a Java array field\n(e.g. long[]) fails fast with an EOFException instead of over-allocating. Valid\narrays continue to read unchanged.\n\n* AVRO-4324: Address review: bound cumulative allocation across array blocks\n\nThe zero-byte allocation guard was only applied to the first array block, so a\nlarge logical array split across multiple blocks could pass the first check\nwhile the cumulative count still exceeded the heap-aware limit. Mirror\nGenericDatumReader by re-validating each continuation block (via a shared\nnextArrayBlock helper) against the bytes remaining and, for zero-byte element\ntypes, the cumulative allocation limit, in both readObjectArray and\nreadCollection." }, { "commit": "dadbc050d2a6dced410694fcadd09389af5e6b0f", "tree": "e9b332cf415b74f77700abf3c90324e89cee2854", "parents": [ "42e4c3d4b03ced580c0d8186b3df133652ab445b" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Thu Aug 06 17:52:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 06 17:52:30 2026 +0200" }, "message": "AVRO-4325: [Trevni] Validate column-file header counts and lengths before allocating (#3921)\n\n* AVRO-4325: [Trevni] Validate header counts and lengths before allocating\n\nThe Trevni readers sized several allocations directly from values read from the\nfile header/metadata without validating them against the input available. For a\nmalformed, corrupted, or truncated file these counts/lengths could greatly\nexceed the bytes present, driving oversized allocations, or overflow to a\nnegative size.\n\nAdd a shared InputBuffer.checkLength/remaining helper that rejects a negative\nvalue and one that could not be backed by the bytes remaining, and apply it to:\n- ColumnFileReader.readHeader (column count)\n- ColumnDescriptor.ensureBlocksRead (block count)\n- InputBuffer.readBytes/readString (length-prefixed byte arrays)\n- ColumnValues.startBlock (compressed block size), which now also uses\n Math.addExact for the checksum size to guard against integer overflow.\n\nReading a malformed file now fails fast with a clear IOException; valid files\nread unchanged.\n\n* AVRO-4325: Address review: validate compressed size plus checksum; derive test offset\n\nColumnValues.startBlock now validates the combined compressed-block-plus-checksum\nlength against the bytes remaining (computed in long to avoid overflow) and\nrejects a negative or overflowing size with an IOException, instead of using\nMath.addExact (which could throw an unchecked ArithmeticException) and validating\nonly the compressed size. The TestColumnFile column-count offset is now derived\nfrom ColumnFileWriter.MAGIC.length + Long.BYTES rather than a hard-coded 12." }, { "commit": "42e4c3d4b03ced580c0d8186b3df133652ab445b", "tree": "c488d1a337dd2ae6f762529517d015f710b5c412", "parents": [ "958846d86ce4ad2a39a91d1af3bec975bc4d9eb1" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Thu Aug 06 17:23:55 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 06 17:23:55 2026 +0200" }, "message": "AVRO-4322: Use reader/writers constently with model (#3924)" }, { "commit": "958846d86ce4ad2a39a91d1af3bec975bc4d9eb1", "tree": "846425ea44119aa14d532ad667c89ab9a5156fb1", "parents": [ "cb1ebc20506c30eb652b565847bf77dd97b75893" ], "author": { "name": "Anton Agestam", "email": "anton.agestam@aiven.io", "time": "Wed Aug 05 18:02:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 18:02:42 2026 +0200" }, "message": "AVRO-3760: [python] Fix resolution of future enum with default symbol (#2250)\n\n* AVRO-3760: [python] Fix resolution of future enum with default symbol\n\n* Change error from review\n\n---------\n\nCo-authored-by: Ryan Skraba \u003cryan@skraba.com\u003e" }, { "commit": "cb1ebc20506c30eb652b565847bf77dd97b75893", "tree": "4b3b3da4386eeabc624e8981d14d626fcc37aa12", "parents": [ "a7e0078d22191f48f752950f3647cb3e5b292ce1" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Wed Aug 05 11:23:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 11:23:05 2026 +0200" }, "message": "AVRO-4321: Fix NPE on getConversionByClass (#3908)" }, { "commit": "a7e0078d22191f48f752950f3647cb3e5b292ce1", "tree": "a96aba6ecbbeda02853cd2aa3ef8d40eb3d25a9c", "parents": [ "28285c9e812e8bcbc89ceebb76e80f915f09b6c6" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Wed Aug 05 11:18:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 11:18:38 2026 +0200" }, "message": "AVRO-4322: [Java] Only apply java-class annotations to SpecificData models. (#3917)" }, { "commit": "28285c9e812e8bcbc89ceebb76e80f915f09b6c6", "tree": "482e3b9675d607c860d0d09d88f058615be12313", "parents": [ "ea005d5ae7e198826f2372f2db2b993712912d98" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:27:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:27:10 2026 +0200" }, "message": "Bump org.apache:apache from 38 to 39 in /lang/java (#3838)\n\nBumps [org.apache:apache](https://github.com/apache/maven-apache-parent) from 38 to 39.\n- [Release notes](https://github.com/apache/maven-apache-parent/releases)\n- [Commits](https://github.com/apache/maven-apache-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache:apache\n dependency-version: \u002739\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ea005d5ae7e198826f2372f2db2b993712912d98", "tree": "1ebd805c6c4a46c5c5ee4dfcde16db42bcc4ca7c", "parents": [ "76d4cc158d5680eebaf6a0ea6cc8ebddcab082e7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:26:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:26:42 2026 +0200" }, "message": "Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 in /lang/java (#3915)\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-11 to 1.5.7-12.\n- [Commits](https://github.com/luben/zstd-jni/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.luben:zstd-jni\n dependency-version: 1.5.7-12\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "76d4cc158d5680eebaf6a0ea6cc8ebddcab082e7", "tree": "d8e419d891406741d1271b8cb45fb7f49755e455", "parents": [ "58e9af67e03eb748491c1878cb0a7449fd383b41" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:26:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:26:33 2026 +0200" }, "message": "Bump org.apache.maven.plugins:maven-toolchains-plugin in /lang/java (#3913)\n\nBumps [org.apache.maven.plugins:maven-toolchains-plugin](https://github.com/apache/maven-toolchains-plugin) from 3.2.0 to 3.3.0.\n- [Release notes](https://github.com/apache/maven-toolchains-plugin/releases)\n- [Commits](https://github.com/apache/maven-toolchains-plugin/compare/maven-toolchains-plugin-3.2.0...maven-toolchains-plugin-3.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:maven-toolchains-plugin\n dependency-version: 3.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "58e9af67e03eb748491c1878cb0a7449fd383b41", "tree": "da116d3ca63728ed3faae10515769a18fde1f4a4", "parents": [ "adf4b45976721933482642c3b22c1c8e2d928ab6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:26:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:26:27 2026 +0200" }, "message": "Bump com.diffplug.spotless:spotless-maven-plugin in /lang/java (#3912)\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.7.0 to 3.9.0.\n- [Release notes](https://github.com/diffplug/spotless/releases)\n- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)\n- [Commits](https://github.com/diffplug/spotless/compare/maven/3.7.0...maven/3.9.0)\n\n---\nupdated-dependencies:\n- dependency-name: com.diffplug.spotless:spotless-maven-plugin\n dependency-version: 3.9.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "adf4b45976721933482642c3b22c1c8e2d928ab6", "tree": "6262d7ef875bbb5766062be1f001509428420864", "parents": [ "8a4733f3a75e8e442753cea77ebaac23cbf75333" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:26:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:26:18 2026 +0200" }, "message": "Bump org.apache.felix:maven-bundle-plugin in /lang/java (#3911)\n\nBumps org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.felix:maven-bundle-plugin\n dependency-version: 6.1.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8a4733f3a75e8e442753cea77ebaac23cbf75333", "tree": "14d93b770790fcd074d204727aa2c8a3f603e97e", "parents": [ "64f4aae51767429f11bc751f38ebf799a8ed34b4" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:26:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:26:10 2026 +0200" }, "message": "Bump postcss from 8.5.20 to 8.5.25 in /doc (#3910)\n\nBumps [postcss](https://github.com/postcss/postcss) from 8.5.20 to 8.5.25.\n- [Release notes](https://github.com/postcss/postcss/releases)\n- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/postcss/compare/8.5.20...8.5.25)\n\n---\nupdated-dependencies:\n- dependency-name: postcss\n dependency-version: 8.5.25\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "64f4aae51767429f11bc751f38ebf799a8ed34b4", "tree": "3330f3bd2ddbd8edfa74841a78e05ce095f54b8d", "parents": [ "9f03f07c7449173ed07db3bcc495567a69925c8a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:26:04 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:26:04 2026 +0200" }, "message": "Bump grpc.version from 1.83.0 to 1.83.1 in /lang/java (#3909)\n\nBumps `grpc.version` from 1.83.0 to 1.83.1.\n\nUpdates `io.grpc:grpc-core` from 1.83.0 to 1.83.1\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.83.0...v1.83.1)\n\nUpdates `io.grpc:grpc-stub` from 1.83.0 to 1.83.1\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.83.0...v1.83.1)\n\nUpdates `io.grpc:grpc-netty` from 1.83.0 to 1.83.1\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.83.0...v1.83.1)\n\n---\nupdated-dependencies:\n- dependency-name: io.grpc:grpc-core\n dependency-version: 1.83.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: io.grpc:grpc-stub\n dependency-version: 1.83.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: io.grpc:grpc-netty\n dependency-version: 1.83.1\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9f03f07c7449173ed07db3bcc495567a69925c8a", "tree": "5ed6bee5b69d06c38f429e6058f4471acc25186c", "parents": [ "93ae13b85088bcd7cbedf52a6292b15f3c33247f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:25:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:25:52 2026 +0200" }, "message": "Bump actions/setup-python from 6 to 7 (#3901)\n\nBumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-python\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "93ae13b85088bcd7cbedf52a6292b15f3c33247f", "tree": "e2f11318c34401cb385cd471be6d383346d5c062", "parents": [ "80dba3a5f11f04f62d7f612a26014c2fb08b4e40" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Aug 04 18:25:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 18:25:15 2026 +0200" }, "message": "Bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#3900)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0.\n- [Release notes](https://github.com/astral-sh/setup-uv/releases)\n- [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9)\n\n---\nupdated-dependencies:\n- dependency-name: astral-sh/setup-uv\n dependency-version: 9.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "80dba3a5f11f04f62d7f612a26014c2fb08b4e40", "tree": "8f660ec6d663bc717014952c8f51fdcd30dfc248", "parents": [ "cd998891e595bf8b2444f538e84d9fd7a0336a3f" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Mon Aug 03 19:08:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 19:08:54 2026 +0200" }, "message": "AVRO-4319: [py] Pin ruff to the version in uv.lock (#3918)" }, { "commit": "cd998891e595bf8b2444f538e84d9fd7a0336a3f", "tree": "ab6fbf6a765b0eec70f9494d3753076b5bbe1dee", "parents": [ "abc285b730ad23816533fd6560411c79faa9cc2b" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Sun Aug 02 15:31:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 02 15:31:02 2026 +0200" }, "message": "AVRO-4311: [java] Escape backslashes in generated Javadoc (#3880)\n\n* AVRO-4311: [java] Escape backslashes in generated Javadoc\n\nThe code generator writes schema documentation strings into the\nJavadoc comments of generated Java sources. escapeForJavadoc escaped\nthe comment terminator and HTML metacharacters but left backslashes\nuntouched.\n\nThe Java compiler translates Unicode escapes (\\uXXXX) across the whole\nsource file, including inside comments, before comments are recognized\n(JLS 3.3). A documentation string containing backslash sequences could\ntherefore be reinterpreted by the compiler and change the generated\nsource in unintended ways.\n\nNeutralize backslashes in escapeForJavadoc by encoding them as the\nHTML entity \u0026#92;, so documentation content is always emitted as inert\ntext. Add a regression test covering several escape forms. The\nstring-literal path (escapeForJavaString) already doubles backslashes\nand is unaffected.\n\n* AVRO-4311: [java] Strengthen Javadoc escaping regression test\n\nAddress review feedback: the end-to-end assertion only inspected lines\nstarting with \"/**\" or \"*\", so the middle physical lines of a\nmulti-line Javadoc block (a doc containing newlines) were not checked.\n\nReplace the line-based scan with one that removes all Java string\nliterals (the embedded schema, which legitimately contains doubled\nbackslashes) and then asserts no backslash remains in the surrounding\ncode and comments. Add a doc vector that spans multiple physical lines." }, { "commit": "abc285b730ad23816533fd6560411c79faa9cc2b", "tree": "ca9fdb814b557e4ce399e130586c1813c5585b47", "parents": [ "05715c4b3bc9750284cc02e2f04c1d799a5148de" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Aug 02 15:29:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 02 15:29:27 2026 +0200" }, "message": "Bump grpc.version from 1.82.2 to 1.83.0 in /lang/java (#3899)\n\nBumps `grpc.version` from 1.82.2 to 1.83.0.\n\nUpdates `io.grpc:grpc-core` from 1.82.2 to 1.83.0\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.2...v1.83.0)\n\nUpdates `io.grpc:grpc-stub` from 1.82.2 to 1.83.0\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.2...v1.83.0)\n\nUpdates `io.grpc:grpc-netty` from 1.82.2 to 1.83.0\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.2...v1.83.0)\n\n---\nupdated-dependencies:\n- dependency-name: io.grpc:grpc-core\n dependency-version: 1.83.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.grpc:grpc-stub\n dependency-version: 1.83.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.grpc:grpc-netty\n dependency-version: 1.83.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "05715c4b3bc9750284cc02e2f04c1d799a5148de", "tree": "bbde74a8d4a5af6e1f1be0015ed1d25132361fa1", "parents": [ "beb766255fc4028b31f3706cc5ccf21e20c2d7c0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Aug 02 15:29:13 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 02 15:29:13 2026 +0200" }, "message": "Bump actions/labeler from 6 to 7 (#3902)\n\nBumps [actions/labeler](https://github.com/actions/labeler) from 6 to 7.\n- [Release notes](https://github.com/actions/labeler/releases)\n- [Commits](https://github.com/actions/labeler/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/labeler\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "beb766255fc4028b31f3706cc5ccf21e20c2d7c0", "tree": "54de0834799946d7c31af97b1c3ed96ecef8e44d", "parents": [ "44f7aa35a6b90ac7d39ef0e68dad706561235941" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Sun Aug 02 12:58:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 02 12:58:43 2026 +0200" }, "message": "AVRO-4313: [java] Clarify javaAnnotation validation comments (#3907)\n\nRewrite the comments around the annotation-validation grammar and its\nregression test in plainer language. Explain why the check exists (the\njavaAnnotation property is emitted verbatim into generated source) and\nwhat an unescaped quote in a string literal would allow, so the intent is\nclear to readers who are not familiar with the regex.\n\nComment-only change; no behavior change." }, { "commit": "44f7aa35a6b90ac7d39ef0e68dad706561235941", "tree": "a6df1277ad22b980fc543f2579fa37953e213ebc", "parents": [ "378e5e25005f580e23692d94b263277b05404ab1" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Sun Jul 26 19:08:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 19:08:53 2026 +0200" }, "message": "AVRO-4313: [java] Tighten javaAnnotation string-literal validation in SpecificCompiler (#3892)\n\n* AVRO-4313: [java] Tighten javaAnnotation string-literal validation in SpecificCompiler\n\nThe string-literal grammar used to validate javaAnnotation values accepted\nan unescaped quote inside the literal body, letting a single literal span\npast its intended closing quote and absorb surrounding tokens. Constrain the\nbody to recognized escape sequences or characters that are not a quote,\nbackslash, or line terminator, and add a regression test.\n\n* AVRO-4313: Exclude all line terminators from annotation string literals\n\nAlso reject NEL, LS and PS in addition to CR and LF so an annotation value\ncannot span multiple lines in the generated source.\n\n* AVRO-4313: Make injection regression test robust to multiple outputs\n\nAssert the injection payload is absent from every generated file and the\nvalid annotation is emitted in at least one, rather than requiring it in\neach output file." }, { "commit": "378e5e25005f580e23692d94b263277b05404ab1", "tree": "eccb91282faaeb4facb096b05bc42d6b19681258", "parents": [ "2c5dec675a5a335950a175f331f9b6c254b8d128" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 18:55:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:55:23 2026 +0200" }, "message": "Bump autoprefixer from 10.5.2 to 10.5.4 in /doc (#3884)\n\nBumps [autoprefixer](https://github.com/postcss/autoprefixer) from 10.5.2 to 10.5.4.\n- [Release notes](https://github.com/postcss/autoprefixer/releases)\n- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/autoprefixer/compare/10.5.2...10.5.4)\n\n---\nupdated-dependencies:\n- dependency-name: autoprefixer\n dependency-version: 10.5.4\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2c5dec675a5a335950a175f331f9b6c254b8d128", "tree": "62dfd57c192060a729620d904adc7ea7cf543a02", "parents": [ "8a61917e4f51c0dfe7586298d05e405714c13132" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 18:48:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:48:50 2026 +0200" }, "message": "Bump System.CodeDom from 10.0.9 to 10.0.10 (#3888)\n\n---\nupdated-dependencies:\n- dependency-name: System.CodeDom\n dependency-version: 10.0.10\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8a61917e4f51c0dfe7586298d05e405714c13132", "tree": "1c371c6d8d0633eb4797a8b19fe7bc312c2cec16", "parents": [ "587cfc79d4115a16d64121cd63a9318ac3e14ce8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 18:48:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:48:38 2026 +0200" }, "message": "Bump Microsoft.Build.Framework and Microsoft.Build.Utilities.Core (#3887)\n\nBumps Microsoft.Build.Framework from 18.7.1 to 18.8.2\nBumps Microsoft.Build.Utilities.Core from 18.7.1 to 18.8.2\n\n---\nupdated-dependencies:\n- dependency-name: Microsoft.Build.Framework\n dependency-version: 18.8.2\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: Microsoft.Build.Utilities.Core\n dependency-version: 18.8.2\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "587cfc79d4115a16d64121cd63a9318ac3e14ce8", "tree": "5be76111819d13e3454d9709801b518b1ffd5426", "parents": [ "a78a6ca11ba824221d720aebcdc43470f60cc646" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 18:48:21 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:48:21 2026 +0200" }, "message": "Update mypy requirement from \u003c2.3.0 to \u003c2.4.0 in /lang/py (#3885)\n\nUpdates the requirements on [mypy](https://github.com/python/mypy) to permit the latest version.\n- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/python/mypy/compare/v0.1.0...v2.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: mypy\n dependency-version: 2.3.0\n dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a78a6ca11ba824221d720aebcdc43470f60cc646", "tree": "c3876f2a74945adb13ef61af9331d259d891c456", "parents": [ "d5c3aa62cb6122adaf9b762ddcd57995392fab52" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 18:47:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:47:38 2026 +0200" }, "message": "Bump actions/setup-node from 6 to 7 (#3883)\n\nBumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.\n- [Release notes](https://github.com/actions/setup-node/releases)\n- [Commits](https://github.com/actions/setup-node/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-node\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d5c3aa62cb6122adaf9b762ddcd57995392fab52", "tree": "05aedda0b6e4a82f50707a89aa51f6b59763e6b5", "parents": [ "2a9b0feaab58cdaa6b8046c95127341105f60fad" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 18:47:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:47:34 2026 +0200" }, "message": "Bump postcss from 8.5.17 to 8.5.20 in /doc (#3882)\n\nBumps [postcss](https://github.com/postcss/postcss) from 8.5.17 to 8.5.20.\n- [Release notes](https://github.com/postcss/postcss/releases)\n- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/postcss/compare/8.5.17...8.5.20)\n\n---\nupdated-dependencies:\n- dependency-name: postcss\n dependency-version: 8.5.20\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2a9b0feaab58cdaa6b8046c95127341105f60fad", "tree": "95cb76af413e84d7956eaa9ee92bcaa0f79aad53", "parents": [ "07ac413eee65f493db899e0cb3caf67eea99006b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Jul 26 18:45:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:45:57 2026 +0200" }, "message": "Bump actions/setup-dotnet from 5 to 6 (#3881)\n\nBumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-dotnet/releases)\n- [Commits](https://github.com/actions/setup-dotnet/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-dotnet\n dependency-version: \u00276\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "07ac413eee65f493db899e0cb3caf67eea99006b", "tree": "ff2317526ebfb88e365474f1cccb99581b071a99", "parents": [ "787adb119c707815e8c6e75289a40a8ec989bc65" ], "author": { "name": "Ryan Skraba", "email": "ryan@skraba.com", "time": "Sun Jul 26 18:44:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 26 18:44:56 2026 +0200" }, "message": "AVRO-4309: [Python][Build] Add uvx to path explicitly (#3879)" }, { "commit": "787adb119c707815e8c6e75289a40a8ec989bc65", "tree": "df0be21ec1fa48baf6912f32e8b63972ae3d06d7", "parents": [ "eab0e48bb8b7b21d78b0aa2121fe107600e10af6" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Wed Jul 22 18:13:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 22 18:13:45 2026 +0200" }, "message": "AVRO-4314: [csharp] Validate names against the Avro name grammar (#3895)\n\n* AVRO-4314: [csharp] Validate names against the Avro name grammar\n\nRecord/fixed/enum names, record field names and protocol message names\nwere accepted verbatim when parsing, unlike enum symbols which were\nalready validated. Because the code generator splices some of these\nvalues directly into generated C# source (for example protocol message\nnames into a case label and field names into Get/Put switch bodies), an\nout-of-spec name produced malformed or unexpected generated code.\n\nAdd a shared, Unicode-aware name validator (first character a letter or\n\u0027_\u0027, remaining characters letters, digits or \u0027_\u0027) and apply it to\nschema names, field names and message names during parsing. The rule is\nUnicode-aware to preserve the existing support for non-ASCII names, and\nnamespaces are intentionally not validated because the code generator\u0027s\nnamespace-mapping feature rewrites them to C#-specific values (such as\n\"@return\") and re-parses the schema. Add negative tests for invalid\nfield, record and message names.\n\n* AVRO-4314: [csharp] Validate field aliases and sanitize name errors\n\nAddress review feedback:\n- Validate record field aliases with the same rule as field names, since\n aliases participate in schema resolution and are names per the Avro\n grammar. Previously they were accepted verbatim.\n- Escape control characters (and quote the value) when embedding an\n invalid name in the SchemaParseException message, so a crafted name\n containing newlines or other control characters cannot produce\n multi-line or ambiguous error output.\n\nAdd a negative test for an invalid field alias.\n\n* AVRO-4314: [csharp] Handle supplementary-plane characters in names\n\nAddress review feedback: ValidateName inspected individual UTF-16 code\nunits, which rejected valid supplementary-plane letters and digits that\nare encoded as surrogate pairs. Iterate by Unicode scalar value using\nthe char.IsLetter(string, int) / char.IsLetterOrDigit(string, int)\noverloads and advance past surrogate pairs. Add a test that a name\ncontaining a supplementary-plane letter (U+20000) is accepted." }, { "commit": "eab0e48bb8b7b21d78b0aa2121fe107600e10af6", "tree": "a619cd688a0909c6bab429731e52e21c1843b104", "parents": [ "61270d45bf53d2b05f88d8b02c503e868e23fcaf" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Tue Jul 21 14:51:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 21 14:51:29 2026 +0200" }, "message": "AVRO-4308: [python] Fix interop build failure from setuptools package discovery (#3894)\n\nThe local Docker interop build failed with \"Multiple top-level packages\ndiscovered in a flat-layout: [\u0027avro\u0027, \u0027userlogs\u0027]\". The Hadoop tether\ntests leave a userlogs/ directory next to the avro/ package, which breaks\nsetuptools automatic flat-layout package discovery.\n\nExplicitly scope package discovery to avro* so stray directories such as\nuserlogs/ are ignored." }, { "commit": "61270d45bf53d2b05f88d8b02c503e868e23fcaf", "tree": "ef8b68c350c4110b6f76b6d67094be99dfa9a5fc", "parents": [ "f3bb10eaea1f03eb17893bc779eb26213da8177c" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Sun Jul 19 15:30:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 19 15:30:34 2026 +0200" }, "message": "AVRO-4300: [java] Bound array/map allocation and skipping for zero-byte elements and on the fast reader path (#3865)\n\n* AVRO-4300: [java] Bound zero-byte array element allocation\n\nAn array whose element schema encodes to zero bytes (null, a zero-length\nfixed, or a record with only zero-byte fields) consumes no input per element,\nso the number of elements a block declares cannot be bounded by the bytes\nremaining in the stream. ensureAvailableCollectionBytes therefore skips the\ncheck for such elements, and the collection-length cap is Integer.MAX_VALUE-8\n(a VM array-size ceiling, not a memory budget). A tiny payload declaring a huge\nblock count of such elements (e.g. {\"type\":\"array\",\"items\":\"null\"} with a\ncount of 200,000,000) drives an unbounded backing-array allocation and exhausts\nthe heap. This affects both the classic GenericDatumReader.readArray path and\nthe default fast-reader path (FastReaderBuilder), which had no collection guard\nat all.\n\nAdd SystemLimitException.checkMaxCollectionAllocation, a heap-aware cumulative\ncap (default: maxMemory()/4/8 elements, overridable via the\norg.apache.avro.limits.collectionItems.maxAllocation system property, mirroring\nthe existing decompression limit). Enforce it before allocating in both reader\npaths, keyed on GenericDatumReader.isZeroByteSchema so only the unbounded\nzero-byte case is affected; all other element types remain bounded by\nensureAvailableCollectionBytes and are unchanged. Maps are already bounded\nbecause each entry carries a string key of at least one byte.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Apply the available-bytes check on the fast reader path\n\nThe fast reader (FastReaderBuilder, the default decode path) never received the\nAVRO-4241 bytes-remaining guard: that change only touched the classic\nGenericDatumReader. As a result an array of non-zero-byte elements with a huge\ndeclared block count and no data (e.g. array\u003clong\u003e/array\u003cint\u003e with a count of\n200,000,000) still pre-allocated new GenericData.Array\u003c\u003e((int) count) on the\ndefault path and exhausted the heap.\n\nExpose GenericDatumReader.ensureAvailableCollectionBytes and apply it, together\nwith the zero-byte allocation cap, before allocating each array block in\nFastReaderBuilder, so the fast and classic readers enforce identical guards.\nMaps were already safe on both paths (each entry carries a \u003e\u003d1-byte key).\n\nVerified with a matrix of array\u003cnull|long|int\u003e and map\u003cnull|long\u003e at a huge\ncount under -Xmx256m: every combination is now rejected (SystemLimitException\nfor zero-byte elements, EOFException otherwise) on both reader paths instead of\nOOM.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Cover all collection/reader combinations in tests\n\nAdd a matrix test asserting every collection kind is rejected (never OOM) with\na huge block count and no data, on both the fast (default) and classic reader:\narray\u003cnull\u003e via the heap-aware allocation cap (SystemLimitException) and\narray\u003clong\u003e, array\u003cint\u003e, map\u003cnull\u003e, map\u003clong\u003e via the bytes-remaining check\n(EOFException) -- the full 5x2 set of combinations. Keep a cumulative\nmulti-block null test and a positive within-limit decode test on both readers.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Test negative block count is bounded on both readers\n\nThe C and Python collection-limit tests cover a negative block count (abs(count)\nzero-byte elements preceded by a block byte-size); the Java tests did not. The\ndecoder normalizes the negative count to a positive one, which must still be\nbounded by the heap-aware allocation cap. Add a test asserting this on both the\nfast and classic reader paths.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Test Long.MIN_VALUE block count is handled safely\n\nMirror the C SDK\u0027s INT64_MIN edge case. Long.MIN_VALUE as a block count is the\npathological overflow: negating it overflows back to a negative value. Java\u0027s\ndecoder normalizes this to an empty collection (no allocation) rather than\nrejecting it as the C SDK does, which is equally non-exploitable. Add a test\nasserting the safe, allocation-free result on both the fast and classic reader\npaths.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Bound the array/map skip path\n\nThe skip path was unbounded: BinaryDecoder.skipArray()/skipMap() returned\ndoSkipItems() without calling checkMaxCollectionLength, and\nGenericDatumReader.skip() looped over the returned count. Skipping a huge block\nof zero-byte elements (e.g. a writer array\u003cnull\u003e field absent from the reader\nschema, skipped during projection) could therefore loop unboundedly -- a CPU\nexhaustion even though skipping reads and allocates nothing.\n\nTwo complementary bounds:\n - BinaryDecoder.skipArray()/skipMap() now apply the structural collection cap\n (checkMaxCollectionLength), mirroring readArrayStart()/readMapStart() and\n covering the resolving-decoder projection skip path on both reader types.\n - GenericDatumReader.skip() additionally bounds the cumulative count, using the\n heap-aware allocation cap for zero-byte element arrays and the structural cap\n otherwise, matching the read path and the other language SDKs.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Fix limit Javadoc markup; clamp allocation cap to VM limit\n\nAddresses review feedback:\n - Fix the malformed \u003cli\u003e markup in the limit-properties list (each item closed\n \u003c/li\u003e prematurely after the \u003ctt\u003e tag) and correct the bytes property name\n (org.apache.avro.limits.bytes.maxLength) so the Javadoc renders correctly.\n - Clamp maxCollectionAllocation to MAX_ARRAY_VM_LIMIT when refreshing limits, so\n a configured (or large-heap-derived) zero-byte allocation cap stays consistent\n with the other collection caps and cannot exceed the VM array ceiling.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Fix limit Javadoc grammar; make heap-cap test deterministic\n\nAddresses review feedback:\n - Javadoc: \"read at once single sequence\" -\u003e \"read in a single sequence\".\n - testCheckMaxCollectionAllocation asserts with MAX_ARRAY_VM_LIMIT + 1 instead\n of Integer.MAX_VALUE - 8. Since the default allocation cap is derived from the\n heap and then clamped to MAX_ARRAY_VM_LIMIT, a value equal to that limit may\n not exceed the computed default on a very large heap; +1 guarantees it does,\n keeping the test deterministic across environments.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reword zero-byte Javadoc; tighten skip test assertions\n\nAddresses review feedback:\n - Javadoc: \"a self-referencing record\" is not inherently zero-byte (the code\n only computes a 0-byte minimum for some recursive schemas to break recursion).\n Reword the three occurrences to describe actual zero-byte encodings: null, a\n zero-length fixed, or a record whose fields all encode to zero bytes.\n - skipMapRejectsHugeCount now asserts UnsupportedOperationException (a count of\n Integer.MAX_VALUE deterministically hits the VM structural-limit path), and\n resolvingSkipOfHugeNullArrayFieldIsBounded asserts SystemLimitException, so the\n tests pin the intended exception rather than a generic RuntimeException.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Apply spotless formatting to reworded Javadoc\n\nThe zero-byte Javadoc rewording did not match the Eclipse formatter\u0027s\nline-wrapping, failing the spotless check. Reflowed via `mvn spotless:apply`.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Clarify zero-byte comments to match the actual predicate\n\nAddresses review feedback: the \"encodes to zero bytes\" wording in\nGenericDatumReader (the array cap comment and isZeroByteSchema Javadoc) and\nFastReaderBuilder is imprecise. The guard is minBytesPerElement(schema) \u003d\u003d 0,\nwhich is also true for recursive schemas whose cycle is broken by returning a 0\nminimum. Reword to describe the \"minimum encoded size is zero\" predicate so the\ndocs match the actual condition under which the heap-aware cap applies.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reject Long.MIN_VALUE block count as malformed\n\nAddresses review feedback: doReadItemCount() negates a negative block count, but\nLong.MIN_VALUE negates back to Long.MIN_VALUE (still negative). The single-arg\ncheckMaxCollectionLength does not reject negatives, so it was truncated via\n(int) cast to 0, silently ending the collection without consuming the\nend-of-array/map marker and desynchronizing decoding of subsequent fields.\n\nReject Long.MIN_VALUE outright as malformed, matching the C SDK, instead of\nnormalizing to an empty collection. Update the test to assert the rejection.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Clamp collection preallocation from declared block count\n\nThe array/map readers passed the declared block count straight to newArray/\nnewMap as the initial capacity. On a stream source the bytes-available guard is\nskipped (BinaryDecoder.remainingBytes() returns -1 for sources other than\nByteArrayInputStream/ByteBufferInputStream), so a large declared count reaches\nthe allocation path directly and drives a huge up-front allocation (e.g.\nnew Object[count]) before a single element is read.\n\nClamp the initial capacity to a modest bound (MAX_COLLECTION_PREALLOC) via\ninitialCollectionCapacity(); the backing array/map still grows on demand as\nelements are decoded, so a truncated or hostile stream now fails with\nEOFException after a bounded allocation instead of attempting to preallocate\nhundreds of millions of slots. Applies to both the classic and fast readers.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reject out-of-range union and enum indices with AvroTypeException\n\nThe union branch index and enum symbol index were used to index the branch/\nsymbol tables without an explicit range check on several paths, surfacing a\nmalformed index as a generic IndexOutOfBoundsException instead of a clear\nAvro-specific error:\n\n- Union: Symbol.Alternative.getSymbol (used by both the validating and resolving\n decoders, and therefore by GenericDatumReader and the fast reader) indexed\n symbols[] directly. Add a [0, size) check throwing AvroTypeException.\n- Enum: ResolvingDecoder.readEnum returned the raw index in the no-adjustments\n case and indexed the adjustment table otherwise, both without validation\n (ValidatingDecoder.readEnum already checked). Add the range checks.\n- The fast reader reads from a plain decoder (resolution is pre-baked), so its\n union and enum readers need their own [0, length) checks.\n\nAdds tests covering negative and too-large union and enum indices on both the\nclassic and fast reader paths.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reword remaining \"zero-byte\" docs to the actual predicate\n\nThe maxAllocation limit is applied when a schema\u0027s minimum encoded size is zero\n(GenericDatumReader.isZeroByteSchema, i.e. minBytesPerElement \u003d\u003d 0), which also\ncovers recursive schemas whose cycle is conservatively broken with a 0 minimum.\nReword the remaining \"encodes to zero bytes\" wording -- the class Javadoc, the\nMAX_COLLECTION_ALLOCATION_PROPERTY Javadoc, the SystemLimitException message, and\nthe skipArray comment -- to say \"minimum encoded size is zero\" so the docs match\nthe condition under which the cap actually applies.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Half-open range in enum messages; finish zero-byte reword\n\nAddress review feedback:\n- The enum out-of-range messages said \"max is \u003csize\u003e\", implying \u003csize\u003e is a\n valid index. Reword to the half-open \"must be in [0, \u003csize\u003e)\" to match the\n actual check and the union messages, in ResolvingDecoder (both the\n no-adjustments and adjustments branches), FastReaderBuilder, and\n ValidatingDecoder.\n- Reword the remaining \"encodes to zero bytes\" wording in the\n checkMaxCollectionAllocation Javadoc to \"minimum encoded size is zero\"\n (including the recursive-schema case), matching isZeroByteSchema.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Enforce structural cap when skipping zero-byte arrays; tidy\n\nAddress review feedback:\n- skip(ARRAY) bounded zero-byte-element arrays only by the heap-aware allocation\n cap, so the configurable structural collection limit\n (MAX_COLLECTION_LENGTH_PROPERTY) was not enforced cumulatively and a large\n count split into many blocks could drive a long skip loop. Always enforce\n checkMaxCollectionLength cumulatively, and additionally\n checkMaxCollectionAllocation for zero-byte schemas.\n- FastReaderBuilder.checkArrayBlock: skip the ensureAvailableCollectionBytes\n call for zero-byte elements (it recomputes minBytesPerElement and no-ops),\n applying the allocation cap directly instead.\n- Reword the checkMaxCollectionAllocation summary line from \"zero-byte-encoded\"\n to \"minimum encoded size is zero\".\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reword defaultMaxCollectionAllocation Javadoc\n\nUpdate the last \"zero-byte-encoded\" wording (the private\ndefaultMaxCollectionAllocation helper) to \"minimum encoded size is zero\",\nconsistent with the public property/Javadoc and the isZeroByteSchema predicate.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reword last zero-byte field doc; sort test imports\n\n- Reword the maxCollectionAllocation field Javadoc from \"zero-byte-encoded\" to\n \"minimum encoded size is zero\".\n- Sort the java.io imports in TestGenericDatumReader (BufferedInputStream before\n the ByteArray* imports) to satisfy Spotless.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reject Long.MIN_VALUE and negative byte-size in doSkipItems\n\ndoSkipItems accepted a Long.MIN_VALUE block count (treating it as a byte-sized\nblock and continuing to skip), inconsistent with doReadItemCount which rejects\nit. Reject Long.MIN_VALUE, and also reject a negative block byte-size, so the\nskip path fails fast on malformed input like the read path.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reject negative block byte-size in doReadItemCount\n\ndoReadItemCount consumed the block byte-size for a negative-count block without\nvalidating it. doSkipItems now rejects a negative byte-size, so the read path\ndoes the same for consistency and to reject malformed encodings.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Clarify test Javadoc: trailing 0L varint, not \"no data\"\n\nThe huge-collection matrix payload includes a trailing 0L varint (an element\nvalue for arrays, a 0-length key for maps); reword \"no element data\" to reflect\nthat.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Reword heap-fraction Javadoc to the actual predicate\n\nReword the DEFAULT_MAX_COLLECTION_ALLOCATION_HEAP_FRACTION Javadoc from\n\"zero-byte elements\" to \"elements whose minimum encoded size is zero\".\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Make array preallocation-clamp test regression-proof\n\narrayHugeCountOnStreamClampsPreallocation only asserted an EOFException, which a\nreintroduced new Object[(int) count] preallocation could still satisfy on a\nlarge-heap JVM (allocating ~200M slots then hitting EOF). Override newArray to\nrecord the largest requested capacity and assert it stays clamped to\ninitialCollectionCapacity, and assert remainingBytes() \u003d\u003d -1 to confirm the\nunknown-remaining-bytes precondition.\n\nAssisted-by: GitHub Copilot:claude-opus-4.8\n\n* AVRO-4300: [java] Address review nits: use isZeroByteSchema, tidy block-count guards\n\nApply RyanSkraba\u0027s review feedback:\n- GenericDatumReader.readArray uses the isZeroByteSchema helper instead\n of inlining minBytesPerElement \u003d\u003d 0, matching skip().\n- BinaryDecoder.doReadItemCount rejects Long.MIN_VALUE before consuming\n the block byte-size, so no readLong runs once the count is invalid.\n- BinaryDecoder.doSkipItems drops the readLong before throwing on an\n invalid Long.MIN_VALUE count, consistent with doReadItemCount.\n- FastReaderBuilder.createArrayReader drops the redundant comment;\n the rationale is documented on checkArrayBlock." }, { "commit": "f3bb10eaea1f03eb17893bc779eb26213da8177c", "tree": "080779c7d177f24f99e63c59d402342e829f6fad", "parents": [ "cc134b3ff6016d86a5f97798afc77ef1a47b7d73" ], "author": { "name": "Harsh Srivastava", "email": "76532840+HarshDevelops@users.noreply.github.com", "time": "Sun Jul 19 18:39:59 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 19 15:09:59 2026 +0200" }, "message": "AVRO-4268: BytesWritableConverter should respect logical length (#3878)\n\nBytesWritable.getBytes() returns the backing array, which can be larger\nthan the logical length reported by BytesWritable.getLength(). Wrap\ninput.getBytes() with the actual length so the Avro bytes value reflects\nthe caller\u0027s data, not unused backing-array capacity.\n\nAdds convertBytesWritableRespectsLogicalLength to cover the regression.\n\nSigned-off-by: Harsh Srivastava \u003charsh10822@gmail.com\u003e" }, { "commit": "cc134b3ff6016d86a5f97798afc77ef1a47b7d73", "tree": "e83478d090b0cd813ce8a3030532d9d2dbbfb8d2", "parents": [ "43096d0457200af54800c8c55bd2074bb9d5b548" ], "author": { "name": "mohammed arib", "email": "arib@bugqore.com", "time": "Sun Jul 19 16:35:59 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jul 19 13:05:59 2026 +0200" }, "message": "MINOR: [c++] reject lone low surrogate U+DFFF in JSON decoder (#3841)\n\nThe lone-surrogate check used an exclusive upper bound (n \u003c 0xdfff), so the last low surrogate U+DFFF slipped through and was emitted as the invalid UTF-8 sequence ED BF BF; make the bound inclusive to match the trailing-surrogate validation in the same function." }, { "commit": "43096d0457200af54800c8c55bd2074bb9d5b548", "tree": "98d1e4ae7850d0fc257dbc3c0aacdc59b392c7e2", "parents": [ "2c8e71098a4d11e52a451ecb1220ff21b6da4c4c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:29:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:29:56 2026 +0200" }, "message": "Bump postcss from 8.5.16 to 8.5.17 in /doc (#3870)\n\nBumps [postcss](https://github.com/postcss/postcss) from 8.5.16 to 8.5.17.\n- [Release notes](https://github.com/postcss/postcss/releases)\n- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/postcss/compare/8.5.16...8.5.17)\n\n---\nupdated-dependencies:\n- dependency-name: postcss\n dependency-version: 8.5.17\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2c8e71098a4d11e52a451ecb1220ff21b6da4c4c", "tree": "b689476a9fc2fdb9b2183ae8feef423f78f4ea94", "parents": [ "8b34f8be0068fc99477c989a51c124118d45a73f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:29:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:29:05 2026 +0200" }, "message": "Bump grpc.version from 1.82.1 to 1.82.2 in /lang/java (#3867)\n\nBumps `grpc.version` from 1.82.1 to 1.82.2.\n\nUpdates `io.grpc:grpc-core` from 1.82.1 to 1.82.2\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.1...v1.82.2)\n\nUpdates `io.grpc:grpc-stub` from 1.82.1 to 1.82.2\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.1...v1.82.2)\n\nUpdates `io.grpc:grpc-netty` from 1.82.1 to 1.82.2\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.1...v1.82.2)\n\n---\nupdated-dependencies:\n- dependency-name: io.grpc:grpc-core\n dependency-version: 1.82.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: io.grpc:grpc-stub\n dependency-version: 1.82.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: io.grpc:grpc-netty\n dependency-version: 1.82.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8b34f8be0068fc99477c989a51c124118d45a73f", "tree": "aa691249e7d573c823d3b8128bdb5d4fe5aef2d4", "parents": [ "8bdb8c612c35bea9632ea48ab2b8d285c9007ed1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:29:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:29:00 2026 +0200" }, "message": "Update mypy requirement from \u003c2.2.0 to \u003c2.3.0 in /lang/py (#3868)\n\nUpdates the requirements on [mypy](https://github.com/python/mypy) to permit the latest version.\n- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/python/mypy/compare/v0.1.0...v2.2.0)\n\n---\nupdated-dependencies:\n- dependency-name: mypy\n dependency-version: 2.2.0\n dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8bdb8c612c35bea9632ea48ab2b8d285c9007ed1", "tree": "b6b1aa7c95e219583bc327305c7a35e7587a911a", "parents": [ "19d83d27ed8f5cf040ab6ad067db1503910c8caf" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:28:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:28:44 2026 +0200" }, "message": "Bump astral-sh/setup-uv from 8.2.0 to 8.3.2 (#3871)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.2.0 to 8.3.2.\n- [Release notes](https://github.com/astral-sh/setup-uv/releases)\n- [Commits](https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990)\n\n---\nupdated-dependencies:\n- dependency-name: astral-sh/setup-uv\n dependency-version: 8.3.2\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "19d83d27ed8f5cf040ab6ad067db1503910c8caf", "tree": "03b96cfd7e68da197070b7ccfe4a06b1f44b114c", "parents": [ "0c0ca3fc1e3439fd5dc12cbf38a93a89d685daf5" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:28:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:28:26 2026 +0200" }, "message": "Bump com.fasterxml.jackson:jackson-bom in /lang/java (#3873)\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.22.0 to 2.22.1.\n- [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.22.0...jackson-bom-2.22.1)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson:jackson-bom\n dependency-version: 2.22.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0c0ca3fc1e3439fd5dc12cbf38a93a89d685daf5", "tree": "18153495c0ac20a139e76ae36d7b10670fb2977d", "parents": [ "bb72c294b1c9a6290b6b190edef75fb51340bc2e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:28:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:28:15 2026 +0200" }, "message": "Bump io.netty:netty-bom from 4.2.15.Final to 4.2.16.Final in /lang/java (#3874)\n\nBumps [io.netty:netty-bom](https://github.com/netty/netty) from 4.2.15.Final to 4.2.16.Final.\n- [Release notes](https://github.com/netty/netty/releases)\n- [Commits](https://github.com/netty/netty/compare/netty-4.2.15.Final...netty-4.2.16.Final)\n\n---\nupdated-dependencies:\n- dependency-name: io.netty:netty-bom\n dependency-version: 4.2.16.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "bb72c294b1c9a6290b6b190edef75fb51340bc2e", "tree": "b0403f619087040186c81b760150c151cf593acb", "parents": [ "e1386c1b12d3b8abbe4a8f46e42ef3d88f2ced0c" ], "author": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Mon Apr 06 19:54:14 2026 +0000" }, "committer": { "name": "Ismaël Mejía", "email": "iemejia@gmail.com", "time": "Sat Jul 11 11:37:22 2026 +0200" }, "message": "AVRO-4242: [Java] Fix NPE in DataFileStream and DataFileReader when schema metadata is missing\n\nMalformed Avro container files without the \u0027avro.schema\u0027 metadata entry\ncaused a NullPointerException in both DataFileStream and DataFileReader12\nwhen the null value was passed directly to Schema.Parser.parse(). Replace\ninline parsing with null-safe helper methods that throw a descriptive\nIOException instead.\n" }, { "commit": "e1386c1b12d3b8abbe4a8f46e42ef3d88f2ced0c", "tree": "7fcc3a08687c4e24c2d4c5c4219d62a5d3454012", "parents": [ "7f08eb1e9cb751273013f6f8c575580420996243" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 19:48:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 19:48:30 2026 +0200" }, "message": "Bump autoprefixer from 10.5.0 to 10.5.2 in /doc (#3834)\n\nBumps [autoprefixer](https://github.com/postcss/autoprefixer) from 10.5.0 to 10.5.2.\n- [Release notes](https://github.com/postcss/autoprefixer/releases)\n- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/autoprefixer/compare/10.5.0...10.5.2)\n\n---\nupdated-dependencies:\n- dependency-name: autoprefixer\n dependency-version: 10.5.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "7f08eb1e9cb751273013f6f8c575580420996243", "tree": "616c636b1eb0a1c66775f480525acd0725821c1b", "parents": [ "5b63fb4161d8753c78e0cfd3a21010c000900bdf" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 19:43:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 19:43:23 2026 +0200" }, "message": "Bump postcss from 8.5.15 to 8.5.16 in /doc (#3832)\n\nBumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.16.\n- [Release notes](https://github.com/postcss/postcss/releases)\n- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/postcss/compare/8.5.15...8.5.16)\n\n---\nupdated-dependencies:\n- dependency-name: postcss\n dependency-version: 8.5.16\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5b63fb4161d8753c78e0cfd3a21010c000900bdf", "tree": "6f6063744a46c7b733019def6106f1aa2197eeee", "parents": [ "777115078052380154fc99be32a9ae188919a522" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 19:43:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 19:43:16 2026 +0200" }, "message": "Bump actions/cache from 5 to 6 (#3833)\n\nBumps [actions/cache](https://github.com/actions/cache) from 5 to 6.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/cache\n dependency-version: \u00276\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "777115078052380154fc99be32a9ae188919a522", "tree": "f06b5b51dfc3f249f46f1fe71fe7b60315111ffc", "parents": [ "87501fee7da2fa65224f40b163b167569ee3acd3" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 19:43:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 19:43:08 2026 +0200" }, "message": "Bump grpc.version from 1.82.0 to 1.82.1 in /lang/java (#3831)\n\nBumps `grpc.version` from 1.82.0 to 1.82.1.\n\nUpdates `io.grpc:grpc-core` from 1.82.0 to 1.82.1\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.0...v1.82.1)\n\nUpdates `io.grpc:grpc-stub` from 1.82.0 to 1.82.1\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.0...v1.82.1)\n\nUpdates `io.grpc:grpc-netty` from 1.82.0 to 1.82.1\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.82.0...v1.82.1)\n\n---\nupdated-dependencies:\n- dependency-name: io.grpc:grpc-core\n dependency-version: 1.82.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: io.grpc:grpc-stub\n dependency-version: 1.82.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: io.grpc:grpc-netty\n dependency-version: 1.82.1\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "87501fee7da2fa65224f40b163b167569ee3acd3", "tree": "7113107c46509f2bfc7c6de6577940f610b502ba", "parents": [ "bbbdd53fa256827819d49026b9795bf069d2b3cd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 19:43:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 19:43:01 2026 +0200" }, "message": "Bump com.diffplug.spotless:spotless-maven-plugin in /lang/java (#3829)\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.6.0 to 3.7.0.\n- [Release notes](https://github.com/diffplug/spotless/releases)\n- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)\n- [Commits](https://github.com/diffplug/spotless/compare/maven/3.6.0...maven/3.7.0)\n\n---\nupdated-dependencies:\n- dependency-name: com.diffplug.spotless:spotless-maven-plugin\n dependency-version: 3.7.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "bbbdd53fa256827819d49026b9795bf069d2b3cd", "tree": "787d5e6471890e1c5a141678561baceb4acb1162", "parents": [ "bc1361576cc3e2822e11cdc189f922d614c67cff" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 19:42:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 19:42:53 2026 +0200" }, "message": "Bump org.cyclonedx:cyclonedx-maven-plugin in /lang/java (#3828)\n\nBumps [org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin) from 2.9.1 to 2.9.2.\n- [Release notes](https://github.com/CycloneDX/cyclonedx-maven-plugin/releases)\n- [Commits](https://github.com/CycloneDX/cyclonedx-maven-plugin/compare/cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.cyclonedx:cyclonedx-maven-plugin\n dependency-version: 2.9.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "bc1361576cc3e2822e11cdc189f922d614c67cff", "tree": "b9ebe2df0ccf578b07af4bd69f5700213e1b9e7e", "parents": [ "840dc8139f4b3d1bfa8e8c8f1ac3be949b440634" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 19:42:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 03 19:42:45 2026 +0200" }, "message": "Bump actions/checkout from 6 to 7 (#3827)\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "840dc8139f4b3d1bfa8e8c8f1ac3be949b440634", "tree": "0b9c9cf05c2a855768399b009e705d10c6b5a165", "parents": [ "d85a45b4f53c3b74e6dab3ba9be48932e301b50b" ], "author": { "name": "Mattia Basone", "email": "mattia.basone@gmail.com", "time": "Fri Jun 19 11:48:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 19 11:48:20 2026 +0200" }, "message": "PHP - fix json_decode syntax error and set dev tools version (#3824)" }, { "commit": "d85a45b4f53c3b74e6dab3ba9be48932e301b50b", "tree": "875d4956b15316e1c6f3e904a52816f1bb92e2f3", "parents": [ "912ab25169ab829d5c523fd231b5abb286c4dbe1" ], "author": { "name": "KyleKim107", "email": "56135395+KyleKim107@users.noreply.github.com", "time": "Fri Jun 19 02:58:41 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jun 19 10:58:41 2026 +0300" }, "message": "Fix wrong schema accessor in avro_generic_map_class (#3823)" }, { "commit": "912ab25169ab829d5c523fd231b5abb286c4dbe1", "tree": "1722d4ddf915102a4a251745f2664e9787acb715", "parents": [ "4bec628b057d2c55447e8e228ceb20158b1c91a4" ], "author": { "name": "Emanuele Russo", "email": "150815706+emarussoo@users.noreply.github.com", "time": "Thu Jun 18 23:56:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 18 23:56:11 2026 +0200" }, "message": "AVRO-4269: Fix timestamp-nanos conversion before epoch (#3813)" }, { "commit": "4bec628b057d2c55447e8e228ceb20158b1c91a4", "tree": "7804c632b5fe0ee05ecb30ab567c55aa848d26c5", "parents": [ "3c972b03c88720e6bdad48fd0c488e5c79b00089" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 15 20:23:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 20:23:15 2026 +0200" }, "message": "Bump System.CodeDom from 10.0.8 to 10.0.9 (#3821)\n\n---\nupdated-dependencies:\n- dependency-name: System.CodeDom\n dependency-version: 10.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3c972b03c88720e6bdad48fd0c488e5c79b00089", "tree": "a82131bc1b2678bfe80f2053fdc0dcf68624ea6c", "parents": [ "23436092e748acff9b4b2723cfaf9b12a2182869" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 15 20:23:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 20:23:02 2026 +0200" }, "message": "Bump Microsoft.Build.Framework and Microsoft.Build.Utilities.Core (#3820)\n\nBumps Microsoft.Build.Framework from 18.6.3 to 18.7.1\nBumps Microsoft.Build.Utilities.Core from 18.6.3 to 18.7.1\n\n---\nupdated-dependencies:\n- dependency-name: Microsoft.Build.Framework\n dependency-version: 18.7.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: Microsoft.Build.Utilities.Core\n dependency-version: 18.7.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "23436092e748acff9b4b2723cfaf9b12a2182869", "tree": "2189105172fe0c7aa81263d8c5774c00ed941292", "parents": [ "2ca939eb8ca01b4d29aae69dd405972424dd0ada" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 15 20:22:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 20:22:51 2026 +0200" }, "message": "Bump com.google.protobuf:protobuf-java in /lang/java (#3818)\n\nBumps [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) from 4.35.0 to 4.35.1.\n- [Release notes](https://github.com/protocolbuffers/protobuf/releases)\n- [Commits](https://github.com/protocolbuffers/protobuf/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.google.protobuf:protobuf-java\n dependency-version: 4.35.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2ca939eb8ca01b4d29aae69dd405972424dd0ada", "tree": "a6f7bf5b52b1382ce5e36845368379682df94afd", "parents": [ "d728cbcbe0eabf76de41e4365e96a2532887bbd2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 15 20:22:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 20:22:41 2026 +0200" }, "message": "Bump grpc.version from 1.81.0 to 1.82.0 in /lang/java (#3817)\n\nBumps `grpc.version` from 1.81.0 to 1.82.0.\n\nUpdates `io.grpc:grpc-core` from 1.81.0 to 1.82.0\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.81.0...v1.82.0)\n\nUpdates `io.grpc:grpc-stub` from 1.81.0 to 1.82.0\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.81.0...v1.82.0)\n\nUpdates `io.grpc:grpc-netty` from 1.81.0 to 1.82.0\n- [Release notes](https://github.com/grpc/grpc-java/releases)\n- [Commits](https://github.com/grpc/grpc-java/compare/v1.81.0...v1.82.0)\n\n---\nupdated-dependencies:\n- dependency-name: io.grpc:grpc-core\n dependency-version: 1.82.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.grpc:grpc-stub\n dependency-version: 1.82.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.grpc:grpc-netty\n dependency-version: 1.82.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d728cbcbe0eabf76de41e4365e96a2532887bbd2", "tree": "8a9bc03b9e1fe582fd82d0778e27ef050abaad54", "parents": [ "0f18ca801f25fa9435d727abba9fb979f9bde662" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 15 20:22:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 15 20:22:11 2026 +0200" }, "message": "Bump com.github.luben:zstd-jni from 1.5.7-10 to 1.5.7-11 in /lang/java (#3816)\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-10 to 1.5.7-11.\n- [Commits](https://github.com/luben/zstd-jni/commits/v1.5.7-11)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.luben:zstd-jni\n dependency-version: 1.5.7-11\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0f18ca801f25fa9435d727abba9fb979f9bde662", "tree": "10240a542af7fa40c5dda000ff9eb7c3832ed9d3", "parents": [ "76fadbfcb73f9173fed535700518d6a41e4c719a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jun 11 15:19:35 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 15:19:35 2026 +0200" }, "message": "Bump com.github.luben:zstd-jni from 1.5.7-9 to 1.5.7-10 in /lang/java (#3812)\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-9 to 1.5.7-10.\n- [Commits](https://github.com/luben/zstd-jni/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.luben:zstd-jni\n dependency-version: 1.5.7-10\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "76fadbfcb73f9173fed535700518d6a41e4c719a", "tree": "44db91133ddfa55b42ea6797ee4752e0b204cdf2", "parents": [ "99bfb9eb0ed73efa8293435e7de5bd568c784261" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jun 11 15:19:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 15:19:27 2026 +0200" }, "message": "Bump astral-sh/setup-uv from 8.1.0 to 8.2.0 (#3811)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.1.0 to 8.2.0.\n- [Release notes](https://github.com/astral-sh/setup-uv/releases)\n- [Commits](https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...fac544c07dec837d0ccb6301d7b5580bf5edae39)\n\n---\nupdated-dependencies:\n- dependency-name: astral-sh/setup-uv\n dependency-version: 8.2.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "99bfb9eb0ed73efa8293435e7de5bd568c784261", "tree": "5fd80acbd224ff1175b49c2b18e678921bef5cf3", "parents": [ "ec31e8b81517138779fa4797e8432cf39bba9801" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jun 11 15:19:12 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 15:19:12 2026 +0200" }, "message": "Bump io.netty:netty-bom from 4.2.14.Final to 4.2.15.Final in /lang/java (#3810)\n\nBumps [io.netty:netty-bom](https://github.com/netty/netty) from 4.2.14.Final to 4.2.15.Final.\n- [Release notes](https://github.com/netty/netty/releases)\n- [Commits](https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final)\n\n---\nupdated-dependencies:\n- dependency-name: io.netty:netty-bom\n dependency-version: 4.2.15.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ec31e8b81517138779fa4797e8432cf39bba9801", "tree": "ca1e81dcade97fcf1c9869a062ee19041138a77c", "parents": [ "6444e8d5e86baa85ab5962a8bc275838e8c364b6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jun 11 15:19:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 11 15:19:00 2026 +0200" }, "message": "Bump com.fasterxml.jackson:jackson-bom in /lang/java (#3809)\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.4 to 2.22.0.\n- [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.4...jackson-bom-2.22.0)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson:jackson-bom\n dependency-version: 2.22.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6444e8d5e86baa85ab5962a8bc275838e8c364b6", "tree": "822ef2d08462756958ed0cd9f77be518a7e43697", "parents": [ "997d50d312613e921598aaed30b082f9bcf9c6ea" ], "author": { "name": "Gang Wu", "email": "ustcwg@gmail.com", "time": "Wed Jun 10 16:02:22 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 10 11:02:22 2026 +0300" }, "message": "MINOR: [C++] fix missing format_context when compiled with C++23 (#3815)" }, { "commit": "997d50d312613e921598aaed30b082f9bcf9c6ea", "tree": "dc6916e830f17b5a978fc87029b937b719970d10", "parents": [ "d77446e5d05cd68c28d09c1af800a428dea34e03" ], "author": { "name": "Gang Wu", "email": "ustcwg@gmail.com", "time": "Mon Jun 08 13:55:52 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 08 08:55:52 2026 +0300" }, "message": "MINOR: [C++] Add missing header \u003ctype_traits\u003e (#3808)" }, { "commit": "d77446e5d05cd68c28d09c1af800a428dea34e03", "tree": "f579ae86b35e31516d19f66cbc5be08053bb90a0", "parents": [ "2041bcdf12c4ce58d33d1853cfe3a016f2d790fe" ], "author": { "name": "Gang Wu", "email": "ustcwg@gmail.com", "time": "Wed Jun 03 04:07:22 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 02 22:07:22 2026 +0200" }, "message": "AVRO-XXX: [C++] Replace fmt with std::format and require C++20 (#3788)" }, { "commit": "2041bcdf12c4ce58d33d1853cfe3a016f2d790fe", "tree": "aee628c5829d3b1bffb4d9ac6e982c4307dcc84a", "parents": [ "bd70a0859b9d739aad0547aa61bd17291049773b" ], "author": { "name": "Fábio Lucas Carneiro", "email": "fabiolucas.carneiro@gmail.com", "time": "Tue Jun 02 20:04:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 02 20:04:24 2026 +0200" }, "message": "AVRO-4246: [c] Fix memory leak on failed decoding (#3732)\n\n* AVRO-4246: Add \u0027AVRO_READ_OR_FREE\u0027 macro.\n\n* AVRO-4246: Replace \u0027AVRO_READ\u0027 by \u0027AVRO_READ_OR_FREE\u0027 in \u0027read_string\u0027 and \u0027read_bytes\u0027 functions.\n\n* AVRO-4246: Add \u0027test_avro_4246.c\u0027 to test suite.\n\n---------\n\nCo-authored-by: flpereir \u003cfabio.carneiro@cern.ch\u003e\nCo-authored-by: kwenzh \u003cyukunzhang29@hotmail.com\u003e" }, { "commit": "bd70a0859b9d739aad0547aa61bd17291049773b", "tree": "dbc973a40d13c516ec945e546a30bf19df0ae4d0", "parents": [ "f433b701e2f8b224e5ac187fd1004048ee9a9517" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 10:04:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 10:04:34 2026 +0200" }, "message": "Bump org.apache.maven.plugins:maven-surefire-plugin in /lang/java (#3805)\n\nBumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.5.5 to 3.5.6.\n- [Release notes](https://github.com/apache/maven-surefire/releases)\n- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.5...surefire-3.5.6)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:maven-surefire-plugin\n dependency-version: 3.5.6\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f433b701e2f8b224e5ac187fd1004048ee9a9517", "tree": "1af0b3e89370c50ae733008c18d7ab07c4154d8d", "parents": [ "2fb95289d49cd5786062c76ed94115525f211ba6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 10:04:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 10:04:24 2026 +0200" }, "message": "Bump tmp from 0.2.6 to 0.2.7 in /lang/js (#3803)\n\nBumps [tmp](https://github.com/raszi/node-tmp) from 0.2.6 to 0.2.7.\n- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.6...v0.2.7)\n\n---\nupdated-dependencies:\n- dependency-name: tmp\n dependency-version: 0.2.7\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2fb95289d49cd5786062c76ed94115525f211ba6", "tree": "05d035aeaa4292771c7e5cf7580390fb351ec4c5", "parents": [ "5481629ae7be942436951bb0b0e7f23130e66e3e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 10:04:13 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 10:04:13 2026 +0200" }, "message": "Bump coverlet.msbuild from 10.0.0 to 10.0.1 (#3798)\n\n---\nupdated-dependencies:\n- dependency-name: coverlet.msbuild\n dependency-version: 10.0.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5481629ae7be942436951bb0b0e7f23130e66e3e", "tree": "38d7e4de01e05ceefe767e018cb5ffc41106e21b", "parents": [ "b86ddf04ed951f4988d64f23daab66e5f7fca729" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 09:19:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 09:19:33 2026 +0200" }, "message": "Bump com.fasterxml.jackson:jackson-bom in /lang/java (#3804)\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.3 to 2.21.4.\n- [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.3...jackson-bom-2.21.4)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson:jackson-bom\n dependency-version: 2.21.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b86ddf04ed951f4988d64f23daab66e5f7fca729", "tree": "95b5dca6424877a00a16af923557d318da68f3a7", "parents": [ "6db0de27609e7a2b76934be8cbb3a807f576f882" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 09:19:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 09:19:20 2026 +0200" }, "message": "Bump com.diffplug.spotless:spotless-maven-plugin in /lang/java (#3802)\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.5.1 to 3.6.0.\n- [Release notes](https://github.com/diffplug/spotless/releases)\n- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)\n- [Commits](https://github.com/diffplug/spotless/compare/maven/3.5.1...maven/3.6.0)\n\n---\nupdated-dependencies:\n- dependency-name: com.diffplug.spotless:spotless-maven-plugin\n dependency-version: 3.6.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6db0de27609e7a2b76934be8cbb3a807f576f882", "tree": "3293cd75399ff88940481a84fedc9b94994f8a79", "parents": [ "1259420f2706bedd5310bf31a67676af3f8e840a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 09:19:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 09:19:08 2026 +0200" }, "message": "Bump tmp from 0.2.5 to 0.2.6 in /lang/js (#3801)\n\nBumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.6.\n- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.6)\n\n---\nupdated-dependencies:\n- dependency-name: tmp\n dependency-version: 0.2.6\n dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1259420f2706bedd5310bf31a67676af3f8e840a", "tree": "7fcdaf0df9a55ddd9b5fe4e556877b4bc6acc868", "parents": [ "9c3010ffb9c9b5d370ad048d576d33d94b5f0257" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 09:18:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 09:18:38 2026 +0200" }, "message": "Bump coverlet.collector from 10.0.0 to 10.0.1 (#3797)\n\n---\nupdated-dependencies:\n- dependency-name: coverlet.collector\n dependency-version: 10.0.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9c3010ffb9c9b5d370ad048d576d33d94b5f0257", "tree": "679a8505f770e0fe2e82708a0130e8ef2d23b338", "parents": [ "77d5c7f09d50f94a43d29710f26b2726165aec3a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 09:18:28 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 09:18:28 2026 +0200" }, "message": "Bump com.google.protobuf:protobuf-java in /lang/java (#3796)\n\nBumps [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) from 4.34.1 to 4.35.0.\n- [Release notes](https://github.com/protocolbuffers/protobuf/releases)\n- [Commits](https://github.com/protocolbuffers/protobuf/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.google.protobuf:protobuf-java\n dependency-version: 4.35.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "77d5c7f09d50f94a43d29710f26b2726165aec3a", "tree": "bae124b93dab67b139c0745ce64c1909b7512ca4", "parents": [ "65ca0a2a2df61cedf7fa070fd45a33d94108ac68" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 08:50:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 08:50:32 2026 +0200" }, "message": "Bump com.github.luben:zstd-jni from 1.5.7-8 to 1.5.7-9 in /lang/java (#3795)\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-8 to 1.5.7-9.\n- [Commits](https://github.com/luben/zstd-jni/compare/v1.5.7-8...v1.5.7-9)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.luben:zstd-jni\n dependency-version: 1.5.7-9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "65ca0a2a2df61cedf7fa070fd45a33d94108ac68", "tree": "7f2694a34929526899a7b0b8ed748837cb9e1b62", "parents": [ "f9689b9347aea998918788f8e2a58710fe969462" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 08:50:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 08:50:23 2026 +0200" }, "message": "Bump mocha from 11.7.5 to 11.7.6 in /lang/js (#3794)\n\nBumps [mocha](https://github.com/mochajs/mocha) from 11.7.5 to 11.7.6.\n- [Release notes](https://github.com/mochajs/mocha/releases)\n- [Changelog](https://github.com/mochajs/mocha/blob/v11.7.6/CHANGELOG.md)\n- [Commits](https://github.com/mochajs/mocha/compare/v11.7.5...v11.7.6)\n\n---\nupdated-dependencies:\n- dependency-name: mocha\n dependency-version: 11.7.6\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f9689b9347aea998918788f8e2a58710fe969462", "tree": "fc12dcd80f419c69158091455dda6debfec7cbe9", "parents": [ "5a6148c4c45f788cbaf7669c0e9123529c1c246a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 08:50:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 08:50:15 2026 +0200" }, "message": "Bump org.apache.maven.plugins:maven-enforcer-plugin in /lang/java (#3793)\n\nBumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.6.2 to 3.6.3.\n- [Release notes](https://github.com/apache/maven-enforcer/releases)\n- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.6.2...enforcer-3.6.3)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin\n dependency-version: 3.6.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5a6148c4c45f788cbaf7669c0e9123529c1c246a", "tree": "8c14d9fe56771cddda94c29ea76ca46ad1dc4755", "parents": [ "c3c14fa184a9dbe11c9367effbc563ea7852c274" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 08:50:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 08:50:05 2026 +0200" }, "message": "Bump postcss from 8.5.14 to 8.5.15 in /doc (#3792)\n\nBumps [postcss](https://github.com/postcss/postcss) from 8.5.14 to 8.5.15.\n- [Release notes](https://github.com/postcss/postcss/releases)\n- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/postcss/postcss/compare/8.5.14...8.5.15)\n\n---\nupdated-dependencies:\n- dependency-name: postcss\n dependency-version: 8.5.15\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c3c14fa184a9dbe11c9367effbc563ea7852c274", "tree": "0044a723d26a86baf5fb59cbb2a9bc2e74cb777d", "parents": [ "66e29f38608e987e96e27f5e06c27eb0f61bd24f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 01 08:49:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 01 08:49:53 2026 +0200" }, "message": "Bump io.netty:netty-bom from 4.2.13.Final to 4.2.14.Final in /lang/java (#3791)\n\nBumps [io.netty:netty-bom](https://github.com/netty/netty) from 4.2.13.Final to 4.2.14.Final.\n- [Release notes](https://github.com/netty/netty/releases)\n- [Commits](https://github.com/netty/netty/compare/netty-4.2.13.Final...netty-4.2.14.Final)\n\n---\nupdated-dependencies:\n- dependency-name: io.netty:netty-bom\n dependency-version: 4.2.14.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "66e29f38608e987e96e27f5e06c27eb0f61bd24f", "tree": "31464ed42e097fb0e7c39db1192765e5d1943118", "parents": [ "9ce6b208a69ec74a4b070e27d8917b98705a6924" ], "author": { "name": "Gang Wu", "email": "ustcwg@gmail.com", "time": "Wed May 27 19:59:48 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 27 14:59:48 2026 +0300" }, "message": "AVRO-4260: [C++] Upgrade minimum C++ standard from C++17 to C++20 (#3800)\n\nRaise CMAKE_CXX_STANDARD default from 17 to 20 and update the\nminimum version check accordingly." }, { "commit": "9ce6b208a69ec74a4b070e27d8917b98705a6924", "tree": "204b35355fb52fe143802c0e80c6377538a29aa4", "parents": [ "0cde4852b7361bb1674d987fabfa4022672dc516" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu May 21 20:48:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 21 20:48:01 2026 +0200" }, "message": "Bump idna from 3.11 to 3.15 in /lang/py (#3787)\n\nBumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15.\n- [Release notes](https://github.com/kjd/idna/releases)\n- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)\n- [Commits](https://github.com/kjd/idna/compare/v3.11...v3.15)\n\n---\nupdated-dependencies:\n- dependency-name: idna\n dependency-version: \u00273.15\u0027\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0cde4852b7361bb1674d987fabfa4022672dc516", "tree": "47159674802a10bf4792b3bcc736a652807ff44a", "parents": [ "a76fb29669cd44a275db98ce8fc9b50af383d997" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu May 21 20:47:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 21 20:47:38 2026 +0200" }, "message": "Bump System.CodeDom from 10.0.7 to 10.0.8 (#3786)\n\n---\nupdated-dependencies:\n- dependency-name: System.CodeDom\n dependency-version: 10.0.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a76fb29669cd44a275db98ce8fc9b50af383d997", "tree": "0dfa19a9b263718964de87a579db5adbe8ce78bb", "parents": [ "61b4e7413222610a6d1f7aace255d3418afb69bd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu May 21 20:47:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 21 20:47:09 2026 +0200" }, "message": "Bump Microsoft.Build.Framework and Microsoft.Build.Utilities.Core (#3785)\n\nBumps Microsoft.Build.Framework from 18.4.0 to 18.6.3\nBumps Microsoft.Build.Utilities.Core from 18.4.0 to 18.6.3\n\n---\nupdated-dependencies:\n- dependency-name: Microsoft.Build.Framework\n dependency-version: 18.6.3\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: Microsoft.Build.Utilities.Core\n dependency-version: 18.6.3\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "61b4e7413222610a6d1f7aace255d3418afb69bd", "tree": "e88db0a4a6bcb64c5c10c63c2161026cf660c27c", "parents": [ "8b2f4a129ce79f9c8c66e6526d654784cd8b7e0f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu May 21 20:46:35 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 21 20:46:35 2026 +0200" }, "message": "Update mypy requirement from \u003c2.1.0 to \u003c2.2.0 in /lang/py (#3783)\n\nUpdates the requirements on [mypy](https://github.com/python/mypy) to permit the latest version.\n- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/python/mypy/compare/v0.1.0...v2.1.0)\n\n---\nupdated-dependencies:\n- dependency-name: mypy\n dependency-version: 2.1.0\n dependency-type: direct:development\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8b2f4a129ce79f9c8c66e6526d654784cd8b7e0f", "tree": "3a7bf3442a11ddff24695ac90207e4dd94e9c146", "parents": [ "7f1bccdb51452430acf8d895a21de0a7f19a2eb7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu May 21 20:46:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 21 20:46:22 2026 +0200" }, "message": "Bump slf4j.version from 2.0.17 to 2.0.18 in /lang/java (#3782)\n\nBumps `slf4j.version` from 2.0.17 to 2.0.18.\n\nUpdates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.18\n\nUpdates `org.slf4j:slf4j-simple` from 2.0.17 to 2.0.18\n\nUpdates `org.slf4j:slf4j-log4j12` from 2.0.17 to 2.0.18\n\n---\nupdated-dependencies:\n- dependency-name: org.slf4j:slf4j-api\n dependency-version: 2.0.18\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-simple\n dependency-version: 2.0.18\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-log4j12\n dependency-version: 2.0.18\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "7f1bccdb51452430acf8d895a21de0a7f19a2eb7", "tree": "de86799ca9a2e2c4c5e0eb65b3a5ae2fc45fc348", "parents": [ "85d61282f514df9b93ce7f26998a3ed803eba87f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu May 21 20:45:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 21 20:45:41 2026 +0200" }, "message": "Bump com.diffplug.spotless:spotless-maven-plugin in /lang/java (#3781)\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.4.0 to 3.5.1.\n- [Release notes](https://github.com/diffplug/spotless/releases)\n- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)\n- [Commits](https://github.com/diffplug/spotless/compare/maven/3.4.0...maven/3.5.1)\n\n---\nupdated-dependencies:\n- dependency-name: com.diffplug.spotless:spotless-maven-plugin\n dependency-version: 3.5.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "85d61282f514df9b93ce7f26998a3ed803eba87f", "tree": "847f96b34ae44ce2d19eb6021949172227b7695d", "parents": [ "68da8fb99da5c482f17853e01e79f714e3717b42" ], "author": { "name": "The Apache Software Foundation", "email": "root-asf-gitbox-commits@apache.org", "time": "Mon May 18 12:18:35 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 18 19:18:35 2026 +0200" }, "message": "Set up default protection ruleset for default and release branches (#3780)" } ], "next": "68da8fb99da5c482f17853e01e79f714e3717b42" }