)]}' { "log": [ { "commit": "ac66880b6184b6cf288b648a259468125d52fdc7", "tree": "6782ee49dad5a8a41754ef9e3d89e643172658d7", "parents": [ "614c8d4c0bc00e1967a19cf4d8213a066cb00608" ], "author": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Tue Jul 28 11:28:10 2026 +0800" }, "committer": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Tue Jul 28 11:28:10 2026 +0800" }, "message": "[KYUUBI #7587] [SPARK] Infer cast-wrapped join keys in InferRebalanceAndSortOrders\n\n### Why are the changes needed?\n\nTwo fixes to `InferRebalanceAndSortOrders` (applied across the Spark 3.5, 4.0, 4.1 and 4.2 extension modules):\n\n1. **Support cast-wrapped join keys.** When join key columns have mismatched types (e.g. via a `UNION ALL` branch that widens `int` to `bigint`), the analyzer inserts a cast on the join key such as `cast(genre_tag_id as bigint)`. The outer projection\u0027s alias map is keyed by the unary-peeled attribute, so the full cast expression never matched and the key was silently dropped by the `outputSet` filter — only the un-cast keys survived, weakening the inferred rebalance/sort. This adds `mapThroughAlias`, which retries the alias lookup with the unary-peeled key (symmetric with how `getAliasMap` builds its keys), so a cast-wrapped key maps back to its aliased output attribute. `Cast` is also treated as cheap in `isCheap` for keys that survive without being aliased away.\n\n2. **Gate the cheap-column check by `maxColumns`.** `INFER_REBALANCE_AND_SORT_ORDERS_MAX_COLUMNS` is now threaded into `infer` and the truncation is applied *before* the cheap-column check, so only the first `maxColumns` inferred columns need to be cheap (previously an expensive key beyond the limit could discard the whole inference).\n\n### How was this patch tested?\n\nAdded unit tests in `RebalanceBeforeWritingSuite` for each affected module:\n- cast-wrapped join key resolves to its aliased output attribute,\n- a `Cast` over a cheap column is treated as cheap,\n- `maxColumns` gates the cheap-column check.\n\nVerified locally with:\n- Spark 3.5: `build/mvn -Pspark-3.5 test -pl extensions/spark/kyuubi-extension-spark-3-5 -am -DwildcardSuites\u003dorg.apache.spark.sql.RebalanceBeforeWritingSuite`\n- Spark 4.0 / 4.1 / 4.2 (JDK 17, `-Pscala-2.13`): same suite per module.\n\nAll suites pass; `dev/reformat` applied.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-8\n\nCloses #7587 from ulysses-you/ne-infer-cast-wrapped-join-keys.\n\nCloses #7587\n\n3999f3a68 [Xiduo You] [SPARK] Infer cast-wrapped join keys in InferRebalanceAndSortOrders\n\nAuthored-by: Xiduo You \u003culyssesyou@apache.org\u003e\nSigned-off-by: Xiduo You \u003culyssesyou@apache.org\u003e\n" }, { "commit": "614c8d4c0bc00e1967a19cf4d8213a066cb00608", "tree": "b210fcc31b92abfe96e24c27f5d32cd27ecb63a6", "parents": [ "8db1a4902a731e92da9253a263afcfd18158c3a4" ], "author": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Thu Jul 23 12:50:39 2026 +0800" }, "committer": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Thu Jul 23 12:50:39 2026 +0800" }, "message": "[KYUUBI #7581] [SPARK] Use the larger advisory partition size when both configs are set\n\n### Why are the changes needed?\n\nWhen both `spark.sql.adaptive.rebalancePartitionsAdvisoryPartitionSizeInBytes`\nand `spark.sql.finalStage.adaptive.advisoryPartitionSizeInBytes` are set,\n`KyuubiSQLConf.getAdvisoryPartitionSize` previously let the rebalance config\nunconditionally take precedence. This could pick a smaller advisory partition\nsize than the finalStage config even when the finalStage value is larger.\n\nThis changes the resolution so the larger of the two values is used when both\nare set, which better reflects the intent of both knobs. The doc for the\nrebalance config is updated accordingly. The change is applied to the\nspark-3.5, 4.0 and 4.1 extension modules.\n\n### How was this patch tested?\n\nUpdated `RebalanceBeforeWritingSuite` in all three modules to cover:\n- both set, rebalance larger -\u003e rebalance wins\n- both set, finalStage larger -\u003e finalStage wins\n- both set to the same value\n\nRan the suite locally:\n\n```\nbuild/mvn test -pl extensions/spark/kyuubi-extension-spark-3-5 -am -Pspark-3.5 \\\n -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.spark.sql.RebalanceBeforeWritingSuite # 14 passed\nbuild/mvn test -pl extensions/spark/kyuubi-extension-spark-4-0 -am -Pspark-4.0 -Pscala-2.13 \\\n -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.spark.sql.RebalanceBeforeWritingSuite # 12 passed\nbuild/mvn test -pl extensions/spark/kyuubi-extension-spark-4-1 -am -Pspark-4.1 -Pscala-2.13 \\\n -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.spark.sql.RebalanceBeforeWritingSuite # 12 passed\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nYes.\n\nAssisted-by: Claude Opus 4.8\n\nCloses #7581 from ulysses-you/advisory-partition-size-max.\n\nCloses #7581\n\n1923b5ae6 [Xiduo You] [SPARK] Apply the larger advisory partition size change to the 4.2 module\ncd113c726 [Xiduo You] [SPARK] Use the larger advisory partition size when both configs are set\n\nAuthored-by: Xiduo You \u003culyssesyou@apache.org\u003e\nSigned-off-by: Xiduo You \u003culyssesyou@apache.org\u003e\n" }, { "commit": "8db1a4902a731e92da9253a263afcfd18158c3a4", "tree": "1a297429c067cc6bb4dde946c9ccaee054b45725", "parents": [ "14322e8a4a05cafc6abfd1813ff23ee9c3c09091" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 21 17:46:10 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 21 17:46:10 2026 +0800" }, "message": "[KYUUBI #7579] [INFRA] Reduce snapshot Docker image publish schedule to every 5 days\n\n### Why are the changes needed?\n\nThe `Publish Snapshot Docker Image` workflow runs daily and writes a large\nmulti-arch build cache via `type\u003dgha`. Because a repo shares a limited GitHub\nActions cache quota with LRU eviction, this daily snapshot cache occupies a big\nchunk of the quota and pushes out other workflows\u0027 caches, causing them to be\nevicted and re-downloaded more often.\n\nReducing the cadence to every 5 days (`0 0 */5 * *`) keeps the master-snapshot\nimage fresh enough while relieving cache-quota pressure on other workflows.\n\n### How was this patch tested?\n\nCI scheduling change only; no functional code change.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-8\n\nCloses #7579 from pan3793/reduce-snapshot-docker-cron.\n\nCloses #7579\n\n76cbecfd9 [Cheng Pan] [INFRA] Reduce snapshot Docker image publish schedule to every 5 days\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "14322e8a4a05cafc6abfd1813ff23ee9c3c09091", "tree": "4fc80621b17b8eaeedb27e75dc7c24f4a482e6de", "parents": [ "ab47c672113a0761751332912508bcf484109e21" ], "author": { "name": "hutiefang", "email": "hutiefang@qq.com", "time": "Tue Jul 21 11:16:10 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 21 13:49:12 2026 +0800" }, "message": "[KYUUBI #2470][AUTHZ] Add Ranger performance tracing to rule authorization\n\n### Why are the changes needed?\n\nCloses #2470.\n\n`RuleAuthorization.checkPrivileges` currently has no Ranger performance trace around privilege-request construction and evaluation. This adds the established `sparkauth.request` tracer around the complete authorization path and logs it from `finally`, so both successful checks and exceptions finish the timing record without changing authorization results.\n\n### How was this patch tested?\n\n- `JAVA_HOME\u003d$(/usr/libexec/java_home -v 17) ./dev/reformat`\n- `JAVA_HOME\u003d$(/usr/libexec/java_home -v 17) ./build/mvn -pl extensions/spark/kyuubi-spark-authz -am -DwildcardSuites\u003dorg.apache.kyuubi.plugin.spark.authz.ranger.InMemoryCatalogRangerSparkExtensionSuite -DskipITs test`\n - 16 tests passed, including a new assertion that captures the performance trace on both successful and denied authorization paths.\n- `git diff --check`\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: OpenAI Codex with GPT-5\n\nCloses #7555 from hutiefang76/codex/kyuubi-2470-ranger-perf-tracer.\n\nCloses #2470\n\n35aa3ecd9 [Cheng Pan] restore\n1f4dffcbb [Cheng Pan] DataSourceV2RelationTableExtractorSuite extends KyuubiFunSuite\nd2ac06ffe [Cheng Pan] fix PaimonCatalogRangerSparkExtensionSuite\nd4c6f6854 [Cheng Pan] flip assume and super.beforeEach()\na0379aa74 [Cheng Pan] codestyle\n8333cc478 [Cheng Pan] codestyle\n356a24d43 [Cheng Pan] restore test hierarchy\nce04403e7 [hutiefang] [KYUUBI #2470][AUTHZ] Add Ranger performance tracing to rule authorization\n\nLead-authored-by: hutiefang \u003chutiefang@qq.com\u003e\nCo-authored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "ab47c672113a0761751332912508bcf484109e21", "tree": "7eba2c490e0476b952815e5acf3f63d2b4e0313d", "parents": [ "f67edd6f9ea8177b7eb6c648bf196d44938d0c26" ], "author": { "name": "Jiwon Park", "email": "jpark92@outlook.kr", "time": "Tue Jul 21 07:49:59 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 21 07:49:59 2026 +0800" }, "message": "[KYUUBI #7230][AUTHZ] Support skipping privilege check for DataSourceV2Relation without catalog and identifier\n\n### Why are the changes needed?\n\nDSv2 `TableProvider`s that do not implement `SupportsCatalogOptions` (the MongoDB connector, the ClickHouse native connector, etc.), when used directly via `format(...).load()` / `.save()`, produce a `DataSourceV2Relation` with neither `catalog` nor `identifier` — Spark\u0027s non-catalog fallback in `DataSourceV2Utils.loadV2Source` / `DataFrameWriter` passes `(None, None)`, and the read-side fallback carries Spark\u0027s own TODO note that \"Non-catalog paths for DSV2 are currently not well defined\".\n\nFor such relations `DataSourceV2RelationTableExtractor` falls back to `table.name()`, which is connector-defined and usually synthetic (e.g. `MongoTable()`). The resulting Ranger resource has no `database` element, and a resource missing a parent level of the `database → table → column` hierarchy matches no policy at all — not even `database\u003d* / table\u003d*` (`RangerDefaultPolicyResourceMatcher.isHierarchyValidForResources`, Ranger 2.6.0). So the current behavior is an unconditional deny that operators cannot lift with any policy, reported in #7230. Meanwhile the v1 path is already skipped: a `LogicalRelation` without `catalogTable` produces no privilege object.\n\nThis PR adds an operator-level opt-out, default `false` so default behavior is unchanged:\n\n- `spark.kyuubi.authz.skip.catalogless.v2.relation.enabled` (default `false`): when enabled, the extractor returns `None` for a `DataSourceV2Relation` whose catalog and identifier are both empty, restoring parity with the v1 path.\n- The key is added to `AuthzConfigurationChecker`\u0027s built-in restricted list (like `spark.sql.runSQLOnFiles`), so end users cannot flip it with `SET`. Operators should also consider listing it in `kyuubi.session.conf.restrict.list`.\n\nNote: whether skipping is safe is deployment-specific — fine when credentials for the external system are supplied per query by the end user, risky when the shared Spark principal holds ambient credentials. Hence opt-in rather than unconditional. Skipped relations produce no Ranger audit events.\n\n### How was this patch tested?\n\n- New `DataSourceV2RelationTableExtractorSuite`:\n - default behavior preserved: the synthetic `table.name()` is still extracted verbatim when the conf is off;\n - the relation is skipped when the conf is enabled;\n - relations carrying an identifier are unaffected even with the conf enabled (the database fallback from #6544 still applies).\n- Extended `AuthzConfigurationCheckerSuite`: `SET` on the new key throws `AccessControlException`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude Opus 4.8\n\nCloses #7557 from j1wonpark/fix/authz-skip-catalogless-v2relation.\n\nCloses #7230\n\n35693a4ab [Jiwon Park] [KYUUBI #7230][AUTHZ] Support skipping privilege check for DataSourceV2Relation without catalog and identifier\n\nAuthored-by: Jiwon Park \u003cjpark92@outlook.kr\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "f67edd6f9ea8177b7eb6c648bf196d44938d0c26", "tree": "35534dbe312e5eb3055fdf89b31aea8179c2de98", "parents": [ "78d2107ebe648574fd253996245129af8ab6b582" ], "author": { "name": "Jiwon Park", "email": "jpark92@outlook.kr", "time": "Mon Jul 20 14:23:02 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jul 20 14:23:02 2026 +0800" }, "message": "[KYUUBI #7576][AUTHZ] Fix data masking failure on a UNION-ALL view over a masked view\n\n### Why are the changes needed?\n\nClose #7576.\n\nReading a permanent view that UNION-ALLs a masked permanent view fails with `MISSING_ATTRIBUTES`, while reading the masked view directly works (#3581).\n\nBoth branches expand the masked view with identical output exprIds. After `RuleApplyDataMaskingStage0` marks both branches, `DeduplicateRelations` re-instances one branch, so that branch\u0027s `exprToMaskers()` ends up keyed on ids now owned by the other branch. `RuleApplyDataMaskingStage1` merges all marker maps into one `Map` (duplicate keys silently last-wins) and substitutes unconditionally, rewiring the outer view\u0027s schema compensation Project — above the Union — to attributes the Union never outputs. See #7576 for the full analysis.\n\nThis change scopes the Stage1 substitution: rewrite the children first, keep only the maskers the rewritten children actually expose (matched by exprId, since `SubqueryAlias` may requalify outputs), and merge the per-marker maps after that filtering. When a child is not resolved yet (a type-changing masker leaves Union branches incompatible until type coercion runs, and `Union.output` fails on them), the previous unfiltered substitution is kept. Branch-local substitution keeps working; the cross-branch leak is blocked at the Union boundary.\n\n### How was this patch tested?\n\nTwo tests added to `DataMaskingTestBase` (run by all data masking suites): a reproduction that failed with `MISSING_ATTRIBUTES` before this fix, and a control proving the same view shape resolves fine without a masking policy. A view-level type-preserving MASK policy is added to the fixture, since a type-changing mask dies earlier with `CANNOT_UP_CAST` and would hide the bug.\n\n```\nbuild/mvn test -pl extensions/spark/kyuubi-spark-authz -Dtest\u003dnone \\\n -DwildcardSuites\u003dorg.apache.kyuubi.plugin.spark.authz.ranger.datamasking.DataMaskingForHiveParquetSuite\n```\n\nAll five data masking suites pass, and the full kyuubi-spark-authz module is green (662 succeeded / 0 failed / 42 pre-existing skips).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-fable-5\n\nCloses #7577 from j1wonpark/fix/authz-datamasking-nested-view.\n\nCloses #7576\n\n96f6b8312 [Jiwon Park] [KYUUBI #7576][AUTHZ] Define the nested-view mask policy in PolicyJsonFileGenerator\n555a51901 [Jiwon Park] [KYUUBI #7576][AUTHZ] Fix data masking failure on a UNION-ALL view over a masked view\nb8d353611 [Jiwon Park] [KYUUBI #7576][AUTHZ] control: unmasked UNION-ALL view resolves — masking is the cause\n050f00b74 [Jiwon Park] [KYUUBI #7576][AUTHZ] repro: data masking breaks on UNION-ALL view nested over a masked view\n\nAuthored-by: Jiwon Park \u003cjpark92@outlook.kr\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "78d2107ebe648574fd253996245129af8ab6b582", "tree": "91120760c6167efe3dbbe7f8ce2584fccd86e5a9", "parents": [ "5fc51faf9ac7c6fc63d5ab3461ae69ba327abf1d" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Mon Jul 20 13:53:56 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jul 20 13:53:56 2026 +0800" }, "message": "[KYUUBI #7578] [K8S][HELM] Update default Kyuubi version to 1.12.0\n\n### Why are the changes needed?\nDefault Kyuubi version used in the Helm chart should be aligned with the latest release version.\n\n### How was this patch tested?\nRender the chart templates to ensure `1.12.0` version is used.\n```shell\nhelm template kyuubi charts/kyuubi\n```\nOutput (reduced)\n```yaml\n# Source: kyuubi/templates/kyuubi-statefulset.yaml\napiVersion: apps/v1\nkind: StatefulSet\nmetadata:\n name: kyuubi\n labels:\n ...\n app.kubernetes.io/version: \"1.12.0\"\nspec:\n template:\n ...\n spec:\n serviceAccountName: kyuubi\n containers:\n - name: kyuubi-server\n image: \"apache/kyuubi:1.12.0\"\n imagePullPolicy: IfNotPresent\n ...\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7578 from dnskr/helm-default-kyuubi-version-1.12.0.\n\nCloses #7578\n\n2737d8185 [Denis Krivenko] [K8S][HELM] Update default Kyuubi version to 1.12.0\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "5fc51faf9ac7c6fc63d5ab3461ae69ba327abf1d", "tree": "ffb21b7eea945e34c7335178c035b66a1202911b", "parents": [ "7066271318b2a1d81e4a3e7b7c89f622b14107ad" ], "author": { "name": "Hiroki Egawa", "email": "hiegawa@lycorp.co.jp", "time": "Mon Jul 20 13:47:18 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jul 20 13:47:18 2026 +0800" }, "message": "[KYUUBI #7387] Replace serverOnly with audience and immutable on ConfigEntry\n\nThis implementation is based on the following suggestion.\n- https://github.com/apache/kyuubi/pull/7451#issuecomment-4587409731\n\n### Why are the changes needed?\n\n`ConfigEntry.serverOnly` conflated two concerns, \"don\u0027t send to engines\" and \"users can\u0027t override\", by stripping entries from the config in `getUserDefaults()`.\nThis caused `kyuubi.server.redaction.regex` to be removed from the session config before `ProcBuilder.toString` could use it for redacting sensitive values in engine command lines (#7387).\n\nAdditionally, `conf.getAll` sends all configs to every engine regardless of engine type, causing Flink-specific configs to be sent to Spark, Trino configs to Hive, etc.\n\nSplitting these concepts into audience and immutable provides the following benefits:\n- Server-side code to always see all config values (fixing redaction — Closes #7387)\n- Engine process builders to receive only audience-appropriate configs via `getEngineConf`\n\n---\n\n[redactCommandLineArgs](https://github.com/apache/kyuubi/blob/7066271318b2a1d81e4a3e7b7c89f622b14107ad/kyuubi-common/src/main/scala/org/apache/kyuubi/Utils.scala#L329-L348) previously only redacted `key\u003dvalue` arguments that followed a `--conf` marker.\nSince arguments like `-Dsome.secret\u003dvalue` are not preceded by `--conf`, they were not redacted even when matching `SERVER_SECRET_REDACTION_PATTERN`.\nThe `--conf` guard is removed so that all arguments containing `\u003d` are subject to redaction.\n\n### How was this patch tested?\n\nUnit tests.\n\n```shell\n$ ./build/mvn test -pl kyuubi-server -am -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.operation.KyuubiServerInfoProviderSuite\n$ ./build/mvn test -pl kyuubi-common -am -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.config,org.apache.kyuubi.session.SessionManagerValidationSuite\n$ ./build/mvn test -pl kyuubi-server -am -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.engine.dataagent.DataAgentProcessBuilderSuite,org.apache.kyuubi.engine.flink.FlinkProcessBuilderSuite,org.apache.kyuubi.engine.trino.TrinoProcessBuilderSuite,org.apache.kyuubi.engine.jdbc.JdbcYarnModeProcessBuilderSuite,org.apache.kyuubi.engine.jdbc.JdbcProcessBuilderSuite,org.apache.kyuubi.engine.hive.HiveProcessBuilderSuite,org.apache.kyuubi.engine.hive.HiveYarnModeProcessBuilderSuite,org.apache.kyuubi.engine.spark.SparkBatchProcessBuilderSuite,org.apache.kyuubi.engine.spark.SparkProcessBuilderSuite\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-6\n\nCloses #7451 from LamiumAmplexicaule/fix-redaction.\n\nCloses #7387\n\nb6ba20873 [Hiroki Egawa] Address review comments on `AGENTS.md` configuration section\ncbf70e153 [Hiroki Egawa] Set `audience(SERVER)` on `SERVER_INFO_PROVIDER`\n1099ba78b [Hiroki Egawa] Forward unregistered non-kyuubi configs to all engines for backward compatibility\n4bd82cf64 [Hiroki Egawa] Verify all `KyuubiReservedKeys` constants are in `reservedKeys`\n59f09d984 [Hiroki Egawa] Fix stale doc on `SERVER_ONLY_PREFIXES`\n9aec39313 [Hiroki Egawa] Set `audience(ANY)` on frontend thrift configs shared with engines\nf06bf5ffc [Hiroki Egawa] Replace serverOnly with audience and immutable on ConfigEntry\n\nAuthored-by: Hiroki Egawa \u003chiegawa@lycorp.co.jp\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "7066271318b2a1d81e4a3e7b7c89f622b14107ad", "tree": "f0080334fb1c3d083a538c388eb7666223a510e0", "parents": [ "dcc0f2f6939440bf81dd17ded92f4b70020d66f5" ], "author": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Fri Jul 17 22:33:07 2026 +0900" }, "committer": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Fri Jul 17 22:33:07 2026 +0900" }, "message": "[KYUUBI #7575] Improve access path validation\n\n### Why are the changes needed?\n\nNormalize config keys before access path validation\n\n### How was this patch tested?\n\nAdded unit tests\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted by: GPT-5.5\n\nCloses #7575 from aajisaka/fix-spark-access-path.\n\nCloses #7575\n\n9c1b47268 [Akira Ajisaka] Improve access path validation\n\nAuthored-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\nSigned-off-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\n" }, { "commit": "dcc0f2f6939440bf81dd17ded92f4b70020d66f5", "tree": "df92fcfb5f38e049aed7c74ef8b8e58cd68cec6e", "parents": [ "91bb98d66c8d4ef5849de0a57fe0386380671f24" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 23:28:34 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 23:28:34 2026 +0800" }, "message": "[RELEASE] Bump 1.13.0-SNAPSHOT\n" }, { "commit": "91bb98d66c8d4ef5849de0a57fe0386380671f24", "tree": "68aae7a77affc0e076ffa0ce973ca6160057fb9b", "parents": [ "9afb1d88927c9d3d3c6d25edd940bd5f0f75530e" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 23:25:32 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 23:25:32 2026 +0800" }, "message": "[KYUUBI #7570] Support Spark 4.2\n\n### Why are the changes needed?\n\nSpark 4.2.0 is released. This adds the `spark-4.2` profile and the `kyuubi-extension-spark-4-2` module, enabling Kyuubi to run on Spark 4.2.\n\n### What changes are proposed?\n\n- Add `spark-4.2` Maven profile with the `kyuubi-extension-spark-4-2` module. Lakehouse engines (Delta/Hudi/Paimon/Iceberg) fall back to 4.1 artifacts until native 4.2 support lands.\n- Adapt the engine UI and servlet adapter for Spark 4.2\u0027s Jetty 12 (ee10) / Servlet 6.0 upgrade.\n- Re-fork `KyuubiEnsureRequirements` and update `MaxScanStrategy` for Spark 4.2 physical plan API changes.\n- Add spark-4.2 CI matrix entries (`normal` + `verify-on-spark-4.2-binary`).\n\n### How was this patch tested?\n\nPass GHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: GLM 5.2\n\nCloses #7570 from pan3793/spark-4.2.\n\nCloses #7570\n\ncbc1dd22e [Cheng Pan] Fix stale spark-4.1 references in kyuubi-extension-spark-4-2\nedbdcbd19 [Cheng Pan] nit: style\n7eb2fec4e [Cheng Pan] Apply suggestions from code review\n562a43bb4 [Cheng Pan] Support Spark 4.2 CatalogTable constructor in HiveTableCatalog\n871db157f [Cheng Pan] Rename test helpers to avoid Spark 4.2 QueryTestBase conflicts\nf4c865d01 [Cheng Pan] Unwrap InvocationTargetException in setCurrentNamespace reflective call\nbc4174c18 [Cheng Pan] Fix setCurrentNamespace reflective call for Array[String] varargs\n750d5114a [Cheng Pan] Add spark-4.2 extension to release script\neaf4a5da9 [Cheng Pan] Sync kyuubi-extension-spark-4-2 pom.xml with 4-1 sibling\n20a405148 [Cheng Pan] Access CatalogManager reflectively for Spark 4.2 cross-version compat\nbe7c99412 [Cheng Pan] Reference SPARK JIRA tickets in Spark 4.x comments\ndfd3c1eef [Cheng Pan] Remove redundant ANSI disable in authz SparkSessionProvider\n9d0408307 [Cheng Pan] Accept DAGScheduler.cleanupQueryJobs NPE in engine crash test\n77f82e40b [Cheng Pan] Use Spark CurrentUserContext for session_user on Spark 4.0+\ne68244c95 [Cheng Pan] update docs\n71ea1e264 [Cheng Pan] Support Spark 4.2\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "9afb1d88927c9d3d3c6d25edd940bd5f0f75530e", "tree": "2a4aab196274f5cc8db44a4118a562d0211853f5", "parents": [ "4bd78d8d562554ca7364cbcb2112a18ccddfbdd9" ], "author": { "name": "ruanwenjun", "email": "wenjun@apache.org", "time": "Thu Jul 16 13:10:51 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 13:10:51 2026 +0800" }, "message": "[KYUUBI #7509] [SERVER] Add engine startup time metric\n\n### Why are the changes needed?\n\nKyuubi already exposes operation execution time metrics, but there is no server-side metric for how long a new engine takes to become available. This patch adds an engine startup time histogram so operators can observe successful engine startup latency, including waiting for startup permits, launching the engine, cluster scheduling, engine initialization, and discovery by the Kyuubi server.\n\n### How was this patch tested?\n\n- `git diff --check`\n- `build/mvn spotless:apply -pl kyuubi-metrics,kyuubi-server -DskipTests`\n- `build/mvn test -pl kyuubi-server -am -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.engine.EngineRefWithZookeeperSuite`\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: OpenAI Codex (GPT-5)\n\nCloses #7509 from ruanwenjun/kyuubi-engine-startup-time.\n\nCloses #7509\n\n6de83b863 [Cheng Pan] fmt\n34bf12be8 [ruanwenjun] Make engine startup metric test robust\n5472ca9cd [ruanwenjun] [SERVER] Add engine startup time metric\n\nLead-authored-by: ruanwenjun \u003cwenjun@apache.org\u003e\nCo-authored-by: Cheng Pan \u003cpan3793@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "4bd78d8d562554ca7364cbcb2112a18ccddfbdd9", "tree": "baebbfaacff6303216edc1d1d9c249a18c64979b", "parents": [ "794ebc520027032ea5694ea5196cb8c58ff94e60" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Thu Jul 16 13:09:25 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 13:09:25 2026 +0800" }, "message": "[KYUUBI #7567] [SERVER] Improve Engine UI proxy 403 response\n\n### Why are the changes needed?\n\nThe Engine UI proxy currently falls back to Jetty\u0027s generic 403 page when proxying is disabled, the target host is not allowlisted, or the URL is invalid. The page does not tell users which Kyuubi settings need to be changed.\n\nThis patch keeps the existing 403 status and host validation, but returns an actionable Kyuubi-styled page that shows the target engine and the relevant proxy and host allowlist settings.\n\n### How was this patch tested?\n\n- `dev/reformat`\n- `build/mvn -pl kyuubi-server -am -Pspark-provided,hive-provided,flink-provided scalastyle:check`\n- `build/mvn test -pl kyuubi-server -am -rf :kyuubi-server_2.12 -Pspark-provided,hive-provided,flink-provided -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.server.api.EngineUIProxyServletSuite`\n- Compared the previous and updated 403 responses through real Jetty servlets in a browser.\n\n### Visual comparison\n\nBefore:\n\n![Jetty default 403 response](https://raw.githubusercontent.com/wangzhigang1999/kyuubi/zhigang/pr-7567-assets/pr-assets/7567/before.png)\n\nAfter:\n\n![Actionable Kyuubi Engine UI 403 response](https://raw.githubusercontent.com/wangzhigang1999/kyuubi/zhigang/pr-7567-assets/pr-assets/7567/after.png)\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Codex with GPT-5\n\nCloses #7567 from wangzhigang1999/zhigang/engine-ui-403-page.\n\nCloses #7567\n\nebe253f55 [wangzhigang] [KYUUBI] Improve Engine UI proxy 403 response\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "794ebc520027032ea5694ea5196cb8c58ff94e60", "tree": "5524c01deb6800e7f71daf6e51a180a958685a76", "parents": [ "8fe59c57b5668eba5db9579c0752919b61866bfb" ], "author": { "name": "lifumao", "email": "lifumao@tencent.com", "time": "Thu Jul 16 13:07:55 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 13:07:55 2026 +0800" }, "message": "[KYUUBI #7574] Fix typo in kyuubi-extension-spark-jdbc-dialect pom.xml\n\n### Why are the changes needed?\n\nFixed https://github.com/apache/kyuubi/issues/7574. There is a typo in extensions/spark/kyuubi-extension-spark-jdbc-dialect/pom.xml:\n```\n\u003coutputDirectory\u003etarget/scala-${scala.binary.verison}/classes\u003c/outputDirectory\u003e\n\u003ctestOutputDirectory\u003etarget/scala-${scala.binary.verison}/test-classes\u003c/testOutputDirectory\u003e\n```\nThe property name `scala.binary.verison` is misspelled (should be `scala.binary.version`). Because Maven cannot resolve the misspelled property, the placeholder is not substituted, and the build outputs are written to a directory literally named target/scala-${scala.binary.verison}/ instead of the expected target/scala-2.12/ or target/scala-2.13/.\n\n### How was this patch tested?\n\nPass GHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #7573 from maomaodev/kyuubi_build.\n\nCloses #7574\n\na31d7acf5 [lifumao] Fix typo in kyuubi-extension-spark-jdbc-dialect pom.xml\n\nAuthored-by: lifumao \u003clifumao@tencent.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "8fe59c57b5668eba5db9579c0752919b61866bfb", "tree": "e8bf21926d373042db7f1dfd7a65c89eeb082b23", "parents": [ "6a68db38e6bcedf0dda91dc3d9344b61ae93c2f2" ], "author": { "name": "Jiwon Park", "email": "jpark92@outlook.kr", "time": "Thu Jul 16 13:05:50 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Thu Jul 16 13:05:50 2026 +0800" }, "message": "[KYUUBI #7568][AUTHZ] Eliminate TypeOfPlaceHolder across the whole plan\n\n### Why are the changes needed?\n\nFixes #7568.\n\n`RuleApplyTypeOfMarker` marks every `TypeOf` in the whole plan (`transformAllExpressions`), but since #5997 `RuleEliminateTypeOf` reverts them with `transformExpressionsUp`, which only visits the root node\u0027s expressions. A `TypeOfPlaceHolder` below the root — under `Sort`, `Union`, `Aggregate`, or a subquery — survives into execution and fails with `CLASS_NOT_OVERRIDE_EXPECTED_METHOD`, since it implements `doGenCode` but no `eval`.\n\nThis change uses `transformAllExpressions` on the eliminating side as well, so both rules cover the same scope in a single pass.\n\nAffects 1.9.0 onwards, including master.\n\n### How was this patch tested?\n\nAdded a test to `RangerSparkExtensionSuite` covering the root shapes the existing `Project`-root-only test misses: `Sort`, `Union`, `Aggregate`, and a subquery. It fails on master and passes with this change. Full `extensions/spark/kyuubi-spark-authz` suite: 657 passed, 0 failed.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-8\n\nCloses #7569 from j1wonpark/fix/authz-eliminate-typeof-whole-plan.\n\nCloses #7568\n\n38464f17f [Jiwon Park] Sort collected rows in the UNION ALL case to avoid order dependency while keeping Union as the root node\n9ffea2de0 [Jiwon Park] [KYUUBI #7568][AUTHZ] Eliminate TypeOfPlaceHolder across the whole plan\n\nAuthored-by: Jiwon Park \u003cjpark92@outlook.kr\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "6a68db38e6bcedf0dda91dc3d9344b61ae93c2f2", "tree": "fc6366528e263f69875d2eba8ac6a4c63c173796", "parents": [ "99bed388587c57c4d181d8833974db6668669548" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed Jul 15 14:04:54 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed Jul 15 14:04:54 2026 +0800" }, "message": "[KYUUBI #7571] [INFRA] Redirect build/mvn fallback message to stderr to avoid corrupting captures\n\n### Why are the changes needed?\n\nFor example, the Spark version was wrongly captured as `Falling back to archive.apache.org to download Maven`\n\nhttps://github.com/apache/kyuubi/actions/runs/29387027103/job/87262361668?pr\u003d7570\n\n### How was this patch tested?\n\nMerge then monitor CI.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #7571 from pan3793/mvn-echo.\n\nCloses #7571\n\n83b48e1fd [Cheng Pan] [INFRA] Redirect build/mvn fallback message to stderr to avoid corrupting captures\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "99bed388587c57c4d181d8833974db6668669548", "tree": "e3939624c10bdf7ead614f03fd5e7dd7f1f880c2", "parents": [ "445a906c2b41a04cbf512d01b5c6f02583821a7e" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 14 13:52:17 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 14 13:52:17 2026 +0800" }, "message": "[KYUUBI #7564] [INFRA] Bump GHA workflows to latest action versions\n\n### Why are the changes needed?\n\nTo keep our CI on the latest GitHub Actions versions, per the [apache/infrastructure-actions allowlist](https://github.com/apache/infrastructure-actions/blob/main/actions.yml).\n\n- For the GitHub-maintained actions (`actions/*`, `github/*`) and allowlisted `*` actions, the allowlist permits any version, so this PR tracks the latest **major** version tags (`vN`) rather than specific patches.\n- For hash-pinned allowlisted third-party actions, the convention is to pin to the allowlisted commit hash with a `# vX.Y.Z` comment. The Docker actions used here were already at the latest allowlisted hashes, so they are unchanged.\n\nChanges (patch tag -\u003e latest major):\n\n- `actions/checkout` `v7.0.0` -\u003e `v7`\n- `actions/setup-java` `v5.4.0` -\u003e `v5`\n- `actions/setup-python` `v6.3.0` -\u003e `v6`\n- `actions/cache` `v6.1.0` -\u003e `v6` (and `v4` -\u003e `v6` in `.github/actions/setup-maven/action.yaml`)\n- `actions/stale` `v10.3.0` -\u003e `v10`\n\n### How was this patch tested?\n\nYAML-only change; no unit tests apply. Verified by:\n\n- Cross-checked each action\u0027s target against the ASF allowlist and the latest release tag on GitHub.\n- Ran `./dev/reformat` (no source changes; Spotless does not manage YAML).\n- The `ASF Allowlist Check` workflow in this repo enforces the allowlist on this PR.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: codemaker with glm-5.2\n\nCloses #7564 from pan3793/gha-bump-actions.\n\nCloses #7564\n\nd5a81d7f8 [Cheng Pan] [INFRA] Bump GHA workflows to latest action versions\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "445a906c2b41a04cbf512d01b5c6f02583821a7e", "tree": "992320a236f783239be1f55d1170afd59136b8d6", "parents": [ "00ba4e65d2fe30ce09620a20ebef8ff2e99e6ac8" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 14 10:21:52 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jul 14 10:21:52 2026 +0800" }, "message": "[KYUUBI #7561] [INFRA] Cache CI engine archives per URL with a reusable action\n\n### Why are the changes needed?\n\nThe old `cache-engine-archives` cache is one blob under a constant key, so bumping any\nengine invalidates all of them. This provisions engines explicitly instead:\n\n- New reusable action `.github/actions/download-archive` downloads a tarball and caches it\n with `actions/cache` **keyed by the URL** (atomic download), so each engine caches\n independently and stable versions restore instantly.\n- `.github/scripts/resolve-engine-archive-urls.sh` derives each URL from the Maven\n properties (honoring the build\u0027s profiles/`-D` overrides); `expose-engine-homes.sh`\n publishes `SPARK_HOME`/`HIVE_HOME`/`FLINK_HOME` from `/opt`.\n- Every `master.yml` job now resolves → downloads → exposes only the engines it needs, and\n the build runs with `-P{spark,flink,hive}-provided`. The now-orphaned\n `cache-engine-archives` action is removed.\n- Flink test helpers now honor `FLINK_HOME` first (fallback to the download dir for local\n runs), matching Spark/Hive.\n- Spark extension modules gain a `spark-home-from-archive` profile, auto-activated only when\n `SPARK_HOME` is unset, so the Standalone-cluster tests use the downloaded archive locally\n but a provided `SPARK_HOME` is no longer overridden.\n- The `hive-it` avatica/CALCITE-1224 hack is now a single `zip -d`.\n\n### How was this patch tested?\n\nRun by this PR\u0027s CI.\n\nLocally checked: URL resolution across all matrix cases (Scala 2.13, Spark/Flink/Hive\nversion overrides, CDH6 empty-query), `*_HOME` resolution, the `closer.lua` redirect for\n`curl -fSL`, the `zip -d` patch on a mock jar, and the extension `SPARK_HOME` profile via\nthe effective POM (inherits the env when set, falls back to the archive otherwise).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude Opus 4.8\n\nCloses #7561 from pan3793/gha-dl.\n\nCloses #7561\n\n1f9ad04dc [Cheng Pan] [INFRA] Restore SPARK_SCALA_VERSION for Spark extension local-cluster tests\n20a94b22f [Cheng Pan] [INFRA] Bump actions/cache to v6 in download-archive action\na5c4208f0 [Cheng Pan] fix spark extension standalone tests\n0010f4e4c [Cheng Pan] [INFRA] Remove orphaned cache-engine-archives action\nda90a49d2 [Cheng Pan] nit\n13948d3d3 [Cheng Pan] [INFRA] Cache CI engine archives per URL with a reusable action\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "00ba4e65d2fe30ce09620a20ebef8ff2e99e6ac8", "tree": "1a8707e55c52299beb31147bc61dde83ff99a53a", "parents": [ "0783f075d7d05b7da0faaaa29282711640242bab" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jul 13 17:42:26 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jul 13 17:42:26 2026 +0800" }, "message": "[KYUUBI #7562] [INFRA] Remove gluten integration test module\n\n### Why are the changes needed?\n\nThis removes the kyuubi-gluten-it module, the gluten-it Maven profile, the CI workflow, and the GlutenSuiteMixin test utility.\n\nGluten IT is not maintained well, let\u0027s just remove it.\n\n### How was this patch tested?\n\nPass GHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: GLM 5.2\n\nCloses #7562 from pan3793/remove-gluten-it.\n\nCloses #7562\n\n45918d4c7 [Cheng Pan] [INFRA] Remove gluten integration test module\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "0783f075d7d05b7da0faaaa29282711640242bab", "tree": "1d394cb1f2e2b0017fb1043ce293b9fdfdb8349b", "parents": [ "84d74d9d9980ea2ac1fa9d9892d3235595534d11" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 23:05:17 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 23:05:17 2026 +0800" }, "message": "[KYUUBI #7554] Bump Log4j 2.26.1\n\n### Why are the changes needed?\n\nLog4j 2.26.1 Release notes (released 02 Jul 2026, patch on 2.26.0):\n\nhttps://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1\n\nNotable fixes in 2.26.1:\n- `RollingFileAppender` `createOnDemand` deferral;\n- non-finite number handling in MapMessage→JSON;\n- MSGID/SD-ID encoding in StructuredDataMessage→XML;\n- stack-trace rendering for exceptions with colliding `equals()`/`hashCode()`;\n- resource leaks in `ConfigurationSource` on failed URL config load;\n- `KafkaAppender` spurious error after successful retry;\n- plus improved `LinkageError` logging around LMAX Disruptor.\n\n### How was this patch tested?\n\nGHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: GLM 5.2\n\nCloses #7554 from pan3793/bump-log4j-2.26.1.\n\nCloses #7554\n\nb12910f65 [Cheng Pan] [KYUUBI] Bump Log4j 2.26.1\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "84d74d9d9980ea2ac1fa9d9892d3235595534d11", "tree": "7e4d42da8079cb2a069231047dfb970e0b236cbe", "parents": [ "e532738a29322280f902268d8c97731183995178" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 23:04:16 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 23:04:16 2026 +0800" }, "message": "[KYUUBI #7553] Bump Flink 1.20.5\n\n### Why are the changes needed?\n\nAs title.\n\n### How was this patch tested?\n\nPass GHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: GLM 5.2\n\nCloses #7553 from pan3793/bump-flink-1.20.5.\n\nCloses #7553\n\nd15dce68f [Cheng Pan] [KYUUBI] Bump Flink 1.20.5\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "e532738a29322280f902268d8c97731183995178", "tree": "4e8c7b98c9d40593f7a9971fa7c60b854f8bff25", "parents": [ "0c6f752754e600b4eb1f715c5b1dee05c22825f4" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 23:03:35 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 23:03:35 2026 +0800" }, "message": "[KYUUBI #7552] Authz supports Spark 4.0 and 4.1\n\n### Why are the changes needed?\n\n`kyuubi-spark-authz` does not support Spark 4.0/4.1. Several Spark 4.0+ changes break authorization, row-filtering, and data masking. This PR fixes all known issues and enables CI for Spark 4.0/4.1.\n\n### What changes are proposed?\n\n**Authz fixes:**\n- `AlterColumns` spec for SPARK-43995 (`AlterColumn`→`AlterColumns` rename in Spark 4.0)\n- Unwrap `CommandResult` to authorize CALL procedures (Spark 4.0 eager execution)\n- Match `ShowNamespacesCommand` for SHOW DATABASES row-filtering (Spark 4.1 nodeName change)\n- Clear leaked `KYUUBI_AUTHZ_TAG` from cached catalog nodes (Spark 4.0 `LogicalRelation` reuse)\n\n**Test adaptations:**\n- Disable ANSI mode in data masking tests (SPARK-44444 enables ANSI by default; `AnsiStringPromotionTypeCoercion` casts masked strings to bigint → `CAST_INVALID_INPUT`)\n- `HoodieCatalogTableTableExtractor` fallback for Hudi 1.2.0 `DeleteHoodieTableCommand.dft`→`query` rename\n- Paimon suite: `isSupportedVersion \u003d isScalaV212 || isSparkV40OrGreater`, alter non-PK column, handle `LocalDateTime`\n\n**Dependency upgrades:**\n- Delta 4.3.1 with Spark-version-specific artifacts (`delta-spark_4.0_2.13` / `delta-spark_4.1_2.13`)\n- Hudi 1.1.1 (Spark 3.x, Java 8) / 1.2.0 (Spark 4.x)\n- Paimon 1.4.2 for Spark 4.0; keep 0.8.2 for Spark 3.x (1.4.x has known Spark 3.3 issues)\n- Enable Iceberg, Delta, Hudi tests for Spark 4.0/4.1, Paimon for Spark 4.0\n\n### How was this patch tested?\n\nAll existing authz tests pass across Spark 3.3/3.4/3.5 (Scala 2.12) and Spark 4.0/4.1 (Scala 2.13).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: codemaker with glm-5.2\n\nCloses #7552 from pan3793/authz-spark-4.1-v2.\n\nCloses #7552\n\nc4f990276 [Cheng Pan] style\n5c5df395b [Cheng Pan] mv to injectPostHocResolutionRule\n76b41b98d [Cheng Pan] Update authz README for Supported Apache Spark Versions\n76e6873f5 [Cheng Pan] mention hudi 1.1 is the latest version that support Java 8\n0530e9d64 [Cheng Pan] [AUTHZ] Fix Paimon Changing Column Type test to use real type change\nf10efc7b6 [Cheng Pan] fix\n7d2e9bd04 [Cheng Pan] tune paimon and hudi version\n94f0343ef [Cheng Pan] enable authz ci for spark 4.0 and 4.1\n411a2220b [Cheng Pan] [AUTHZ] Bump Paimon 1.4.2 and enable Paimon tests for Spark 4.0\n38cd0df01 [Cheng Pan] [AUTHZ] Bump Hudi 1.2.0 and enable Hudi tests for Spark 4.0/4.1\n7bd778496 [Cheng Pan] enable delta lake tests for spark 4.1\n28198f944 [Cheng Pan] Bump Delta Lake 4.3.0\nb13cee1e3 [Cheng Pan] enable iceberg test for spark 4.1\n8ea58653f [Cheng Pan] [AUTHZ] Adapt tests for Spark 4.0 behavior changes\n939da7e4d [Cheng Pan] [AUTHZ] Clear leaked authz tags to fix permanent-view column deny on Spark 4.0\nb3e0232bb [Cheng Pan] [AUTHZ] Fix SHOW DATABASES row-filtering on Spark 4.1\ndb1932197 [Cheng Pan] [AUTHZ] Authorize CALL procedures on Spark 4.0 via CommandResult unwrap\nf7bccd7a0 [Cheng Pan] [AUTHZ] Add AlterColumns spec for Spark 4.0 ALTER COLUMN rename\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "0c6f752754e600b4eb1f715c5b1dee05c22825f4", "tree": "4d0007d10208650d8767b1821a345612fec9828e", "parents": [ "4b740c509def9252139d60472f6e3e28b99701f7" ], "author": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Fri Jul 10 16:42:13 2026 +0800" }, "committer": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Fri Jul 10 16:42:13 2026 +0800" }, "message": "[KYUUBI #7551] [Spark] Optimize InferRebalanceAndSortOrders to support skip non-cheap keys and local sort\n\n### Why are the changes needed?\n\nThe `InferRebalanceAndSortOrders` optimization infers rebalance partitioning\nand sort columns from the original query (e.g. join keys) to improve the\ncompression ratio before writing. In practice this can regress performance in\ntwo cases:\n\n1. **Expensive inferred columns.** When the inferred rebalance/sort keys are\n non-trivial expressions, evaluating them during the extra shuffle and local\n sort adds CPU cost that can outweigh the compression benefit.\n2. **Unwanted local sort.** Some workloads only want the file-layout benefit\n from rebalance and do not want the additional local `Sort` before writing.\n\nThis PR makes the inference tunable so users can opt out of expensive-column\ninference and skip the sort while keeping the rebalance.\n\nTwo new configs are added (default behavior is unchanged except that inference\nnow restricts to cheap columns by default):\n\n| Config | Default | Description |\n|---|---|---|\n| `spark.sql.optimizer.inferRebalanceAndSortOrdersWithCheapColumns.enabled` | `true` | Only infer rebalance/sort columns when all inferred columns are cheap expressions (attributes, foldable values, or field extractions over cheap expressions). |\n| `spark.sql.optimizer.skipInferRebalanceAndSortOrders.enabled` | `false` | Only infer the rebalance partition columns and skip inferring the sort orders. |\n\nBoth configs only take effect when\n`spark.sql.optimizer.inferRebalanceAndSortOrders.enabled` is `true`.\n\nImplementation notes:\n\n- `InferRebalanceAndSortOrders.infer` gains an `onlyInferWithCheapColumns`\n parameter. A new `isCheap` helper classifies an expression as cheap when it is\n an `Attribute` / `OuterReference` / `BoundReference`, foldable, or an `Alias` /\n `ExtractValue` whose children are all cheap. When the flag is set and any\n inferred column is not cheap, inference returns `None` and the rule falls back\n to a plain rebalance.\n- `RebalanceBeforeWritingBase.buildRebalance` reads the two new configs and\n skips the local `Sort` when `skipInferRebalanceAndSortOrders.enabled` is on.\n- The change is applied consistently across the Spark `4.1`, `4.0`, and `3.5`\n extension modules, and the rule docs table is updated.\n\n### How was this patch tested?\n\n- Added `Skip inferring sort orders` — end-to-end check that enabling\n `skipInferRebalanceAndSortOrders.enabled` drops the inferred local `Sort`\n while keeping the `RebalancePartitions`.\n- Added `Infer rebalance and sort orders only with cheap columns` — unit-level\n check on `InferRebalanceAndSortOrders.infer`: expensive join keys\n (`col1 + 1`) are not inferred when the cheap-column restriction is on and are\n inferred when it is off; cheap attribute keys are inferred regardless.\n- Tests added to the `RebalanceBeforeWritingSuite` of all three modules.\n\nRan locally (all green):\n\n```\nbuild/mvn -Pspark-4.1 -Pscala-2.13 test -pl extensions/spark/kyuubi-extension-spark-4-1 -am\n -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.spark.sql.RebalanceBeforeWritingSuite # 12/12\nbuild/mvn -Pspark-4.0 -Pscala-2.13 test -pl extensions/spark/kyuubi-extension-spark-4-0 -am\n -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.spark.sql.RebalanceBeforeWritingSuite # 12/12\nbuild/mvn -Pspark-3.5 test -pl extensions/spark/kyuubi-extension-spark-3-5 -am\n -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.spark.sql.RebalanceBeforeWritingSuite # 14/14\n```\n\n`dev/reformat` run; no style changes required.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nYes.\n\nAssisted-by: Claude Opus 4.8\n\nCloses #7551 from ulysses-you/infer.\n\nCloses #7551\n\n0b6003bef [Xiduo You] comment\n54320bcdd [Xiduo You] Optimize InferRebalanceAndSortOrders to support skip non-cheap keys and local sort\n\nAuthored-by: Xiduo You \u003culyssesyou@apache.org\u003e\nSigned-off-by: Xiduo You \u003culyssesyou@apache.org\u003e\n" }, { "commit": "4b740c509def9252139d60472f6e3e28b99701f7", "tree": "06f92ba91c86d4e6a002700362fa0bc63a0f06b4", "parents": [ "32b06b78950501cf36f39c2b289b5b4a4e1c3876" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 10 15:28:57 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 15:28:57 2026 +0800" }, "message": "[KYUUBI #7548] Bump docker/setup-buildx-action from 4.1.0 to 4.2.0\n\n[//]: # (dependabot-start)\n⚠️ **Dependabot is rebasing this PR** ⚠️\n\nRebasing might not happen immediately, so don\u0027t worry if this takes some time.\n\nNote: if you make any changes to this PR yourself, they will take precedence over the rebase.\n\n---\n\n[//]: # (dependabot-end)\n\nBumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve names in esbuild bundle by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/572\"\u003edocker/setup-buildx-action#572\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/551\"\u003edocker/setup-buildx-action#551\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.90.0 to 0.92.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/557\"\u003edocker/setup-buildx-action#557\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/580\"\u003edocker/setup-buildx-action#580\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​sigstore/core\u003c/code\u003e from 3.1.0 to 3.2.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/573\"\u003edocker/setup-buildx-action#573\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​sigstore/verify\u003c/code\u003e from 3.1.0 to 3.1.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/576\"\u003edocker/setup-buildx-action#576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.1 to 5.2.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/562\"\u003edocker/setup-buildx-action#562\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump sigstore from 4.1.0 to 4.1.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/577\"\u003edocker/setup-buildx-action#577\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.5 to 0.2.7 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/556\"\u003edocker/setup-buildx-action#556\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.25.0 to 6.27.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/570\"\u003edocker/setup-buildx-action#570\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.2 to 7.3.6 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/569\"\u003edocker/setup-buildx-action#569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v4.1.0...v4.2.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c\"\u003e\u003ccode\u003ebb05f3f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/580\"\u003e#580\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/321c814cb51fbe4af8eca00249525cc0973ea66f\"\u003e\u003ccode\u003e321c814\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/b9a36ef79ba42cfc611885a1e8c388fbf8b8cb3f\"\u003e\u003ccode\u003eb9a36ef\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.91.0 to 0.92.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/ebeab241289497cd564ac98b3cfc9e64607bb276\"\u003e\u003ccode\u003eebeab24\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/570\"\u003e#570\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.27.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/5c7b8ae78cec97a3215d4d86679b1d072eaa80cb\"\u003e\u003ccode\u003e5c7b8ae\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/037e618cd98e95e81525b15ff0e9c96f507e6a0e\"\u003e\u003ccode\u003e037e618\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.25.0 to 6.27.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/66080e5802281ec2e72b7f3108915643e702db85\"\u003e\u003ccode\u003e66080e5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/577\"\u003e#577\u003c/a\u003e from docker/dependabot/npm_and_yarn/sigstore-4.1.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/409aef0aa3f48f0a742e7dec4e0e04ab19afe93c\"\u003e\u003ccode\u003e409aef0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/562\"\u003e#562\u003c/a\u003e from docker/dependabot/npm_and_yarn/js-yaml-4.2.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/49c6e42949280fa0d70fb327633591be54efbfb6\"\u003e\u003ccode\u003e49c6e42\u003c/code\u003e\u003c/a\u003e build(deps): bump sigstore from 4.1.0 to 4.1.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/2211273e8121ecf9ecb7d6c7c0fcd55526d530c7\"\u003e\u003ccode\u003e2211273\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/setup-buildx-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4.1.0\u0026new-version\u003d4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7548 from dependabot[bot]/dependabot/github_actions/docker/setup-buildx-action-4.2.0.\n\nCloses #7548\n\n217a88e1f [dependabot[bot]] Bump docker/setup-buildx-action from 4.1.0 to 4.2.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "32b06b78950501cf36f39c2b289b5b4a4e1c3876", "tree": "a5132da8edc58581c52a71a41394392a9ce420da", "parents": [ "8a144c96dd70c78daa311947aac23fd8df6e736a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 10 15:27:51 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 15:27:51 2026 +0800" }, "message": "[KYUUBI #7547] Bump docker/build-push-action from 7.2.0 to 7.3.0\n\nBumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.2.0 to 7.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/build-push-action/releases\"\u003edocker/build-push-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve names in esbuild bundle by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1567\"\u003edocker/build-push-action#1567\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.90.0 to 0.92.0 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1545\"\u003edocker/build-push-action#1545\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1572\"\u003edocker/build-push-action#1572\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​sigstore/core\u003c/code\u003e from 3.1.0 to 3.2.1 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1568\"\u003edocker/build-push-action#1568\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.1 to 4.3.0 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1566\"\u003edocker/build-push-action#1566\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.5 to 0.2.7 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1547\"\u003edocker/build-push-action#1547\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.24.1 to 6.27.0 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1564\"\u003edocker/build-push-action#1564\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.2 to 7.3.6 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1563\"\u003edocker/build-push-action#1563\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/build-push-action/compare/v7.2.0...v7.3.0\"\u003ehttps://github.com/docker/build-push-action/compare/v7.2.0...v7.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a\"\u003e\u003ccode\u003e53b7df9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1572\"\u003e#1572\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-t...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/154298c1ca89be1c0e019084f0611ddca621aafc\"\u003e\u003ccode\u003e154298c\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/cb1238b9c9eb453d106b4e4142a5bd9cde710040\"\u003e\u003ccode\u003ecb1238b\u003c/code\u003e\u003c/a\u003e chore(deps): Bump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.91.0 to 0.92.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/24f845d5cbe75d2d350a984fd0e18cb7a3f29c1c\"\u003e\u003ccode\u003e24f845d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1566\"\u003e#1566\u003c/a\u003e from docker/dependabot/npm_and_yarn/js-yaml-4.2.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/9c6973007b52c322651c38915d5e8824cea95c50\"\u003e\u003ccode\u003e9c69730\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/bc3a3a5f72a6dca16c2c2468d1dfc55ee66d2193\"\u003e\u003ccode\u003ebc3a3a5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1574\"\u003e#1574\u003c/a\u003e from docker/dependabot/github_actions/aws-actions/co...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/a82c504a2387bb8bedc50072f9c554ae2a7dab5d\"\u003e\u003ccode\u003ea82c504\u003c/code\u003e\u003c/a\u003e chore(deps): Bump js-yaml from 4.1.1 to 4.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/0285a75190c039d6dac52b7711abcef3f5d8f6f6\"\u003e\u003ccode\u003e0285a75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1573\"\u003e#1573\u003c/a\u003e from docker/dependabot/github_actions/actions/cache-...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/c6ad2a3f9644680619de938b97c8a10a87b2a88d\"\u003e\u003ccode\u003ec6ad2a3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1575\"\u003e#1575\u003c/a\u003e from docker/dependabot/github_actions/actions/checko...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/d37484fb9737c5442a257e2f0ae5a8d756ed7d92\"\u003e\u003ccode\u003ed37484f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1564\"\u003e#1564\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.27.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/build-push-action/compare/f9f3042f7e2789586610d6e8b85c8f03e5195baf...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/build-push-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d7.2.0\u0026new-version\u003d7.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7547 from dependabot[bot]/dependabot/github_actions/docker/build-push-action-7.3.0.\n\nCloses #7547\n\ndd51be3a2 [dependabot[bot]] Bump docker/build-push-action from 7.2.0 to 7.3.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "8a144c96dd70c78daa311947aac23fd8df6e736a", "tree": "fdd8f7dfa19dbb4f13f88c9ca3defa0899995746", "parents": [ "f6fbbd58e2a661f51d4192578b59767ff49681ca" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 10 15:26:47 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 15:26:47 2026 +0800" }, "message": "[KYUUBI #7546] Bump docker/setup-qemu-action from 4.1.0 to 4.2.0\n\nBumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.1.0 to 4.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/setup-qemu-action/releases\"\u003edocker/setup-qemu-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve names in esbuild bundle by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/311\"\u003edocker/setup-qemu-action#311\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/295\"\u003edocker/setup-qemu-action#295\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.91.0 to 0.92.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/315\"\u003edocker/setup-qemu-action#315\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​sigstore/core\u003c/code\u003e from 3.1.0 to 3.2.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/312\"\u003edocker/setup-qemu-action#312\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.1 to 4.2.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/310\"\u003edocker/setup-qemu-action#310\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.6 to 0.2.7 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/304\"\u003edocker/setup-qemu-action#304\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.26.0 to 6.27.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/308\"\u003edocker/setup-qemu-action#308\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.2 to 7.3.6 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/307\"\u003edocker/setup-qemu-action#307\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0\"\u003ehttps://github.com/docker/setup-qemu-action/compare/v4.1.0...v4.2.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/96fe6ef7f33517b61c61be40b68a1882f3264fb8\"\u003e\u003ccode\u003e96fe6ef\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/315\"\u003e#315\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/31f08d3fc9186dbe4b4550696f2e32e9aa7f9465\"\u003e\u003ccode\u003e31f08d3\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/4e7017a474d2cf3912bb0437f7fafec6d5fb6c52\"\u003e\u003ccode\u003e4e7017a\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.91.0 to 0.92.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/0eca235293ca1939b58c082f69bdc981ccce8c94\"\u003e\u003ccode\u003e0eca235\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/314\"\u003e#314\u003c/a\u003e from crazy-max/fix-yarn-preapprove-actions-toolkit\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/ea66a4130b037e7961e14a0e5b155836e797cced\"\u003e\u003ccode\u003eea66a41\u003c/code\u003e\u003c/a\u003e chore: allow actions-toolkit to bypass yarn age gate\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/451542b03ae7946b7082a398b11c8c315a0e4e80\"\u003e\u003ccode\u003e451542b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/308\"\u003e#308\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.27.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/532ae0057542ec2102e2d19e9feccf85f1f69013\"\u003e\u003ccode\u003e532ae00\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/b6f5af659afad3f9931b782668dee4595ae7e841\"\u003e\u003ccode\u003eb6f5af6\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.26.0 to 6.27.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/cf96b86294b57480ac6d330bd177fca87eac95bc\"\u003e\u003ccode\u003ecf96b86\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/304\"\u003e#304\u003c/a\u003e from docker/dependabot/npm_and_yarn/tmp-0.2.7\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/f0ba643f78dc96bc931fb83e5dadc39628e10047\"\u003e\u003ccode\u003ef0ba643\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/setup-qemu-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4.1.0\u0026new-version\u003d4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7546 from dependabot[bot]/dependabot/github_actions/docker/setup-qemu-action-4.2.0.\n\nCloses #7546\n\n321ea5a60 [dependabot[bot]] Bump docker/setup-qemu-action from 4.1.0 to 4.2.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "f6fbbd58e2a661f51d4192578b59767ff49681ca", "tree": "c29b9cd3af04fb76f10eb94c3602b6250f129763", "parents": [ "5a763c3f0da71fe5812cfdd7faa4de78bc7ae9d1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 10 15:25:32 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 15:25:32 2026 +0800" }, "message": "[KYUUBI #7545] Bump docker/login-action from 4.2.0 to 4.4.0\n\nBumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/login-action/releases\"\u003edocker/login-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.4.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip empty \u003ccode\u003eregistry-auth\u003c/code\u003e secret mask by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1035\"\u003edocker/login-action#1035\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1077.0 \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1034\"\u003edocker/login-action#1034\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/login-action/compare/v4.3.0...v4.4.0\"\u003ehttps://github.com/docker/login-action/compare/v4.3.0...v4.4.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve names in esbuild bundle by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1022\"\u003edocker/login-action#1022\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1076.0 \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/999\"\u003edocker/login-action#999\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1030\"\u003edocker/login-action#1030\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.90.0 to 0.92.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1004\"\u003edocker/login-action#1004\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1027\"\u003edocker/login-action#1027\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​sigstore/core\u003c/code\u003e from 3.1.0 to 3.2.1 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1023\"\u003edocker/login-action#1023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​sigstore/verify\u003c/code\u003e from 3.1.0 to 3.1.1 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1029\"\u003edocker/login-action#1029\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump http-proxy-agent and https-proxy-agent to 9.1.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1017\"\u003edocker/login-action#1017\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.1 to 5.2.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1028\"\u003edocker/login-action#1028\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump sigstore from 4.1.0 to 4.1.1 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1031\"\u003edocker/login-action#1031\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.5 to 0.2.7 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1002\"\u003edocker/login-action#1002\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.24.1 to 6.27.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1020\"\u003edocker/login-action#1020\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.3 to 7.3.6 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/1019\"\u003edocker/login-action#1019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/login-action/compare/v4.2.0...v4.3.0\"\u003ehttps://github.com/docker/login-action/compare/v4.2.0...v4.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0\"\u003e\u003ccode\u003eaf1e73f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/1034\"\u003e#1034\u003c/a\u003e from docker/dependabot/npm_and_yarn/aws-sdk-dependen...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b\"\u003e\u003ccode\u003eda722bd\u003c/code\u003e\u003c/a\u003e [dependabot skip] chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a\"\u003e\u003ccode\u003e2916ad6\u003c/code\u003e\u003c/a\u003e build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903\"\u003e\u003ccode\u003eca0a662\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/1035\"\u003e#1035\u003c/a\u003e from crazy-max/fix-registry-auth-empty-mask\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80\"\u003e\u003ccode\u003ec455755\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438\"\u003e\u003ccode\u003e4835190\u003c/code\u003e\u003c/a\u003e skip empty registry-auth secret mask\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004\"\u003e\u003ccode\u003e992421c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/1033\"\u003e#1033\u003c/a\u003e from docker/dependabot/github_actions/docker/bake-ac...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/b249b43765525dd7951068267a34cf63f22ab4f0\"\u003e\u003ccode\u003eb249b43\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/1032\"\u003e#1032\u003c/a\u003e from docker/dependabot/github_actions/docker/bake-ac...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/1b67977736863551a88ff218642a2d7628b10520\"\u003e\u003ccode\u003e1b67977\u003c/code\u003e\u003c/a\u003e build(deps): bump docker/bake-action from 7.2.0 to 7.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/9d49d6a3234c78daa10c3c12183ef7b6caa8e69e\"\u003e\u003ccode\u003e9d49d6a\u003c/code\u003e\u003c/a\u003e build(deps): bump docker/bake-action/subaction/matrix\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/login-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4.2.0\u0026new-version\u003d4.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7545 from dependabot[bot]/dependabot/github_actions/docker/login-action-4.4.0.\n\nCloses #7545\n\n8dded6e86 [dependabot[bot]] Bump docker/login-action from 4.2.0 to 4.4.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "5a763c3f0da71fe5812cfdd7faa4de78bc7ae9d1", "tree": "09202c6166ce65fc012e525eb080f48934376010", "parents": [ "fe81544f64a495e4092933a487e96e8f8936b49a" ], "author": { "name": "ruanwenjun", "email": "wenjun@apache.org", "time": "Fri Jul 10 15:24:20 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 15:24:20 2026 +0800" }, "message": "[KYUUBI #7527] [JDBC] Respect interrupt while waiting for engine launch\n\n### Why are the changes needed?\n\nJDBC clients can block inside `KyuubiConnection` construction while waiting for engine launch. If the caller cancels that connection attempt with `Thread.interrupt()`, the wait loop previously kept polling and the caller still had no returned `Connection` object to close.\n\nThis patch makes the launch wait path honor interruption by converting it to a typed JDBC exception, `KyuubiInterruptedException`. The interrupt status is intentionally consumed before the exception reaches the caller, and comments explain that the caller receives the typed exception while the current thread is not interrupted.\n\nThe patch also keeps `SQLException` subclasses intact when `KyuubiDataSource` creates a connection, so callers can distinguish the interrupted launch path.\n\n### How was this patch tested?\n\n- `./build/mvn -pl kyuubi-hive-jdbc -am spotless:apply`\n- `./build/mvn -pl kyuubi-hive-jdbc -am -Dtest\u003dKyuubiConnectionTest,KyuubiStatementTest,TestJdbcDriver,TestKyuubiPreparedStatement,UtilsTest,ZooKeeperHiveClientHelperTest -DwildcardSuites\u003dnone test`\n- `git diff --check`\n\nAlso attempted `dev/reformat`, but the full repo reformat is blocked in this local environment because Spotless expects `black 22.3.0` while the installed executable is `black 25.1.0`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: OpenAI Codex: GPT-5\n\nCloses #7527 from ruanwenjun/kyuubi-jdbc-interrupt-launch.\n\nCloses #7527\n\n6ff3e96ef [ruanwenjun] [JDBC] Use error SQLState for launch cancellation\n6795917ac [ruanwenjun] [JDBC] Reuse ExceptionUtils for interrupt cause checks\n5db1bad5d [ruanwenjun] [JDBC] Narrow launch interrupt cleanup handling\nb471c4653 [ruanwenjun] [JDBC] Simplify launch interrupt handling\n5f6a573b9 [ruanwenjun] [JDBC] Respect interrupt while waiting for engine launch\n\nAuthored-by: ruanwenjun \u003cwenjun@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "fe81544f64a495e4092933a487e96e8f8936b49a", "tree": "1c05ae50238b6ad0dbb8b2899d6c0a8096223187", "parents": [ "7535d1f28163626ebe9381ecc8d4605602a0b56e" ], "author": { "name": "Fei Wang", "email": "fwang12@ebay.com", "time": "Fri Jul 10 15:04:59 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri Jul 10 15:04:59 2026 +0800" }, "message": "[KYUUBI #7549] Fix Subject.getSubject() in Kyuubi JDBC driver for JDK 25 compatibility\n\n## Why are the changes needed?\n\nJDK 24 permanently disabled the Security Manager (JEP 486), making `AccessController.getContext()` throw `UnsupportedOperationException`. JDK 25 extended this to `Subject.getSubject()`. These APIs are called in the Kyuubi JDBC driver during Kerberos authentication, causing connections to fail:\n\n```\njava.lang.UnsupportedOperationException: getSubject is not supported\n at java.base/javax.security.auth.Subject.getSubject(Subject.java)\n```\n\nAdditionally, `Subject.doAs()` is deprecated for removal (JEP 411) and will break in a future JDK release.\n\nFixes #7549.\n\n## What changed\n\nAdded `SubjectUtil` to `kyuubi-hive-jdbc`, ported from Apache Hadoop (HADOOP-19212, HADOOP-19906). It bridges the deprecated/removed Security Manager APIs to their JDK 18+ replacements using `MethodHandle` lookups resolved once at class load time:\n\n- `Subject.getSubject(AccessController.getContext())` → `Subject.current()` (JDK 18+)\n- `Subject.doAs()` → `Subject.callAs()` (JDK 18+)\n- On JDK 22+, maintains an `InheritableThreadLocal\u003cSubject\u003e` to restore pre-JDK 22 Subject propagation into newly constructed threads (HADOOP-19906)\n- Falls back to the old APIs on JDK \u003c 18 transparently\n\nUpdated all affected callsites in the JDBC driver:\n\n| File | Change |\n|------|--------|\n| `KyuubiConnection.java` | `Subject.getSubject()` × 2 → `SubjectUtil.current()` |\n| `HttpAuthUtils.java` | `Subject.doAs()` → `SubjectUtil.doAs()` |\n| `TSubjectTransport.java` | `Subject.doAs()` → `SubjectUtil.doAs()` |\n\n## How was this patch tested?\n\nPorted `TestSubjectUtil` from Apache Hadoop, covering exception propagation semantics of `callAs()`, `doAs(PrivilegedAction)`, `doAs(PrivilegedExceptionAction)`, and `sneakyThrow()` across JDK versions. Full `kyuubi-hive-jdbc` unit suite (43 tests) passes.\n\n## Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-sonnet-4-6\n\nCloses #7550 from turboFei/jdk25.\n\nCloses #7549\n\n5baf2c974 [Fei Wang] refactor: move SubjectUtil to kyuubi-util; fix Javadoc and Kyuubi-managed comments\n17d810697 [Fei Wang] test: replace SubjectUtilTest with full Hadoop TestSubjectUtil port\nc01508255 [Fei Wang] fix: replace Subject.doAs() with SubjectUtil.doAs() in HttpAuthUtils and TSubjectTransport\n727aa53d5 [Fei Wang] feat: replace SubjectUtil with full Hadoop implementation for JDK 25\nfbfb88689 [Fei Wang] chore: remove docs/superpowers\n27a02e8b2 [Fei Wang] style: reformat after JDK 25 Subject fix\n492273c67 [Fei Wang] fix: replace Subject.getSubject() with SubjectUtil.current() for JDK 25 compat\n78ba2f172 [Fei Wang] feat: add SubjectUtil to bridge Subject.getSubject() for JDK 25\nfe909f976 [Fei Wang] docs: add JDK 25 Subject.getSubject fix implementation plan\n23864a37e [Fei Wang] docs: add JDK 25 Subject.getSubject fix design spec\n\nAuthored-by: Fei Wang \u003cfwang12@ebay.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "7535d1f28163626ebe9381ecc8d4605602a0b56e", "tree": "e335b5c8bcffea2d29191f88318069341d8b9d63", "parents": [ "016db7f3b05bd94e98da2ee112536ac0babbf464" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed Jul 08 10:24:55 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed Jul 08 10:24:55 2026 +0800" }, "message": "[KYUUBI #7544] Bump Iceberg 1.11.0\n\n### Why are the changes needed?\n\nBump Iceberg from 1.10.0 to 1.11.0.\n\nSpark 4.1 correctly pulls the iceberg-spark-runtime-4.1 jar now, but UTs are kept disabled until a dedicated fix.\n\n### How was this patch tested?\n\nPass GHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #7544 from pan3793/iceberg-1.11.0.\n\nCloses #7544\n\n4b11e0d88 [Cheng Pan] Merge branch \u0027master\u0027 into iceberg-1.11.0\n5ebabd511 [Cheng Pan] docker\nfba963cc5 [Cheng Pan] spark 4.1\nb9c56f82e [Cheng Pan] [KYUUBI] Bump Iceberg from 1.10.0 to 1.11.0\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "016db7f3b05bd94e98da2ee112536ac0babbf464", "tree": "a56ebe7751e044c1d52bfeb2c3559be37364f9ae", "parents": [ "ca6488012e1e8f4e248b4f50806d672eaff2507a" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed Jul 08 10:22:03 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed Jul 08 10:22:03 2026 +0800" }, "message": "[KYUUBI #7543] Bump Spark 3.5.8, 4.0.3, 4.1.2\n\n### Why are the changes needed?\n\nBump Spark to the latest patched versions.\n\n- Spark 3.5.7 to 3.5.8\n- Spark 4.0.1 to 4.0.3\n- Spark 4.1.1 to 4.1.2\n\n### How was this patch tested?\n\nPass GHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #7543 from pan3793/spark-upgrade.\n\nCloses #7543\n\n04b1f303c [Cheng Pan] [KYUUBI] Bump Spark versions\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "ca6488012e1e8f4e248b4f50806d672eaff2507a", "tree": "d51aa67dba948ae87ab07abd8b2c55ce3f467399", "parents": [ "6753fdfcb98d5bba9062020287b3064aced69b18" ], "author": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Tue Jul 07 13:54:39 2026 +0800" }, "committer": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Tue Jul 07 13:54:39 2026 +0800" }, "message": "[KYUUBI #7539] [Spark] Remove rebalance shuffle before writing at AQE time when not worthwhile\n\n## Why are the changes needed?\n\n`RebalanceBeforeWriting` injects a `RebalancePartitions` operator before writes (physically a\n`ShuffleExchangeExec` with `shuffleOrigin \u003d REBALANCE_PARTITIONS_BY_NONE`) to merge small files and\navoid the small-file problem. However, in some cases this rebalance shuffle is pure overhead: once\nthe upstream data is materialized and its real size is known, the shuffle brings no benefit and only\nadds an extra round of shuffle read/write.\n\nThis PR adds an AQE runtime optimizer rule `RemoveRebalanceShuffle` that, at AQE time (when the\nupstream query stage is materialized and real statistics are available), decides whether such a\nnot-worthwhile rebalance shuffle can be removed, saving one shuffle.\n\n## What changes were proposed in this pull request?\n\nA new rule `RemoveRebalanceShuffle`, injected into the `AQEOptimizer` via\n`injectRuntimeOptimizerRule`, runs on the **logical plan**: it replaces `RebalancePartitions` with\nits child, and the physical planner then re-plans without the shuffle.\n\n**Scope** — only the rebalance feeding the final write is considered: starting from `WriteFiles`,\nthe rule walks down through at most `Project` and local `Sort`; any other operator in between leaves\nthe rebalance untouched.\n\n**Removal conditions** (all must hold):\n\n1. `spark.sql.adaptive.removeRebalanceShuffle.enabled` is on;\n2. the `RebalancePartitions` has no partition expressions (i.e. `REBALANCE_PARTITIONS_BY_NONE`);\n3. its `optAdvisoryPartitionSize` is present and **larger than**\n `spark.sql.adaptive.advisoryPartitionSizeInBytes` (a smaller advisory size sugge\n intentionally wants finer partitions, so we respect that).\n\n**Size decision** — the rebalance input is split into groups of sub-plans whose leaves are all\nmaterialized `LogicalQueryStage` exchange stages (a `Union` yields one group per br\nmeasured by its runtime `sizeInBytes`. The shuffle is removed only when every group is removable,\nwhere a group is removable under either:\n\n- **Large data**: the input has no data-reducing operator and the group\u0027s represent\n `max(maxStageSize, groupSum / 2)` is larger than\n `spark.sql.shuffle.partitions * removeRebalanceShuffle.smallPartitionSize`; or\n- **Small data**: the input has no data-expanding operator and the representative size is smaller\n than `advisoryPartitionSizeInBytes * removeRebalanceShuffle.tolerableSmallFileNum\n\nOperator classification (logical operators):\n\n- reducing: `Aggregate` / `Filter` / `Sample` / `Offset` / `GlobalLimit` / `LocalLi\n `WindowGroupLimit` / `Inner` join / semi-anti join;\n- expanding: `Generate` / `Expand` / non-semi-anti `Join`.\n\n**New configs** (`KyuubiSQLConf`, version 1.12.0):\n\n| Config | Default |\n|---|---|\n| `spark.sql.adaptive.removeRebalanceShuffle.enabled` | `false` |\n| `spark.sql.adaptive.removeRebalanceShuffle.smallPartitionSize` | `96MB` |\n| `spark.sql.adaptive.removeRebalanceShuffle.tolerableSmallFileNum` | `5` |\n\nModules changed (identical across 3.5 / 4.0 / 4.1):\n\n- Add `RemoveRebalanceShuffle.scala` and `RemoveRebalanceShuffleSuite.scala`;\n- Add 3 configs in `KyuubiSQLConf.scala`;\n- Register the rule in `KyuubiSparkSQLExtension.scala`;\n- Document the feature and configs in `docs/extensions/engines/spark/rules.md`.\n\n## How was this patch tested?\n\nAdded `RemoveRebalanceShuffleSuite` (3.5 / 4.0 / 4.1), which asserts on the presence of\n`REBALANCE_PARTITIONS_BY_NONE` shuffle in the executed plan, covering:\n\n- semi join (reducing), small data → removed;\n- outer join (expanding, non-reducing), large data with tiny / huge `smallPartitionSize` → removed /\n kept respectively;\n- rebalance advisory size ≤ session advisory size → kept;\n- inner join (both reducing and expanding) → kept;\n- semi join with `tolerableSmallFileNum\u003d0` → kept;\n- switch off → kept.\n\nAll pass on Spark 3.5:\n\n```\nbuild/mvn -Pspark-3.5 -pl extensions/spark/kyuubi-extension-spark-3-5 -am test \\\n -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.spark.sql.RemoveRebalanceShuffleSuite\n```\n\nNo regression in `RebalanceBeforeWritingSuite`. Formatted with `spotless:apply` across all Spark\nprofiles.\n### Was this patch authored or co-authored using generative AI tooling?\n\nco-authored: Claude Opus 4.8\n\nCloses #7539 from ulysses-you/skipshuffle.\n\nCloses #7539\n\n9cacd4b3a [Xiduo You] style\n73e7c3faf [Xiduo You] InferRebalanceAndSortOrders\nc21e100a2 [Xiduo You] coalesce\n900bc9de1 [Xiduo You] docs\na74d9bc58 [Xiduo You] fix\n0c19d2338 [Xiduo You] test\n8c23eecbb [Xiduo You] Add RemoveRebalanceShuffle rule to remove unnecessary rebalance\n\nAuthored-by: Xiduo You \u003culyssesyou@apache.org\u003e\nSigned-off-by: Xiduo You \u003culyssesyou@apache.org\u003e\n" }, { "commit": "6753fdfcb98d5bba9062020287b3064aced69b18", "tree": "b808c6629bb135f69daef65dcdb39df54fadb626", "parents": [ "69e7167a946245afdf81c6f3996e07e319f39d69" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jul 06 16:33:10 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jul 06 16:33:10 2026 +0800" }, "message": "[KYUUBI #7540] KSHC supports Spark 4.1\n\n### Why are the changes needed?\n\nThis PR makes KSHC (Kyuubi Spark Hive Connector) support Spark 4.1\n\nMain idea: get rid of `spark.sql.legacy.v1IdentifierNoCatalog` (which does not work well in Spark 4.1) and use `attachCatalogName` to adapt to SPARK-46283\n\n### How was this patch tested?\n\nUpdate GHA workflow to enable KSCH tests for Spark 4.1, also update KSHC cross-version tests - build with Spark 3.5, test on Spark 4.1\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: GLM 5.2\n\nCloses #7540 from pan3793/kyuubi-spark41-attach-catalog-name.\n\nCloses #7540\n\n338c3fa53 [Cheng Pan] enable kshc tests for spark 4.1\nd70334a28 [Cheng Pan] 1\n261b377e7 [Cheng Pan] [KYUUBI][KSHC] Attach catalog name to TableIdentifier (drop legacy conf)\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "69e7167a946245afdf81c6f3996e07e319f39d69", "tree": "c0a5d40c4e567dbedf69a13dce5d99f5c276f55c", "parents": [ "c2e3c67621d883aa1172a30d10039bcdc1dd6420" ], "author": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Mon Jul 06 16:38:24 2026 +0900" }, "committer": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Mon Jul 06 16:38:24 2026 +0900" }, "message": "[KYUUBI #7542] Validate filename in Utils\n\n### Why are the changes needed?\n\nValidate the file path is in the target directory before copying the file\n\n### How was this patch tested?\n\nAdded unit tests\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude Sonnet 4.6\n\nCloses #7542 from aajisaka/validate-filename.\n\nCloses #7542\n\n262e484e8 [Akira Ajisaka] Fix potential resource leak and empty dir\n5b5a9d0fa [Akira Ajisaka] Validate filename in Utils\n\nAuthored-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\nSigned-off-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\n" }, { "commit": "c2e3c67621d883aa1172a30d10039bcdc1dd6420", "tree": "50249523017d2285498c1bd8c329394645c5ad52", "parents": [ "2fa5941b906d0dc7a8ee8ac7d695520f3ec798af" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 22:46:57 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jul 03 22:46:57 2026 +0200" }, "message": "[KYUUBI #7535] Bump actions/cache from 5.0.5 to 6.1.0\n\nBumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/cache\u003c/code\u003e to v6.1.0 - handle read-only cache access by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1768\"\u003eactions/cache#1768\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/cache/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate packages, migrate to ESM by \u003ca href\u003d\"https://github.com/Samirat\"\u003e\u003ccode\u003e​Samirat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1760\"\u003eactions/cache#1760\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/cache/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/cache\u003c/code\u003e to v5.1.0 - handle read-only cache access by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1775\"\u003eactions/cache#1775\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.1.0\"\u003ehttps://github.com/actions/cache/compare/v5...v5.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch3\u003e6.1.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v6.1.0 to pick up \u003ca href\u003d\"https://redirect.github.com/actions/toolkit/pull/2435\"\u003eactions/toolkit#2435 Handle cache write error due to read-only token\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch redundant \u0026quot;Cache save failed\u0026quot; warning to debug log in save-only\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e6.0.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated \u003ccode\u003eactions/cache\u003c/code\u003e to ^6.0.1, \u003ccode\u003eactions/core\u003c/code\u003e to ^3.0.1, \u003ccode\u003eactions/exec\u003c/code\u003e to ^3.0.0, \u003ccode\u003eactions/io\u003c/code\u003e to ^3.0.2\u003c/li\u003e\n\u003cli\u003eMigrated to ESM module system\u003c/li\u003e\n\u003cli\u003eUpgraded Jest to v30 and test infrastructure to be ESM compatible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar patterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca href\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v5.0.3 \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1692\"\u003e#1692\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.1\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003eazure/storage-blob\u003c/code\u003e to \u003ccode\u003e^12.29.1\u003c/code\u003e via \u003ccode\u003eactions/cache5.0.1\u003c/code\u003e \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1685\"\u003e#1685\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.0\u003c/h3\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\n\u003ccode\u003eactions/cachev5\u003c/code\u003e runs on the Node.js 24 runtime and requires a minimum Actions Runner version of \u003ccode\u003e2.327.1\u003c/code\u003e.\nIf you are using self-hosted runners, ensure they are updated before upgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003e4.3.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to \u003ca href\u003d\"https://redirect.github.com/actions/toolkit/pull/2132\"\u003ev4.1.0\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e4.2.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v4.0.5\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e4.2.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v4.0.3 (obfuscates SAS token in debug logs for cache entries)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e4.2.2\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9\"\u003e\u003ccode\u003e55cc834\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1768\"\u003e#1768\u003c/a\u003e from jasongin/readonly-cache\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337\"\u003e\u003ccode\u003ed8cd72f\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​actions/cache\u003c/code\u003e to v6.1.0 - handle cache write error due to RO token\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8\"\u003e\u003ccode\u003e2c8a9bd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1760\"\u003e#1760\u003c/a\u003e from actions/samirat/esm_migration_and_package_update\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023\"\u003e\u003ccode\u003ee9b91fd\u003c/code\u003e\u003c/a\u003e Prettier fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb\"\u003e\u003ccode\u003ee4884b8\u003c/code\u003e\u003c/a\u003e Rebuild dist\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f\"\u003e\u003ccode\u003e10baf01\u003c/code\u003e\u003c/a\u003e Fixed licenses\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37\"\u003e\u003ccode\u003ee39b386\u003c/code\u003e\u003c/a\u003e Fix test mock return order\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06\"\u003e\u003ccode\u003eb692820\u003c/code\u003e\u003c/a\u003e PR feedback\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1\"\u003e\u003ccode\u003e6074912\u003c/code\u003e\u003c/a\u003e Rebuild dist bundles as ESM to match type:module\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e\"\u003e\u003ccode\u003e5a912e8\u003c/code\u003e\u003c/a\u003e Fix lint and jest issues\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/cache/compare/v5.0.5...v6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/cache\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5.0.5\u0026new-version\u003d6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7535 from dependabot[bot]/dependabot/github_actions/actions/cache-6.1.0.\n\nCloses #7535\n\n97f3546dd [dependabot[bot]] Bump actions/cache from 5.0.5 to 6.1.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "2fa5941b906d0dc7a8ee8ac7d695520f3ec798af", "tree": "917f69c5c00de3084b9d9b46b919e597244e3fee", "parents": [ "a9caa9bd6c4b7ddc75f06d82beb99d9624959209" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 22:46:00 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jul 03 22:46:00 2026 +0200" }, "message": "[KYUUBI #7536] Bump actions/setup-java from 5.3.0 to 5.4.0\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5.3.0 to 5.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.4.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e​typescript-eslint/parser\u003c/code\u003e from 8.48.0 to 8.61.1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1021\"\u003eactions/setup-java#1021\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix codeql workflow permissions by \u003ca href\u003d\"https://github.com/jsoref\"\u003e\u003ccode\u003e​jsoref\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/993\"\u003eactions/setup-java#993\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix CodeQL permissions by \u003ca href\u003d\"https://github.com/gdams\"\u003e\u003ccode\u003e​gdams\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1025\"\u003eactions/setup-java#1025\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: reject non-semver candidate versions in isVersionSatisfies by \u003ca href\u003d\"https://github.com/sproctor\"\u003e\u003ccode\u003e​sproctor\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1009\"\u003eactions/setup-java#1009\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/cache\u003c/code\u003e to 5.1.0, handle cache write denied by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1026\"\u003eactions/setup-java#1026\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Maven Wrapper cache feature by \u003ca href\u003d\"https://github.com/mahabaleshwars\"\u003e\u003ccode\u003e​mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1027\"\u003eactions/setup-java#1027\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSpelling by \u003ca href\u003d\"https://github.com/jsoref\"\u003e\u003ccode\u003e​jsoref\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/713\"\u003eactions/setup-java#713\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eadd link to advanced configuration for JetBrains by \u003ca href\u003d\"https://github.com/robstoll\"\u003e\u003ccode\u003e​robstoll\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/850\"\u003eactions/setup-java#850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs(action): fix missing required or default fields by \u003ca href\u003d\"https://github.com/kranthipoturaju\"\u003e\u003ccode\u003e​kranthipoturaju\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1007\"\u003eactions/setup-java#1007\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add microsoft openjdk 17.0.18 by \u003ca href\u003d\"https://github.com/al-kau\"\u003e\u003ccode\u003e​al-kau\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1002\"\u003eactions/setup-java#1002\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md - use \u0026quot;alert syntax for Markdown\u0026quot; for notes by \u003ca href\u003d\"https://github.com/mhoffrog\"\u003e\u003ccode\u003e​mhoffrog\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/924\"\u003eactions/setup-java#924\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.24.1 to 6.27.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1033\"\u003eactions/setup-java#1033\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate contributor guide with emoji for clarity by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1028\"\u003eactions/setup-java#1028\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eadd javac problem matcher by \u003ca href\u003d\"https://github.com/Trass3r\"\u003e\u003ccode\u003e​Trass3r\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/562\"\u003eactions/setup-java#562\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify README version syntax and migration guidance by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1038\"\u003eactions/setup-java#1038\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate undici artifacts to 6.27.0 (license cache + dist) by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1040\"\u003eactions/setup-java#1040\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: enhance custom jdk file installation by \u003ca href\u003d\"https://github.com/stephanabel\"\u003e\u003ccode\u003e​stephanabel\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/996\"\u003eactions/setup-java#996\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTemplates for new Java distributions by \u003ca href\u003d\"https://github.com/panticmilos\"\u003e\u003ccode\u003e​panticmilos\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/429\"\u003eactions/setup-java#429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6 to 7 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1032\"\u003eactions/setup-java#1032\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​types/node\u003c/code\u003e from 25.9.3 to 26.0.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1031\"\u003eactions/setup-java#1031\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: replace non-existent HelloWorldApp references with java --version by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1043\"\u003eactions/setup-java#1043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: add JavaFX Maven project configuration instructions by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1044\"\u003eactions/setup-java#1044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: self-signed certificate / internal CA handling for GitHub Enterprise by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1050\"\u003eactions/setup-java#1050\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: document importing an internal CA into the installed JDK (cacerts) by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1051\"\u003eactions/setup-java#1051\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: Harden workflows: least-privilege permissions + zizmor integration by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1039\"\u003eactions/setup-java#1039\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Add GraalVM Community distribution support by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1042\"\u003eactions/setup-java#1042\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: note jdkfile approach for Early Access / unreleased JDK builds by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1058\"\u003eactions/setup-java#1058\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edist: Apply Copilot review suggestions from PR \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1042\"\u003e#1042\u003c/a\u003e (GraalVM Community) by \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1059\"\u003eactions/setup-java#1059\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jsoref\"\u003e\u003ccode\u003e​jsoref\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/993\"\u003eactions/setup-java#993\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/sproctor\"\u003e\u003ccode\u003e​sproctor\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1009\"\u003eactions/setup-java#1009\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e​jasongin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1026\"\u003eactions/setup-java#1026\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/robstoll\"\u003e\u003ccode\u003e​robstoll\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/850\"\u003eactions/setup-java#850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/kranthipoturaju\"\u003e\u003ccode\u003e​kranthipoturaju\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1007\"\u003eactions/setup-java#1007\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/al-kau\"\u003e\u003ccode\u003e​al-kau\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1002\"\u003eactions/setup-java#1002\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mhoffrog\"\u003e\u003ccode\u003e​mhoffrog\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/924\"\u003eactions/setup-java#924\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1028\"\u003eactions/setup-java#1028\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Trass3r\"\u003e\u003ccode\u003e​Trass3r\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/562\"\u003eactions/setup-java#562\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/stephanabel\"\u003e\u003ccode\u003e​stephanabel\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/996\"\u003eactions/setup-java#996\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v5...v5.4.0\"\u003ehttps://github.com/actions/setup-java/compare/v5...v5.4.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/1bcf9fb12cf4aa7d266a90ae39939e61372fe520\"\u003e\u003ccode\u003e1bcf9fb\u003c/code\u003e\u003c/a\u003e dist: Address Copilot review suggestions from PR \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1042\"\u003e#1042\u003c/a\u003e (GraalVM Community) (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/fa2c6508d1036292a5efdf642f98d1c695974c72\"\u003e\u003ccode\u003efa2c650\u003c/code\u003e\u003c/a\u003e docs: note jdkfile approach for Early Access / unreleased JDK builds (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1058\"\u003e#1058\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/1d56e31dbb83904d53629e4e0bd2d956e011c1c2\"\u003e\u003ccode\u003e1d56e31\u003c/code\u003e\u003c/a\u003e dist: Add GraalVM Community distribution support (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1042\"\u003e#1042\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/1d252528046b5ceb47839b03a115e0ea04f026cc\"\u003e\u003ccode\u003e1d25252\u003c/code\u003e\u003c/a\u003e chore: Harden workflows: least-privilege permissions + zizmor integration (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/668c1ea991737ea087e51dbf0bcf7fd41cbc20ee\"\u003e\u003ccode\u003e668c1ea\u003c/code\u003e\u003c/a\u003e docs: add post-install keytool import for the JDK cacerts trust store (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1051\"\u003e#1051\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/a9a46fbe0996878a5673db759d29dbc5f470320e\"\u003e\u003ccode\u003ea9a46fb\u003c/code\u003e\u003c/a\u003e docs: document self-signed certificate / internal CA handling for GitHub Ente...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/5431e71f9a4e00431c1c904af57e62794b518b11\"\u003e\u003ccode\u003e5431e71\u003c/code\u003e\u003c/a\u003e docs: add JavaFX Maven project configuration instructions (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1044\"\u003e#1044\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/4baa9b45d2bff6fcbef9619dabd0cb1ca822905b\"\u003e\u003ccode\u003e4baa9b4\u003c/code\u003e\u003c/a\u003e docs: replace non-existent HelloWorldApp references with java --version (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1043\"\u003e#1043\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/eab4b0854d2abdb899d5cf9e1bbff1df86044a8e\"\u003e\u003ccode\u003eeab4b08\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​types/node\u003c/code\u003e from 25.9.3 to 26.0.0 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1031\"\u003e#1031\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/bf0c0e6df33849b0cba166f7c5d05fb38a219383\"\u003e\u003ccode\u003ebf0c0e6\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6 to 7 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1032\"\u003e#1032\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v5.3.0...v5.4.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-java\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5.3.0\u0026new-version\u003d5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7536 from dependabot[bot]/dependabot/github_actions/actions/setup-java-5.4.0.\n\nCloses #7536\n\n3ebc38c5a [dependabot[bot]] Bump actions/setup-java from 5.3.0 to 5.4.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "a9caa9bd6c4b7ddc75f06d82beb99d9624959209", "tree": "e245c10977553c250af609353e03117b7225da1e", "parents": [ "99d93c5edcdd32075568c9932e7e6f31ea129570" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jul 03 22:44:12 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jul 03 22:44:12 2026 +0200" }, "message": "[KYUUBI #7537] Bump actions/setup-python from 6.2.0 to 6.3.0\n\nBumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancement\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd RHEL support and include Linux distro in cache keys by \u003ca href\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1323\"\u003eactions/setup-python#1323\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix pip cache error handling on Windows by \u003ca href\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1040\"\u003eactions/setup-python#1040\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency update\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade minimatch from 3.1.2 to 3.1.5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1281\"\u003eactions/setup-python#1281\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions dependencies by \u003ca href\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e​gowridurgad\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied by \u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependency versions and test workflow configuration by \u003ca href\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1322\"\u003eactions/setup-python#1322\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate advanced-usage.md by \u003ca href\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e​Dunky-Z\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e​gowridurgad\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e​jasongin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e​Dunky-Z\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v6...v6.3.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v6.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1\"\u003e\u003ccode\u003eece7cb0\u003c/code\u003e\u003c/a\u003e Fix pip cache error handling on Windows. (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1040\"\u003e#1040\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf\"\u003e\u003ccode\u003e1d18d7a\u003c/code\u003e\u003c/a\u003e Update advanced-usage.md (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/811\"\u003e#811\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/d2b357a6a3a3687dd6781a416c0d24fcfd68660e\"\u003e\u003ccode\u003ed2b357a\u003c/code\u003e\u003c/a\u003e Update dependency versions and test workflow configuration (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1322\"\u003e#1322\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/8f639b1e75c1048640734b2bb46e22cecf136982\"\u003e\u003ccode\u003e8f639b1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1324\"\u003e#1324\u003c/a\u003e from jasongin/update-actions-cache-5.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/6731c2ba87f530c26324d128c8fdd53499a4d4b0\"\u003e\u003ccode\u003e6731c2b\u003c/code\u003e\u003c/a\u003e Resolve high-severity audit issues\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/0cb1a84326b90186fcd211036c65b42819794c87\"\u003e\u003ccode\u003e0cb1a84\u003c/code\u003e\u003c/a\u003e Add RHEL support and include Linux distro in cache keys (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1323\"\u003e#1323\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/dc6eab6194394e0119523369788b507096f923e2\"\u003e\u003ccode\u003edc6eab6\u003c/code\u003e\u003c/a\u003e Update dist\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/6f4b74bfa2f520a380a620de3615c0dac427f4d3\"\u003e\u003ccode\u003e6f4b74b\u003c/code\u003e\u003c/a\u003e Strict equality\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/fa8bde1a9cc6347d06948d66bcd68c598b79eaea\"\u003e\u003ccode\u003efa8bde1\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/c8813ba1bc76ebf779b911ad8ffccbf2e449cb48\"\u003e\u003ccode\u003ec8813ba\u003c/code\u003e\u003c/a\u003e Upgrade \u003ca href\u003d\"https://github.com/actions\"\u003e\u003ccode\u003e​actions\u003c/code\u003e\u003c/a\u003e dependencies and update licenses (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1303\"\u003e#1303\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-python\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6.2.0\u0026new-version\u003d6.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7537 from dependabot[bot]/dependabot/github_actions/actions/setup-python-6.3.0.\n\nCloses #7537\n\n4f946d1e3 [dependabot[bot]] Bump actions/setup-python from 6.2.0 to 6.3.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "99d93c5edcdd32075568c9932e7e6f31ea129570", "tree": "425a05b135a75cc6b69e0474acd8100f4c42286e", "parents": [ "dd16179d9b59c8340d249e8535c33fd2221b620d" ], "author": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Thu Jul 02 20:28:02 2026 +0800" }, "committer": { "name": "Xiduo You", "email": "ulyssesyou@apache.org", "time": "Thu Jul 02 20:28:02 2026 +0800" }, "message": "[KYUUBI #7531] Add rebalance advisoryPartitionSizeInBytes config\n\n### Why are the changes needed?\n\nStarting from Spark 3.5, the RebalancePartitions operator supports an optAdvisoryPartitionSize parameter to specify the desired partition size after shuffle. This allows Kyuubi to directly control the target output size of the rebalance shuffle, helping AQE\u0027s CoalesceShufflePartitions to produce appropriately sized output files and avoid small file issues.\n\nCurrently, RebalanceBeforeWriting inserts RebalancePartitions without any advisory size, leaving AQE to use the global spark.sql.adaptive.advisoryPartitionSizeInBytes which may not be suitable for the final write stage.\n\nThis patch introduces a new Kyuubi configuration key spark.sql.adaptive.rebalancePartitionsAdvisoryPartitionSizeInBytes that takes precedence over the final-stage config spark.sql.finalStage.adaptive.advisoryPartitionSizeInBytes as a fallback.\n\n### How was this patch tested?\n\nAdded 5 unit tests in RebalanceBeforeWritingSuite covering all scenarios:\n- Final-stage config takes effect\n- Kyuubi config fallback\n- Kyuubi config takes precedence over final-stage when both are set\n- Neither config is set (optAdvisoryPartitionSize is None)\n- Raw getAdvisoryPartitionSize(conf) config resolution\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nClaude Code (Anthropic Claude Opus 4.7)\n\nCloses #7531 from ulysses-you/rebalance.\n\nCloses #7531\n\nacbbc529a [Xiduo You] style\n635b398cb [Xiduo You] docs\n776f9d29a [Xiduo You] style\n9bba43d9c [Xiduo You] Add rebalance advisoryPartitionSizeInBytes config\n\nAuthored-by: Xiduo You \u003culyssesyou@apache.org\u003e\nSigned-off-by: Xiduo You \u003culyssesyou@apache.org\u003e\n" }, { "commit": "dd16179d9b59c8340d249e8535c33fd2221b620d", "tree": "ddefcd4a53fa218785309f0127cdfe6a064055b0", "parents": [ "36f0b8ccded683ce6625db3b1c5c69338d111840" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Thu Jul 02 14:51:43 2026 +0800" }, "committer": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Thu Jul 02 14:51:43 2026 +0800" }, "message": "[KYUUBI #7538] [KYUUBI][WEBUI] Upgrade ESLint to 9 (flat config) and clear remaining dev-dependency advisories\n\n### Why are the changes needed?\n\nFollow-up to #7533, which deferred the ESLint upgrade. ESLint 8 is end-of-life and its transitive deps still carry dev-only advisories. This moves the lint stack to ESLint 9 and takes `pnpm audit` (dev + prod) to 0.\n\n- eslint 8→9, `typescript-eslint/*` 5 → unified `typescript-eslint` 8, eslint-plugin-vue 9→10, vue/eslint-config-typescript 11→14, eslint-plugin-prettier 4→5, prettier 2→3, add eslint/js, drop vue/eslint-config-prettier.\n- Convert `.eslintrc` to flat config `eslint.config.js` (ESLint 9 drops eslintrc); the rule set is preserved.\n- Pin `brace-expansion` / `picomatch` via pnpm overrides to clear the last transitive advisories.\n\n`pnpm audit`: 12 vulnerabilities (6 high / 5 moderate / 1 low) → 0.\n\n### How was this patch tested?\n\n`pnpm install --frozen-lockfile`, `build`, `coverage` (80 tests), and `lint` pass on Node 22 / pnpm 9.11; `pnpm audit` \u003d 0.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude Opus 4.8\n\nCloses #7538 from wangzhigang1999/kyuubi-web-ui-eslint9.\n\nCloses #7538\n\n7cb868596 [wangzhigang] [KYUUBI][WEBUI] Upgrade ESLint to 9 (flat config) and clear remaining dev-dependency advisories\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\n" }, { "commit": "36f0b8ccded683ce6625db3b1c5c69338d111840", "tree": "2889b1084353cfc6d6b79c46ea81392dfe8e2b96", "parents": [ "96da471b36257b94b03c5909b303da2ca29af0db" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Thu Jul 02 09:54:28 2026 +0800" }, "committer": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Thu Jul 02 09:54:28 2026 +0800" }, "message": "[KYUUBI #7533][WEBUI] Upgrade web-ui build toolchain and fix dependency security advisories\n\n### Why are the changes needed?\n\nThe web-ui toolchain is years behind and partly EOL (vite 4.5, vitest 0.32, vue-tsc 0.38, TS 4.6), with open dependency advisories. This consolidates Dependabot\u0027s 11 web-ui PRs and modernizes the toolchain in one change.\n\n- Toolchain: vite 4→8, vitest/coverage-v8 0.32→4, plugin-vue 4→6, vue-tsc 0.38→3.3, TS 4.6→5.9, jsdom 20→26, sass→1.101, types/node→22.\n- Security: vue-i18n 9.2→9.14.5, element-plus 2.2→2.14, lodash/lodash-es→4.18.1 (pnpm overrides). `pnpm audit --prod`: 3 high / 7 moderate → 0.\n- CI `node.version` v20.17→v22.23.1 (required by vite 8; derived from the Maven property, no workflow edits).\n- Removed the unused `package-lock.json` (the module builds with pnpm).\n\nESLint 8→9 (flat-config) is deferred to a follow-up.\n\nCloses #7533\n\n### How was this patch tested?\n\n`pnpm install --frozen-lockfile`, `build`, `coverage` (80 tests), and `lint` pass on Node 22 / pnpm 9.11; `pnpm audit --prod` \u003d 0. Manually verified all routes and interactive features (i18n switch, Monaco, run SQL → result grid, tabs, data-agent, sign-in) against a running Kyuubi instance — no console errors.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude Opus 4.8\n\nCloses #7534 from wangzhigang1999/kyuubi-7533-web-ui-toolchain-upgrade.\n\nCloses #7533\n\n7bcba675c [wangzhigang] [KYUUBI #7533][WEBUI] Upgrade web-ui build toolchain and fix dependency security advisories\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\n" }, { "commit": "96da471b36257b94b03c5909b303da2ca29af0db", "tree": "135fe3366b2223cbce18ea896bc5bd2a4a4d72f7", "parents": [ "96f745e98b49a289deeabcd9778ebd625b6c6691" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Mon Jun 29 14:21:50 2026 +0800" }, "committer": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Mon Jun 29 14:21:50 2026 +0800" }, "message": "[KYUUBI #7379][4/4] Data Agent Engine: REST API, SSE streaming, and Web UI\n\n### Why are the changes needed?\n\nPart 4 of 4 for the Data Agent Engine ([umbrella](https://github.com/apache/kyuubi/issues/7379), [KPIP-7373](https://github.com/apache/kyuubi/discussions/7373)).\n\n- **REST API** (`DataAgentResource` at `/api/v1/data-agent`): `POST /{handle}/chat` (SSE) and `POST /{handle}/approve` (JSON), plus `ChatRequest` / `ApprovalRequest` DTOs in `kyuubi-client-api`\n- **Engine streaming**: `ReasoningDelta` event for chain-of-thought streaming (qwen3, DeepSeek-R1); `AgentRunContext` token accounting split into `accumulated*` (billing) and `last*` (current context size for `CompactionMiddleware`)\n- **Web UI**: new `/data-agent` route with chat view, multi-tab sessions, tool-call/approval flow, reasoning collapse, sanitized markdown; SSE client built on `microsoft/fetch-event-source` with watchdog and visibility-triggered reconnect\n- Bundles SQLite and PostgreSQL JDBC drivers in the engine package (Apache-compatible); MySQL stays test-scope\n\n### How was this patch tested?\n\n- Unit tests: `DataAgentResourceSuite` (chat / approve preflight, SSE framing), `EventTest` (engine SSE name parity), web-ui specs for SSE parsing, JDBC URL sanitization, and the persist serializer\n- Live LLM integration suite (gated on `DATA_AGENT_OPENAI_API_KEY`): full ReAct loop, approval gate, denial flow, compaction — green against dashscope qwen-plus\n- Manual E2E in the dev server against a live engine\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nYes. The Web UI (Vue components, Pinia store, SSE client, tests) was primarily authored by Claude Code (Claude Opus 4.7) under human direction and review. The server-side REST API, engine streaming changes, and overall architecture are human-designed, with Claude assisting in implementation, code review, test generation, and PR formatting.\n\nCloses #7431 from wangzhigang1999/pr3/data-agent-rest-ui.\n\nCloses #7379\n\n3f2e02ab1 [wangzhigang] [KYUUBI #7379][PR 4/4] Bump dompurify to 3.4.11 to fix XSS advisories\n95906d1a3 [wangzhigang] [KYUUBI #7379][PR 4/4] Reject Kerberos for the Data Agent JDBC datasource\nab6d0ed92 [wangzhigang] [KYUUBI #7379][PR 4/4] Migrate ChatCompletionProviderTest to JUnit 5\ne7c440bb1 [wangzhigang] [KYUUBI #7379][PR 4/4] Address review feedback on Data Agent docs and default JDBC URL\n845acc8f5 [wangzhigang] [KYUUBI #7379][PR 4/4] Fix Data Agent web UI copy and persist limits\n2ed1e140a [wangzhigang] [KYUUBI #7379][PR 4/4] Add Data Agent quick start documentation\n277c0945c [wangzhigang] [KYUUBI #7379][PR 4/4] Make Data Agent default JDBC URL work outside ZK HA\n6aee3a931 [wangzhigang] [KYUUBI #7379][PR 4/4] Polish Data Agent web UI error and confirm flows\n755aa61d6 [wangzhigang] [KYUUBI #7379][PR 4/4] Harden Data Agent JDBC datasource setup\n7a8d44d5e [wangzhigang] [KYUUBI #7379][PR 4/4] Round 2 review fixes for Data Agent web UI\nf5ed9eba7 [wangzhigang] [KYUUBI #7379][PR 4/4] Round 2 review fixes for Data Agent REST resource\n1ffd9251e [wangzhigang] [KYUUBI #7379][PR 4/4] Slim chat messages on persist to fit sessionStorage\n37f5d96be [wangzhigang] [KYUUBI #7379][PR 4/4] Harden Data Agent REST chat path\n988b09f54 [wangzhigang] [KYUUBI #7379][PR 4/4] Fix JDBC sanitizer and persist credentials safely\nc303511b0 [wangzhigang] [KYUUBI #7379][PR 4/4] Add Data Agent chat interface in Web UI\nff08fa950 [wangzhigang] [KYUUBI #7379][PR 4/4] Add DataAgent REST API for chat and approve\na3787c3d1 [wangzhigang] [KYUUBI #7379][PR 4/4] Add ChatRequest and ApprovalRequest DTOs for Data Agent\na6386e3e3 [wangzhigang] [KYUUBI #7379][PR 4/4] Stream reasoning content via ReasoningDelta event\n6b5438eb2 [wangzhigang] [KYUUBI #7379][PR 4/4] Rework AgentFinish/AgentRunContext token fields\n2bdda7f1a [wangzhigang] [KYUUBI #7379][PR 4/4] Bundle SQLite and PostgreSQL JDBC drivers in Data Agent engine\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\n" }, { "commit": "96f745e98b49a289deeabcd9778ebd625b6c6691", "tree": "3f1de4b2114df8721a268c58eec5384cd19cb4a0", "parents": [ "6f717a2558846a0e7a4548fa374eb18a4e7fad90" ], "author": { "name": "Sunwoo-Shin", "email": "62536685+Sunwoo-Shin@users.noreply.github.com", "time": "Mon Jun 29 13:40:11 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jun 29 13:40:11 2026 +0800" }, "message": "[KYUUBI #7433][SPARK] Preserve Hive delegation tokens with non-empty service\n\n### Why are the changes needed?\n\nCloses #7433.\n\n`SparkTBinaryFrontendService#addHiveToken` keeps only the Hive delegation token whose `service` field is empty (the one `HiveMetaStoreClient` selects by default) and silently drops every Hive token whose `service` is non-empty.\n\nA Hive delegation token gets a non-empty `service` when it is bound to a specific metastore via `hive.metastore.token.signature` (the signature is stored in the token service). When an engine talks to multiple Hive metastores that use different Kerberos principals — e.g. two Iceberg catalogs, each backed by its own HMS — each metastore produces its own signature-bound token. Because these tokens are dropped before reaching the engine UGI, the engine fails to authenticate against the non-default metastore with `DIGEST-MD5: IO error acquiring password`.\n\nThis is the engine-side counterpart of #1091 (renewing delegation tokens for multiple Hive metastore clusters): even when the server pushes per-metastore tokens, the engine drops them.\n\nAffected versions: 1.11.1.\n\nThis change partitions the incoming Hive tokens by their `service` field:\n\n- Tokens with a non-empty `service` are added to the engine credentials keyed by their alias, reusing the same issue-date downgrade guard the default path already applies.\n- The existing single-metastore URI matching now runs only over the default (empty-`service`) tokens, so behavior for the common single-HMS case is unchanged.\n- The `No matching Hive token found ...` warning is emitted only when a default-`service` token was actually expected, to avoid noise in metastore deployments that rely solely on signature-bound tokens.\n\n### How was this patch tested?\n\nAdded unit tests in `SparkTBinaryFrontendServiceSuite` (the token-merging logic was extracted into `mergeHiveTokens` so it can be exercised without a `SparkContext`):\n\n- signature-bound tokens for multiple metastores are preserved, keyed by alias;\n- a signature-bound token with an earlier issue date is ignored, and a later one replaces the existing token;\n- the existing single-metastore matching for default-`service` tokens is unchanged;\n- signature-bound tokens are added without disturbing the default-`service` path.\n\n```\nbuild/mvn test -pl externals/kyuubi-spark-sql-engine -am \\\n -Dtest\u003dnone \\\n -DwildcardSuites\u003dorg.apache.kyuubi.engine.spark.SparkTBinaryFrontendServiceSuite\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-8\n\nCloses #7518 from Sunwoo-Shin/kyuubi-7433-multi-hms-hive-token.\n\nCloses #7433\n\nc4242b9bf [Sunwoo-Shin] [KYUUBI #7433][SPARK] Preserve Hive delegation tokens with non-empty service\n\nAuthored-by: Sunwoo-Shin \u003c62536685+Sunwoo-Shin@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "6f717a2558846a0e7a4548fa374eb18a4e7fad90", "tree": "f56a91e71ea839cc413681cc90828bb4176fb19b", "parents": [ "306321cd89d4c0769274f1e00fdae46743603442" ], "author": { "name": "Sunwoo-Shin", "email": "62536685+Sunwoo-Shin@users.noreply.github.com", "time": "Mon Jun 29 13:38:55 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jun 29 13:38:55 2026 +0800" }, "message": "[KYUUBI #7435][SERVER] Honor server-level kyuubi.server.info.provider in getInfo\n\n### Why are the changes needed?\n\nCloses #7435.\n\n`kyuubi.server.info.provider` was declared `.serverOnly`, so `KyuubiConf#getUserDefaults` stripped it from the per-session conf that `KyuubiSessionManager#openSession` builds. As a result `KyuubiSessionImpl#getInfo` read it through `sessionConf.get(SERVER_INFO_PROVIDER)`, which never saw the server-level value and always returned the hard-coded default `ENGINE`. Setting `kyuubi.server.info.provider\u003dSERVER` in `kyuubi-defaults.conf` was therefore silently ignored, and every `GetInfo` request waited for the engine to launch and forwarded to it instead of being answered by the server directly.\n\n`SERVER_INFO_PROVIDER` is only read on the server frontend (`KyuubiSessionImpl#getInfo`); the engine never reads it. Dropping the `serverOnly` flag lets the server-level value flow into the session conf so `getInfo` honors it, while an explicit per-session value still wins as before.\n\nAffected versions: 1.11.1.\n\n### How was this patch tested?\n\nAdded `KyuubiServerInfoProviderSuite`, which boots a server with `kyuubi.server.info.provider\u003dSERVER` set only at the server level (no per-session override) and asserts `GetInfo(CLI_DBMS_NAME)` returns `Apache Kyuubi`. Before the fix it returns the engine name (`Spark SQL`).\n\n```\nbuild/mvn test -pl kyuubi-server -am \\\n -Dtest\u003dnone \\\n -DwildcardSuites\u003dorg.apache.kyuubi.operation.KyuubiServerInfoProviderSuite\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-8\n\nCloses #7519 from Sunwoo-Shin/kyuubi-7435-honor-server-info-provider.\n\nCloses #7435\n\n81db4790d [Sunwoo-Shin] [KYUUBI #7435][SERVER] Honor server-level kyuubi.server.info.provider in getInfo\n\nAuthored-by: Sunwoo-Shin \u003c62536685+Sunwoo-Shin@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "306321cd89d4c0769274f1e00fdae46743603442", "tree": "9046b54557c186d80345dbcaec4c7ae4a3d6e5bf", "parents": [ "0d7abecba11e4226f4ed4cbc5276a1416df42275" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jun 29 13:37:12 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon Jun 29 13:37:12 2026 +0800" }, "message": "[KYUUBI #7528] Remove MySQL frontend protocol\n\n### Why are the changes needed?\n\nThe MySQL frontend was added as an experimental feature for a long time, but it never got improved after that.\n\n### How was this patch tested?\n\nPass GHA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: GLM 5.2\n\nCloses #7528 from pan3793/rm-mysql-fe.\n\nCloses #7528\n\n5516dfe97 [Cheng Pan] cleanup docs\n45293177d [Cheng Pan] Remove MySQL frontend protocol\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "0d7abecba11e4226f4ed4cbc5276a1416df42275", "tree": "2cf3db208a3610ae243231c5d3bc1589959964da", "parents": [ "484f8836ddb0424098079fe85dc820b4fb950ecc" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jun 26 11:28:47 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 26 11:28:47 2026 +0200" }, "message": "[KYUUBI #7526] Bump actions/checkout from 6.0.3 to 7.0.0\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/core\u003c/code\u003e and \u003ccode\u003e​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e​aiqiaoy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/core\u003c/code\u003e and \u003ccode\u003e​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003e\u003ccode\u003e9c091bb\u003c/code\u003e\u003c/a\u003e update error wording (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2467\"\u003e#2467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a\"\u003e\u003ccode\u003e1044a6d\u003c/code\u003e\u003c/a\u003e getting ready for checkout v7 release (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2464\"\u003e#2464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f\"\u003e\u003ccode\u003ef028218\u003c/code\u003e\u003c/a\u003e Bump the minor-npm-dependencies group across 1 directory with 3 updates (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2462\"\u003e#2462\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d\"\u003e\u003ccode\u003ed914b26\u003c/code\u003e\u003c/a\u003e upgrade module to esm and update dependencies (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2463\"\u003e#2463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d\"\u003e\u003ccode\u003e537c7ef\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​actions/core\u003c/code\u003e and \u003ccode\u003e​actions/tool-cache\u003c/code\u003e and Remove uuid (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2459\"\u003e#2459\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6\"\u003e\u003ccode\u003e130a169\u003c/code\u003e\u003c/a\u003e Bump js-yaml from 4.1.0 to 4.2.0 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2461\"\u003e#2461\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3\"\u003e\u003ccode\u003e7d09575\u003c/code\u003e\u003c/a\u003e Bump flatted from 3.3.1 to 3.4.2 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2460\"\u003e#2460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e\"\u003e\u003ccode\u003e0f9f3aa\u003c/code\u003e\u003c/a\u003e Bump actions/publish-immutable-action (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2458\"\u003e#2458\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7\"\u003e\u003ccode\u003ef9e715a\u003c/code\u003e\u003c/a\u003e block checking out fork pr for pull_request_target and workflow_run (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2454\"\u003e#2454\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nCloses #7526 from dependabot[bot]/dependabot/github_actions/actions/checkout-7.0.0.\n\nCloses #7526\n\n71d023eb8 [dependabot[bot]] Bump actions/checkout from 6.0.3 to 7.0.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "484f8836ddb0424098079fe85dc820b4fb950ecc", "tree": "e93f3c03af58fa637f105f9abbbf2b01c7e230f2", "parents": [ "c72258745f920524ec6609e729073164bb5d97a7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jun 26 11:27:12 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 26 11:27:12 2026 +0200" }, "message": "[KYUUBI #7525] Bump actions/cache from 5 to 5.0.5\n\nBumps [actions/cache](https://github.com/actions/cache) from 5 to 5.0.5.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.5\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate ts-http-runtime dependency by \u003ca href\u003d\"https://github.com/yacaovsnc\"\u003e\u003ccode\u003e​yacaovsnc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1747\"\u003eactions/cache#1747\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.0.5\"\u003ehttps://github.com/actions/cache/compare/v5...v5.0.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.4\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd release instructions and update maintainer docs by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1696\"\u003eactions/cache#1696\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePotential fix for code scanning alert no. 52: Workflow does not contain permissions by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1697\"\u003eactions/cache#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix workflow permissions and cleanup workflow names / formatting by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1699\"\u003eactions/cache#1699\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update examples to use the latest version by \u003ca href\u003d\"https://github.com/XZTDean\"\u003e\u003ccode\u003e​XZTDean\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1690\"\u003eactions/cache#1690\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix proxy integration tests by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1701\"\u003eactions/cache#1701\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix cache key in examples.md for bun.lock by \u003ca href\u003d\"https://github.com/RyPeck\"\u003e\u003ccode\u003e​RyPeck\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1722\"\u003eactions/cache#1722\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies \u0026amp; patch security vulnerabilities by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1738\"\u003eactions/cache#1738\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/XZTDean\"\u003e\u003ccode\u003e​XZTDean\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1690\"\u003eactions/cache#1690\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/RyPeck\"\u003e\u003ccode\u003e​RyPeck\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1722\"\u003eactions/cache#1722\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.0.4\"\u003ehttps://github.com/actions/cache/compare/v5...v5.0.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca href\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.0.3\"\u003ehttps://github.com/actions/cache/compare/v5...v5.0.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev.5.0.2\u003c/h2\u003e\n\u003ch1\u003ev5.0.2\u003c/h1\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cp\u003eWhen creating cache entries, 429s returned from the cache service will not be retried.\u003c/p\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\n\u003cstrong\u003e\u003ccode\u003eactions/cachev5\u003c/code\u003e runs on the Node.js 24 runtime and requires a minimum Actions Runner version of \u003ccode\u003e2.327.1\u003c/code\u003e.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIf you are using self-hosted runners, ensure they are updated before upgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003chr /\u003e\n\u003ch1\u003ev5.0.1\u003c/h1\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca href\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e with the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by updating the \u003ca href\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e file with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed and merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e use the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you made in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca href\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version number.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags for this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e6.1.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v6.1.0 to pick up \u003ca href\u003d\"https://redirect.github.com/actions/toolkit/pull/2435\"\u003eactions/toolkit#2435 Handle cache write error due to read-only token\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch redundant \u0026quot;Cache save failed\u0026quot; warning to debug log in save-only\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e6.0.0\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated \u003ccode\u003eactions/cache\u003c/code\u003e to ^6.0.1, \u003ccode\u003eactions/core\u003c/code\u003e to ^3.0.1, \u003ccode\u003eactions/exec\u003c/code\u003e to ^3.0.0, \u003ccode\u003eactions/io\u003c/code\u003e to ^3.0.2\u003c/li\u003e\n\u003cli\u003eMigrated to ESM module system\u003c/li\u003e\n\u003cli\u003eUpgraded Jest to v30 and test infrastructure to be ESM compatible\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar patterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca href\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/cache/compare/v5...v5.0.5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nCloses #7525 from dependabot[bot]/dependabot/github_actions/actions/cache-5.0.5.\n\nCloses #7525\n\n431cf11ae [dependabot[bot]] Bump actions/cache from 5 to 5.0.5\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "c72258745f920524ec6609e729073164bb5d97a7", "tree": "0f4e3176dc9bfa373cde871297ca70e118fe1f25", "parents": [ "054810d2f20423a2d253f37274931503fd3ce612" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jun 26 11:11:50 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 26 11:11:50 2026 +0200" }, "message": "[KYUUBI #7524] Bump actions/setup-python from 6 to 6.2.0\n\nBumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 6.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade dependencies to Node 24 compatible versions by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1259\"\u003eactions/setup-python#1259\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade urllib3 from 2.5.0 to 2.6.3 in \u003ccode\u003e/__tests__/data\u003c/code\u003e by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1253\"\u003eactions/setup-python#1253\u003c/a\u003e and \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1264\"\u003eactions/setup-python#1264\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v6...v6.2.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v6.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for \u003ccode\u003epip-install\u003c/code\u003e input by \u003ca href\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1201\"\u003eactions/setup-python#1201\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd graalpy early-access and windows builds by \u003ca href\u003d\"https://github.com/timfel\"\u003e\u003ccode\u003e​timfel\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/880\"\u003eactions/setup-python#880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency and Documentation updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnhanced wording and updated example usage for \u003ccode\u003eallow-prereleases\u003c/code\u003e by \u003ca href\u003d\"https://github.com/yarikoptic\"\u003e\u003ccode\u003e​yarikoptic\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/979\"\u003eactions/setup-python#979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1139\"\u003eactions/setup-python#1139\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade typescript from 5.4.2 to 5.9.3 and Documentation update by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1094\"\u003eactions/setup-python#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/publish-action from 0.3.0 to 0.4.0 \u0026amp; Documentation update for pip-install input by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1199\"\u003eactions/setup-python#1199\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade requests from 2.32.2 to 2.32.4 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1130\"\u003eactions/setup-python#1130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade prettier from 3.5.3 to 3.6.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1234\"\u003eactions/setup-python#1234\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​types/node\u003c/code\u003e from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1235\"\u003eactions/setup-python#1235\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yarikoptic\"\u003e\u003ccode\u003e​yarikoptic\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/979\"\u003eactions/setup-python#979\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v6...v6.1.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v6.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/03bb6152f4f691b9d64579a1bd791904a083c452\"\u003e\u003ccode\u003e03bb615\u003c/code\u003e\u003c/a\u003e Bump idna from 2.9 to 3.7 in /\u003cstrong\u003etests\u003c/strong\u003e/data (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/843\"\u003e#843\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/36da51d563b70a972897150555bb025096d65565\"\u003e\u003ccode\u003e36da51d\u003c/code\u003e\u003c/a\u003e Add version parsing from Pipfile (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1067\"\u003e#1067\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/3c6f142cc0036d53007e92fa1e327564a4cfb7aa\"\u003e\u003ccode\u003e3c6f142\u003c/code\u003e\u003c/a\u003e update documentation (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1156\"\u003e#1156\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/88ffd4d597d830d67a7369dd33dcb72c0958a807\"\u003e\u003ccode\u003e88ffd4d\u003c/code\u003e\u003c/a\u003e Include python version in PyPy python-version output (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1110\"\u003e#1110\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/532b046aaf352bab5717122cc0ea52b7f12266a3\"\u003e\u003ccode\u003e532b046\u003c/code\u003e\u003c/a\u003e Add Architecture-Specific PATH Management for Python with --user Flag on Wind...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/12648859835f68b273febdd9aab9972bbb624d8c\"\u003e\u003ccode\u003e1264885\u003c/code\u003e\u003c/a\u003e Enhance cache-dependency-path handling to support files outside the workspace...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/e9c40fbc2bf309799101412f178fe3064ebb27ac\"\u003e\u003ccode\u003ee9c40fb\u003c/code\u003e\u003c/a\u003e Add support for \u003ccode\u003epip-version\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1129\"\u003e#1129\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/5fa0ee6f38acba344a11175befcf11c0c1d46f5a\"\u003e\u003ccode\u003e5fa0ee6\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​actions/tool-cache\u003c/code\u003e from 2.0.1 to 2.0.2 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1095\"\u003e#1095\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/5db1cf9a59fb97c40a68accab29236f0da7e94db\"\u003e\u003ccode\u003e5db1cf9\u003c/code\u003e\u003c/a\u003e Enhance reading from .python-version (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/787\"\u003e#787\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/a26af69be951a213d495a4c3e4e4022e16d87065\"\u003e\u003ccode\u003ea26af69\u003c/code\u003e\u003c/a\u003e Bump ts-jest from 29.1.2 to 29.3.2 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1081\"\u003e#1081\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v6...v6.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-python\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6\u0026new-version\u003d6.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7524 from dependabot[bot]/dependabot/github_actions/actions/setup-python-6.2.0.\n\nCloses #7524\n\n0e5d80bc5 [dependabot[bot]] Bump actions/setup-python from 6 to 6.2.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "054810d2f20423a2d253f37274931503fd3ce612", "tree": "2789e086124d6a6792f3a584fde745165d3d00a8", "parents": [ "1f5ebbf05f3cfe2c118579504868cbf9bb477ecc" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jun 26 11:10:30 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 26 11:10:30 2026 +0200" }, "message": "[KYUUBI #7523] Bump actions/setup-java from 5.2.0 to 5.3.0\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5.2.0 to 5.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: update Java version to 25 in setup examples by \u003ca href\u003d\"https://github.com/alaahong\"\u003e\u003ccode\u003e​alaahong\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/969\"\u003eactions/setup-java#969\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump minimatch from 3.1.2 to 3.1.5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/984\"\u003eactions/setup-java#984\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRefactor error handling and improve test logging for installers by \u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/989\"\u003eactions/setup-java#989\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: upgrade dependencies (\u003ccode\u003e​actions/core\u003c/code\u003e, cache, glob, http-client, tool-cache, xmlbuilder2) by \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/999\"\u003eactions/setup-java#999\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Oracle JDK 17 licensing limitation note by \u003ca href\u003d\"https://github.com/mahabaleshwars\"\u003e\u003ccode\u003e​mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1001\"\u003eactions/setup-java#1001\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate readme for ubuntu sudo java_home behavior by \u003ca href\u003d\"https://github.com/mahabaleshwars\"\u003e\u003ccode\u003e​mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1013\"\u003eactions/setup-java#1013\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etemurin: add support for Alpine Linux by \u003ca href\u003d\"https://github.com/gdams\"\u003e\u003ccode\u003e​gdams\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/674\"\u003eactions/setup-java#674\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by \u003ca href\u003d\"https://github.com/gdams\"\u003e\u003ccode\u003e​gdams\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1015\"\u003eactions/setup-java#1015\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​typescript-eslint/eslint-plugin\u003c/code\u003e from 8.35.1 to 8.48.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/952\"\u003eactions/setup-java#952\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump eslint-config-prettier from 8.10.0 to 10.1.8 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/881\"\u003eactions/setup-java#881\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump picomatch, \u003ccode\u003e​types/jest\u003c/code\u003e, jest, jest-circus and ts-jest by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1016\"\u003eactions/setup-java#1016\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​types/node\u003c/code\u003e from 24.1.0 to 25.9.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/950\"\u003eactions/setup-java#950\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImplement pagination with link headers for Adoptium based apis by \u003ca href\u003d\"https://github.com/johnoliver\"\u003e\u003ccode\u003e​johnoliver\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1014\"\u003eactions/setup-java#1014\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake the Adoptopenjdk package type look at the Temurin repo first for latest assets by \u003ca href\u003d\"https://github.com/johnoliver\"\u003e\u003ccode\u003e​johnoliver\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/522\"\u003eactions/setup-java#522\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​vercel/ncc\u003c/code\u003e from 0.38.1 to 0.44.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1018\"\u003eactions/setup-java#1018\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/alaahong\"\u003e\u003ccode\u003e​alaahong\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/969\"\u003eactions/setup-java#969\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/999\"\u003eactions/setup-java#999\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/johnoliver\"\u003e\u003ccode\u003e​johnoliver\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/1014\"\u003eactions/setup-java#1014\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v5...v5.3.0\"\u003ehttps://github.com/actions/setup-java/compare/v5...v5.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/ad2b38190b15e4d6bdf0c97fb4fca8412226d287\"\u003e\u003ccode\u003ead2b381\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​vercel/ncc\u003c/code\u003e from 0.38.1 to 0.44.0 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1018\"\u003e#1018\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/b24df5bba5e9b8a1fcf822c1f0517b7bcc070757\"\u003e\u003ccode\u003eb24df5b\u003c/code\u003e\u003c/a\u003e Make the Adoptopenjdk package type look at the Temurin repo first for latest ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/43120bc3c3d8598724a29b0c856f33e1151591f3\"\u003e\u003ccode\u003e43120bc\u003c/code\u003e\u003c/a\u003e Implement pagination with link headers for Adoptium based apis (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1014\"\u003e#1014\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/ad9d6a632083232d766860674a129059adbcf61a\"\u003e\u003ccode\u003ead9d6a6\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​types/node\u003c/code\u003e from 24.1.0 to 25.9.3 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/950\"\u003e#950\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/039af37997902e61332385d6ba53a0c99379949a\"\u003e\u003ccode\u003e039af37\u003c/code\u003e\u003c/a\u003e Bump picomatch, \u003ccode\u003e​types/jest\u003c/code\u003e, jest, jest-circus and ts-jest (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1016\"\u003e#1016\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/1756ab6acdd8c8f78b33671c220bf78547b2db03\"\u003e\u003ccode\u003e1756ab6\u003c/code\u003e\u003c/a\u003e Bump eslint-config-prettier from 8.10.0 to 10.1.8 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/881\"\u003e#881\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/662bb59f48b4e26f135e9c9a90c42632866e41e3\"\u003e\u003ccode\u003e662bb59\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​typescript-eslint/eslint-plugin\u003c/code\u003e from 8.35.1 to 8.46.2 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/952\"\u003e#952\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/1071fc12d634df380b160287a5e2c9045eb0cad3\"\u003e\u003ccode\u003e1071fc1\u003c/code\u003e\u003c/a\u003e fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/576b821f29a2e03344ca994f84b2ff3c953673ba\"\u003e\u003ccode\u003e576b821\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/674\"\u003e#674\u003c/a\u003e from gdams/alpine\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/307d3a25a0b59c828425a19915c8b94c314c7ca8\"\u003e\u003ccode\u003e307d3a2\u003c/code\u003e\u003c/a\u003e update readme for ubuntu sudo java_home behavior (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/1013\"\u003e#1013\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v5.2.0...v5.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-java\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5.2.0\u0026new-version\u003d5.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7523 from dependabot[bot]/dependabot/github_actions/actions/setup-java-5.3.0.\n\nCloses #7523\n\n83c4ec0a9 [dependabot[bot]] Bump actions/setup-java from 5.2.0 to 5.3.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "1f5ebbf05f3cfe2c118579504868cbf9bb477ecc", "tree": "40587537fe792f9537897be5182f783bcfae76fc", "parents": [ "56caed275784fa09b7f30b6b2ad584eb15784a62" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 22 00:28:02 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Mon Jun 22 00:28:02 2026 +0200" }, "message": "[KYUUBI #7517] Bump actions/setup-java from 5 to 5.2.0\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 5.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancement\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRetry on HTTP 522 Connection timed out by \u003ca href\u003d\"https://github.com/findepi\"\u003e\u003ccode\u003e​findepi\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/964\"\u003eactions/setup-java#964\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate gradle caching by \u003ca href\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/972\"\u003eactions/setup-java#972\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate checkout to v6 by \u003ca href\u003d\"https://github.com/mahabaleshwars\"\u003e\u003ccode\u003e​mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/973\"\u003eactions/setup-java#973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​actions/cache\u003c/code\u003e to v5 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/968\"\u003eactions/setup-java#968\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/checkout from 5 to 6 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/961\"\u003eactions/setup-java#961\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/findepi\"\u003e\u003ccode\u003e​findepi\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/964\"\u003eactions/setup-java#964\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v5...v5.2.0\"\u003ehttps://github.com/actions/setup-java/compare/v5...v5.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eNew Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for \u003ccode\u003e.sdkmanrc\u003c/code\u003e file in \u003ccode\u003ejava-version-file\u003c/code\u003e parameter by \u003ca href\u003d\"https://github.com/guicamest\"\u003e\u003ccode\u003e​guicamest\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/736\"\u003eactions/setup-java#736\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for Microsoft OpenJDK 25 builds by \u003ca href\u003d\"https://github.com/the-mod\"\u003e\u003ccode\u003e​the-mod\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/927\"\u003eactions/setup-java#927\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes \u0026amp; Improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Regex to Support All ASDF Versions for the supported distributions in tool-versions File by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/767\"\u003eactions/setup-java#767\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnhance error logging for network failures to include endpoint/IP details, add retry mechanism and update workflows to use macos-15-intel by \u003ca href\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/946\"\u003eactions/setup-java#946\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate SapMachine URLs by \u003ca href\u003d\"https://github.com/RealCLanger\"\u003e\u003ccode\u003e​RealCLanger\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/955\"\u003eactions/setup-java#955\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd GitHub Token Support for GraalVM and Refactor Code by \u003ca href\u003d\"https://github.com/mahabaleshwars\"\u003e\u003ccode\u003e​mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/849\"\u003eactions/setup-java#849\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate documentation to use checkout and Java v5 by \u003ca href\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e​lmvysakh\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/903\"\u003eactions/setup-java#903\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify JAVA_HOME and PATH setup in README by \u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/841\"\u003eactions/setup-java#841\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade prettier from 2.8.8 to 3.6.2 and document breaking changes in v5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/873\"\u003eactions/setup-java#873\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/publish-action from 0.3.0 to 0.4.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/912\"\u003eactions/setup-java#912\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e​lmvysakh\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/903\"\u003eactions/setup-java#903\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/841\"\u003eactions/setup-java#841\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/the-mod\"\u003e\u003ccode\u003e​the-mod\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/927\"\u003eactions/setup-java#927\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e​priya-kinthali\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/946\"\u003eactions/setup-java#946\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/guicamest\"\u003e\u003ccode\u003e​guicamest\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/736\"\u003eactions/setup-java#736\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v5...v5.1.0\"\u003ehttps://github.com/actions/setup-java/compare/v5...v5.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/dded0888837ed1f317902acf8a20df0ad188d165\"\u003e\u003ccode\u003edded088\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 4 to 5 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/896\"\u003e#896\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/0913e9a06eb8b69c62db76aa61f580c2b3a5b4e0\"\u003e\u003ccode\u003e0913e9a\u003c/code\u003e\u003c/a\u003e Upgrade to node 24 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/888\"\u003e#888\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/e9343db97e09d87a3c50e544105d99fe912c204b\"\u003e\u003ccode\u003ee9343db\u003c/code\u003e\u003c/a\u003e Bumps form-data (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/887\"\u003e#887\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/ae2b61dbc685e60e4427b2e8ed4f0135c6ea8597\"\u003e\u003ccode\u003eae2b61d\u003c/code\u003e\u003c/a\u003e Bump undici from 5.28.5 to 5.29.0 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/833\"\u003e#833\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/c190c18febcf6c040d80b10ea201a05a2c320263\"\u003e\u003ccode\u003ec190c18\u003c/code\u003e\u003c/a\u003e Bump eslint-plugin-jest from 27.9.0 to 29.0.1 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/730\"\u003e#730\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/67aec007b3fcabe15ca665bfccc1e255dd52e30d\"\u003e\u003ccode\u003e67aec00\u003c/code\u003e\u003c/a\u003e Fix: prevent default installation of JetBrains pre-releases (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/859\"\u003e#859\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/ebb356cc4e59bcf94f518203228485f5d40e4b58\"\u003e\u003ccode\u003eebb356c\u003c/code\u003e\u003c/a\u003e Improve Error Handling for Setup-Java Action to Help Debug Intermittent Failu...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/f4f1212c880fdec8162ea9a6493f4495191887b4\"\u003e\u003ccode\u003ef4f1212\u003c/code\u003e\u003c/a\u003e Update publish-immutable-actions.yml (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/798\"\u003e#798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/c5195efecf7bdfc987ee8bae7a71cb8b11521c00\"\u003e\u003ccode\u003ec5195ef\u003c/code\u003e\u003c/a\u003e actions/cache upgrade to 4.0.3 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/773\"\u003e#773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/dd38875f930accc291b5816356a21f72056c0b70\"\u003e\u003ccode\u003edd38875\u003c/code\u003e\u003c/a\u003e Bump ts-jest from 29.1.2 to 29.2.5 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/743\"\u003e#743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v5...v5.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-java\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5\u0026new-version\u003d5.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7517 from dependabot[bot]/dependabot/github_actions/actions/setup-java-5.2.0.\n\nCloses #7517\n\nc53fd11fb [dependabot[bot]] Bump actions/setup-java from 5 to 5.2.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "56caed275784fa09b7f30b6b2ad584eb15784a62", "tree": "0de3d10afe95784b4a1e03e19954cd4c859d0c55", "parents": [ "2f2be44732b9252e3e1be341dcc694ae8affc2f2" ], "author": { "name": "Eric Liu", "email": "y.liu@fetchrewards.com", "time": "Tue Jun 16 20:39:42 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Jun 16 20:39:42 2026 +0800" }, "message": "[KYUUBI #7515] Handle Spark variant type in metadata\n\n### Why are the changes needed?\n\nFixes #7515.\n\nSpark 4 introduced `VariantType`. Kyuubi\u0027s Spark schema conversion did not handle it when building HiveServer2 result-set metadata, so `GetResultSetMetadata` could fail with `Unrecognized type name: variant` even when the query itself completed.\n\nThis patch maps Spark `VariantType` to the existing HiveServer2 `STRING_TYPE` representation for query result-set metadata, and reports `java.sql.Types.OTHER` for `DatabaseMetaData.getColumns` `DATA_TYPE`.\n\n### How was this patch tested?\n\n- Added `SchemaHelperSuite` coverage for `VariantType` mapping to `TTypeId.STRING_TYPE` and `java.sql.Types.OTHER`.\n- Added Spark 4 regression coverage for `SELECT parse_json(\u0027{\"a\":1}\u0027) AS v` result-set metadata.\n- Added Spark 4 regression coverage for `SELECT *` from a dummy table with a `VARIANT` column populated via `parse_json`.\n- Added Spark `getColumns` coverage for reporting `VARIANT` as `java.sql.Types.OTHER`.\n- `dev/reformat`\n- `env JAVA_HOME\u003d/opt/homebrew/opt/openjdk17/libexec/openjdk.jdk/Contents/Home PATH\u003d/opt/homebrew/opt/openjdk17/bin:$PATH ./build/mvn test -pl externals/kyuubi-spark-sql-engine -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.engine.spark.schema.SchemaHelperSuite -Pspark-4.1 -Pscala-2.13`\n- `env JAVA_HOME\u003d/opt/homebrew/opt/openjdk17/libexec/openjdk.jdk/Contents/Home PATH\u003d/opt/homebrew/opt/openjdk17/bin:$PATH ./build/mvn test -pl externals/kyuubi-spark-sql-engine -Dtest\u003dnone -Dsuites\u003dorg.apache.kyuubi.engine.spark.operation.SparkOperationSuite -Pspark-4.1 -Pscala-2.13`\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: OpenAI Codex\n\nCloses #7516 from ericyangliu/kyuubi-7515-variant-metadata.\n\nCloses #7515\n\n5c7a74867 [Eric Liu] [KYUUBI-7515] Handle Spark variant type in metadata\n\nAuthored-by: Eric Liu \u003cy.liu@fetchrewards.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "2f2be44732b9252e3e1be341dcc694ae8affc2f2", "tree": "a173d6cc468a2a9bdbe07631d45cf5578aca3f2c", "parents": [ "db17791c26b8f2b29fd3d92e4dd9a41df19cffdb" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sat Jun 13 20:41:45 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sat Jun 13 20:41:45 2026 +0200" }, "message": "[KYUUBI #7513] Remove broken status badges from README\n\n### Why are the changes needed?\nThe changes are needed to keep README correct and clean from broken links:\n- `tokei` was [deprecated](https://github.com/badges/shields/pull/9581) and added to [retiring-badges](https://github.com/badges/shields/blob/35221ad0c76d93b14b3f4005ea5da98ebdd6598d/doc/retiring-badges.md?plain\u003d1#L135).\n- [`contributor-graph`](https://github.com/api7/contributor-graph) stopped working and has not received updates for a long time.\n\n\u003cimg width\u003d\"979\" height\u003d\"403\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/645566e4-443c-4560-9f3b-ca93b8ea6be0\" /\u003e\n\n### How was this patch tested?\nTested in the [fork branch](https://github.com/dnskr/kyuubi/tree/remove-broken-status-badges#project--community-status).\n\u003cimg width\u003d\"940\" height\u003d\"359\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/22d4d7a3-402b-42bc-8777-2edb680ab57d\" /\u003e\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7513 from dnskr/remove-broken-status-badges.\n\nCloses #7513\n\nec479953e [Denis Krivenko] Remove broken status badges from README\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "db17791c26b8f2b29fd3d92e4dd9a41df19cffdb", "tree": "ac6ef1c533425f88f134400af66b4bc69fa6646b", "parents": [ "cd6a79d168a497ce1f154bce77678a7f6c94f020" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Jun 13 11:25:10 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sat Jun 13 11:25:10 2026 +0200" }, "message": "[KYUUBI #7508] Bump codecov/codecov-action from 6 to 7.0.0\n\nBumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6 to 7.0.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cp\u003e⚠️ Due to migration issues with keybase, we are unable to update our keys under the \u003ccode\u003ecodecovsecurity\u003c/code\u003e account. We have deleted the account and are using \u003ccode\u003ecodecovsecops\u003c/code\u003e with the original gpg key\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: remove Enforce License Compliance workflow by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1950\"\u003ecodecov/codecov-action#1950\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 7.0.0 by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1957\"\u003ecodecov/codecov-action#1957\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cp\u003eThis is a copy of the \u003ccode\u003ev7.0.0\u003c/code\u003e release to make updates easier\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eci: remove Enforce License Compliance workflow by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1950\"\u003ecodecov/codecov-action#1950\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 7.0.0 by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1957\"\u003ecodecov/codecov-action#1957\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: prevent template injection in run: steps (VULN-1652) by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1947\"\u003ecodecov/codecov-action#1947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 6.0.1 by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1949\"\u003ecodecov/codecov-action#1949\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href\u003d\"https://github.com/datalater\"\u003e\u003ccode\u003e​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href\u003d\"https://github.com/webknjaz\"\u003e\u003ccode\u003e​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href\u003d\"https://github.com/jviall\"\u003e\u003ccode\u003e​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href\u003d\"https://github.com/martincostello\"\u003e\u003ccode\u003e​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href\u003d\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href\u003d\"https://github.com/spalmurray\"\u003e\u003ccode\u003e​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href\u003d\"https://github.com/spalmurray\"\u003e\u003ccode\u003e​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href\u003d\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v6...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcodecov/codecov-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6\u0026new-version\u003d7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7508 from dependabot[bot]/dependabot/github_actions/codecov/codecov-action-7.0.0.\n\nCloses #7508\n\nd17e5af8a [dependabot[bot]] Bump codecov/codecov-action from 6 to 7.0.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "cd6a79d168a497ce1f154bce77678a7f6c94f020", "tree": "a91baac4e3b647485f811319fa274e3f4ca8563c", "parents": [ "6f6e0ebff0a99eeaf47b8ad83b7acdc4eeadbf30" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Fri Jun 12 17:49:31 2026 +0800" }, "committer": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Fri Jun 12 17:49:31 2026 +0800" }, "message": "[KYUUBI #7504][UI] Add a Batch management page to the Web UI\n\n### Why are the changes needed?\n\nThe Web UI has Session/Operation/Engine/Server pages but none for batch jobs ([#7504](https://github.com/apache/kyuubi/issues/7504)), so batches can only be inspected via raw REST. This adds a Batch page to list / filter / paginate batches, view their details, open a running batch\u0027s Spark UI (direct, or via the engine-UI proxy when enabled), tail the batch log live, and cancel a non-terminal batch.\n\n### How was this patch tested?\n\n- Unit tests (vitest) in `src/test/unit/views/management/batch/index.spec.ts`: driver-UI link gating by batch state, `getAppUI` proxy/direct URL building, and the log live-tail (incremental offset cursor, stop-on-terminal, buffer cap). `cd kyuubi-server/web-ui \u0026\u0026 npx vitest run` → 13/13; `npm run lint` clean.\n- Manually verified against a running Kyuubi (Spark on Kubernetes and YARN): list / filter / cancel, the driver-UI link showing only for live batches and opening the proxied Spark UI, and the live log tail with auto-scroll.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-8\n\nCloses #7505 from wangzhigang1999/kyuubi-ui-batch-display.\n\nCloses #7504\n\n9cdd12bce [wangzhigang] [KYUUBI #7504][DOC] Add Web UI Batch management page documentation\n9464a935e [wangzhigang] [KYUUBI #7504][UI] Add a Batch management page to the Web UI\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\n" }, { "commit": "6f6e0ebff0a99eeaf47b8ad83b7acdc4eeadbf30", "tree": "c2d2cf84b0a10a3f8e5832101b699324ace67076", "parents": [ "a97592e357e9349cce58b21518ab57bb4bdc4888" ], "author": { "name": "ruanwenjun", "email": "wenjun@apache.org", "time": "Wed Jun 10 17:56:19 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed Jun 10 17:56:19 2026 +0800" }, "message": "[KYUUBI #7495][KUBERNETES] Avoid overlong pod log directory names\n\n### Why are the changes needed?\n\nKyuubi currently limits generated Spark driver pod names and executor pod name prefixes only against the Kubernetes pod name limit.\n\nHowever, kubelet creates pod log directories with the `namespace_podName_podUID` format. When the generated pod name is close to the Kubernetes pod name limit, the log directory name can exceed the Linux path component limit and kubelet fails to create it.\n\nThis patch makes the generated driver pod name and executor pod name prefix reserve the kubelet pod log directory budget. Closes #7495.\n\n### How was this patch tested?\n\n- `env PATH\u003d\"/tmp/kyuubi-black-22.3.0/bin:$PATH\" dev/reformat`\n- `git diff --check HEAD~1..HEAD`\n- `build/mvn test -pl kyuubi-server -am -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.util.KubernetesPodNameSuite`\n- `build/mvn test -pl externals/kyuubi-spark-sql-engine -am -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.engine.spark.SparkSQLEngineSuite`\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: OpenAI Codex (GPT-5)\n\nCloses #7496 from ruanwenjun/kyuubi-7495-pod-log-name.\n\nCloses #7495\n\naa5bc55f3 [ruanwenjun] [KYUUBI #7495] Avoid overlong Kubernetes pod log names\n\nAuthored-by: ruanwenjun \u003cwenjun@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "a97592e357e9349cce58b21518ab57bb4bdc4888", "tree": "36b09084d2ad4701f5214c6163e355eef2ce57e5", "parents": [ "76a5d36d72eefe766611cb704dc619b7e048137f" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Tue Jun 09 16:17:47 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Tue Jun 09 16:17:47 2026 +0200" }, "message": "[KYUUBI #7502] [DOC] Align Python version and style\n\n### Why are the changes needed?\nThe changes align:\n- Python version used for the documentation build in `.github/workflows/docs.yml` with [.readthedocs.yaml](https://github.com/apache/kyuubi/blob/26e3eaa93ea354245866526a697a16f23ed77455/.readthedocs.yaml#L22).\n- Quotes used for strings in `docs/conf.py`.\n\n### How was this patch tested?\nBuilt and verify the documentation.\n```shell\nmake html\n\nopen _build/html/overview/kyuubi_vs_hive.html\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7502 from dnskr/doc-align-python-version-and-style.\n\nCloses #7502\n\n4363c401b [Denis Krivenko] [DOC] Align Python version and style\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "76a5d36d72eefe766611cb704dc619b7e048137f", "tree": "62bb2ef68a45ba88e1598f83838991c67f3d2fd7", "parents": [ "a21408c63d76e611d93d23f03e1372981e726ba1" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Tue Jun 09 16:15:45 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Tue Jun 09 16:15:45 2026 +0200" }, "message": "[KYUUBI #7499] [CI] Use \"ubuntu-slim\" runner for lightweight workflows\n\n### Why are the changes needed?\nThe changes are needed to optimize costs and resource consumption.\nDetails:\n- [Standard GitHub-hosted runners for public repositories](https://docs.github.com/en/actions/reference/runners/github-hosted-runners#standard-github-hosted-runners-for-public-repositories)\n- [Actions runner pricing](https://docs.github.com/en/billing/reference/actions-runner-pricing)\n\n### How was this patch tested?\nReview / CI\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7499 from dnskr/ci-use-ubuntu-slim-runner.\n\nCloses #7499\n\nad679ef54 [Denis Krivenko] [CI] Use \"ubuntu-slim\" runner for lightweight workflows\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "a21408c63d76e611d93d23f03e1372981e726ba1", "tree": "3481c04e089bae2ad730828a86ddd3b569d4a0de", "parents": [ "de20c20323edeec8e5251873cd7769c775fba706" ], "author": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Tue Jun 09 14:32:18 2026 +0900" }, "committer": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Tue Jun 09 14:32:18 2026 +0900" }, "message": "[KYUUBI #7503] [DOC] Document kyuubi.session.local.dir.allow.list is only for Spark engine\n\n### Why are the changes needed?\n\nDocument kyuubi.session.local.dir.allow.list is currently Spark engine only.\n\n### How was this patch tested?\n\nDoc only change\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #7503 from aajisaka/doc-allowlist-limitation.\n\nCloses #7503\n\nbc15a3a5a [Akira Ajisaka] [DOC] Document kyuubi.session.local.dir.allow.list is only for Spark engine\n\nAuthored-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\nSigned-off-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\n" }, { "commit": "de20c20323edeec8e5251873cd7769c775fba706", "tree": "863ea3f683b025a55b7fbb34d4aa4d29afc44774", "parents": [ "84c0c0556de3162d9f704cc6f46c10c0c649a13b" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Sat Jun 06 23:59:52 2026 +0800" }, "committer": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Sat Jun 06 23:59:52 2026 +0800" }, "message": "[KYUUBI #7488][SERVER] Fix canceled batch reporting stale RUNNING application state\n\n### Why are the changes needed?\n\nCloses #7488.\n\nCanceling a RUNNING batch leaves its reported `appState` stuck at `RUNNING` forever: the operation state correctly becomes `CANCELED` and the application is killed, but `getAppState` only reconciles a non-terminal application state for `ERROR` (to `UNKNOWN`), not `CANCELED`, so the stale `RUNNING` is persisted and reported by the REST API. This reconciles `CANCELED` + non-terminal application state to `KILLED`, mirroring the existing `ERROR` handling. Affects master and 1.10.1.\n\n### How was this patch tested?\n\nAdded an assertion to the existing `BatchesResourceSuite` metrics test (v1 and v2): it cancels a RUNNING batch and now asserts the reported `appState` is terminated, which fails on the old behavior (where it stayed `RUNNING`).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-8\n\nCloses #7489 from wangzhigang1999/fix-batch-appstate-after-cancel.\n\nCloses #7488\n\n352ec7938 [wangzhigang] [KYUUBI #7488][SERVER] Fix canceled batch reporting stale RUNNING application state\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\n" }, { "commit": "84c0c0556de3162d9f704cc6f46c10c0c649a13b", "tree": "84dacff02462eeb20e586fab7f9c8760567bfcd4", "parents": [ "a27bd7a57bf3d55fbe66f80b94679ff057261cee" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Jun 06 17:23:02 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sat Jun 06 17:23:02 2026 +0200" }, "message": "[KYUUBI #7501] Bump actions/labeler from 5 to 6\n\nBumps [actions/labeler](https://github.com/actions/labeler) from 5 to 6.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/labeler/releases\"\u003eactions/labeler\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd workflow file for publishing releases to immutable action package by \u003ca href\u003d\"https://github.com/jcambass\"\u003e\u003ccode\u003e​jcambass\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/802\"\u003eactions/labeler#802\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Node.js version to 24 in action and dependencies \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/891\"\u003eactions/labeler#891\u003c/a\u003e\nMake sure your runner is on version v2.327.1 or later to ensure compatibility with this release. \u003ca href\u003d\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade eslint-config-prettier from 9.0.0 to 9.1.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/711\"\u003eactions/labeler#711\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint from 8.52.0 to 8.55.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/720\"\u003eactions/labeler#720\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​types/jest\u003c/code\u003e from 29.5.6 to 29.5.11 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/719\"\u003eactions/labeler#719\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​types/js-yaml\u003c/code\u003e from 4.0.8 to 4.0.9 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/718\"\u003eactions/labeler#718\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​typescript-eslint/parser\u003c/code\u003e from 6.9.0 to 6.14.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/717\"\u003eactions/labeler#717\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade prettier from 3.0.3 to 3.1.1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/726\"\u003eactions/labeler#726\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint from 8.55.0 to 8.56.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/725\"\u003eactions/labeler#725\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​typescript-eslint/parser\u003c/code\u003e from 6.14.0 to 6.19.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/745\"\u003eactions/labeler#745\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-jest from 27.4.3 to 27.6.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/744\"\u003eactions/labeler#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​typescript-eslint/eslint-plugin\u003c/code\u003e from 6.9.0 to 6.20.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/750\"\u003eactions/labeler#750\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade prettier from 3.1.1 to 3.2.5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/752\"\u003eactions/labeler#752\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade undici from 5.26.5 to 5.28.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/757\"\u003eactions/labeler#757\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade braces from 3.0.2 to 3.0.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/789\"\u003eactions/labeler#789\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade minimatch from 9.0.3 to 10.0.1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/805\"\u003eactions/labeler#805\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​actions/core\u003c/code\u003e from 1.10.1 to 1.11.1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/811\"\u003eactions/labeler#811\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade typescript from 5.4.3 to 5.7.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/819\"\u003eactions/labeler#819\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​typescript-eslint/parser\u003c/code\u003e from 7.3.1 to 8.17.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/824\"\u003eactions/labeler#824\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade prettier from 3.2.5 to 3.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/825\"\u003eactions/labeler#825\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​types/jest\u003c/code\u003e from 29.5.12 to 29.5.14 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/827\"\u003eactions/labeler#827\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-jest from 27.9.0 to 28.9.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/832\"\u003eactions/labeler#832\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade ts-jest from 29.1.2 to 29.2.5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/831\"\u003eactions/labeler#831\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​vercel/ncc\u003c/code\u003e from 0.38.1 to 0.38.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/830\"\u003eactions/labeler#830\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade typescript from 5.7.2 to 5.7.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/835\"\u003eactions/labeler#835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-jest from 28.9.0 to 28.11.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/839\"\u003eactions/labeler#839\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade undici from 5.28.4 to 5.28.5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/842\"\u003eactions/labeler#842\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​octokit/request-error\u003c/code\u003e from 5.0.1 to 5.1.1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/846\"\u003eactions/labeler#846\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd note regarding \u003ccode\u003epull_request_target\u003c/code\u003e to README.md by \u003ca href\u003d\"https://github.com/silverwind\"\u003e\u003ccode\u003e​silverwind\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/669\"\u003eactions/labeler#669\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate readme with additional examples and important note about \u003ccode\u003epull_request_target\u003c/code\u003e event by \u003ca href\u003d\"https://github.com/IvanZosimov\"\u003e\u003ccode\u003e​IvanZosimov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/721\"\u003eactions/labeler#721\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument update - permission section by \u003ca href\u003d\"https://github.com/harithavattikuti\"\u003e\u003ccode\u003e​harithavattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/840\"\u003eactions/labeler#840\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprovement in documentation for pull_request_target event usage in README by \u003ca href\u003d\"https://github.com/suyashgaonkar\"\u003e\u003ccode\u003e​suyashgaonkar\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/871\"\u003eactions/labeler#871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix broken links in documentation by \u003ca href\u003d\"https://github.com/suyashgaonkar\"\u003e\u003ccode\u003e​suyashgaonkar\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/822\"\u003eactions/labeler#822\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/silverwind\"\u003e\u003ccode\u003e​silverwind\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/669\"\u003eactions/labeler#669\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Jcambass\"\u003e\u003ccode\u003e​Jcambass\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/802\"\u003eactions/labeler#802\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/suyashgaonkar\"\u003e\u003ccode\u003e​suyashgaonkar\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/822\"\u003eactions/labeler#822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/840\"\u003eactions/labeler#840\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/labeler/pull/891\"\u003eactions/labeler#891\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213\"\u003e\u003ccode\u003ef27b608\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies (\u003ccode\u003e​actions/core\u003c/code\u003e, \u003ccode\u003e​actions/github\u003c/code\u003e, js-yaml, minimat...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904\"\u003e\u003ccode\u003ec5dadc2\u003c/code\u003e\u003c/a\u003e Add \u0027changed-files-labels-limit\u0027 and \u0027max-files-changed\u0027 configs to allow cap...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f\"\u003e\u003ccode\u003ee52e4fb\u003c/code\u003e\u003c/a\u003e Bump minimatch from 10.0.1 to 10.2.3 (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250\"\u003e\u003ccode\u003e77a4082\u003c/code\u003e\u003c/a\u003e Fix: Preserve manually added labels during workflow run and refine label sync...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a\"\u003e\u003ccode\u003e25abb3c\u003c/code\u003e\u003c/a\u003e Improve Labeler Action Documentation and Error Handling for Permissions (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/897\"\u003e#897\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd\"\u003e\u003ccode\u003e395c8cf\u003c/code\u003e\u003c/a\u003e Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/634933edcd8ababfe52f92936142cc22ac488b1b\"\u003e\u003ccode\u003e634933e\u003c/code\u003e\u003c/a\u003e publish-action upgrade to 0.4.0 from 0.2.2 (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/901\"\u003e#901\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/f1a63e87db0c6baf19c5713083f8d00d789ca184\"\u003e\u003ccode\u003ef1a63e8\u003c/code\u003e\u003c/a\u003e Update Node.js version to 24 in action and dependencies (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/891\"\u003e#891\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/b0a1180683c9f17424de4d71c044bea4c7b9bc7c\"\u003e\u003ccode\u003eb0a1180\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​octokit/request-error\u003c/code\u003e from 5.0.1 to 5.1.1 (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/846\"\u003e#846\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/labeler/commit/110d44140c9195b853f2f24044bbfed8f4968efb\"\u003e\u003ccode\u003e110d441\u003c/code\u003e\u003c/a\u003e Update README.md (\u003ca href\u003d\"https://redirect.github.com/actions/labeler/issues/871\"\u003e#871\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/labeler/compare/v5...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/labeler\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5\u0026new-version\u003d6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7501 from dependabot[bot]/dependabot/github_actions/actions/labeler-6.\n\nCloses #7501\n\n73337a7d9 [dependabot[bot]] Bump actions/labeler from 5 to 6\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "a27bd7a57bf3d55fbe66f80b94679ff057261cee", "tree": "02fdd889d44e7674c73c0898ea1b6ee23fd58080", "parents": [ "26e3eaa93ea354245866526a697a16f23ed77455" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Jun 06 17:21:13 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sat Jun 06 17:21:13 2026 +0200" }, "message": "[KYUUBI #7500] Bump actions/checkout from 6.0.2 to 6.0.3\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate changelog by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2357\"\u003eactions/checkout#2357\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate changelog for v6.0.3 by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2446\"\u003eactions/checkout#2446\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e​yaananth\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6...v6.0.3\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.3\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca href\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10\"\u003e\u003ccode\u003edf4cb1c\u003c/code\u003e\u003c/a\u003e Update changelog for v6.0.3 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2446\"\u003e#2446\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824\"\u003e\u003ccode\u003e1cce339\u003c/code\u003e\u003c/a\u003e Fix checkout init for SHA-256 repositories (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2439\"\u003e#2439\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231\"\u003e\u003ccode\u003e900f221\u003c/code\u003e\u003c/a\u003e fix: expand merge commit SHA regex and add SHA-256 test cases (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2414\"\u003e#2414\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98\"\u003e\u003ccode\u003e0c366fd\u003c/code\u003e\u003c/a\u003e Update changelog (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/2357\"\u003e#2357\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6.0.2...v6.0.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/checkout\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6.0.2\u0026new-version\u003d6.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7500 from dependabot[bot]/dependabot/github_actions/actions/checkout-6.0.3.\n\nCloses #7500\n\n22668e21d [dependabot[bot]] Bump actions/checkout from 6.0.2 to 6.0.3\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "26e3eaa93ea354245866526a697a16f23ed77455", "tree": "64c0fa958cce1d51b5edc8229ec5a8232c8b4007", "parents": [ "49954ee4f8523ff851d2e1f5174fc90a8fd54487" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Jun 06 14:35:54 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sat Jun 06 14:35:54 2026 +0200" }, "message": "[KYUUBI #7494] Bump docker/build-push-action from 7.1.0 to 7.2.0\n\nBumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.1.0 to 7.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/build-push-action/releases\"\u003edocker/build-push-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1525\"\u003edocker/build-push-action#1525\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.87.0 to 0.90.0 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1517\"\u003edocker/build-push-action#1517\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 2.0.2 to 5.0.6 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1534\"\u003edocker/build-push-action#1534\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.1.4 to 1.2.0 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1529\"\u003edocker/build-push-action#1529\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.5.7 to 5.8.0 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1521\"\u003edocker/build-push-action#1521\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1526\"\u003edocker/build-push-action#1526\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1533\"\u003edocker/build-push-action#1533\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0\"\u003ehttps://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/f9f3042f7e2789586610d6e8b85c8f03e5195baf\"\u003e\u003ccode\u003ef9f3042\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1517\"\u003e#1517\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-t...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/812d5fd9212a4c5d419e5be02fd8e9bb435c5d76\"\u003e\u003ccode\u003e812d5fd\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/b6f66930769f2917a3275dc4d81f15583ac7e105\"\u003e\u003ccode\u003eb6f6693\u003c/code\u003e\u003c/a\u003e chore(deps): Bump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.87.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/c1c626eced73a500ec65c4256c620b3b9e8278c0\"\u003e\u003ccode\u003ec1c626e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1525\"\u003e#1525\u003c/a\u003e from docker/dependabot/npm_and_yarn/actions/core-3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/51bb284cd4d05650aa6f5e4e22cb96d2cbfe62b7\"\u003e\u003ccode\u003e51bb284\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/5f7884def8f133e8ef40c53d003d1471c05621c6\"\u003e\u003ccode\u003e5f7884d\u003c/code\u003e\u003c/a\u003e chore(deps): Bump \u003ccode\u003e​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/e01deff7d956c756a20f3e19ff7ddc0e4a50fc1d\"\u003e\u003ccode\u003ee01deff\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1521\"\u003e#1521\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/3804d497934b39bd591ee9d1c6c9e593b4488a67\"\u003e\u003ccode\u003e3804d49\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/71e8947aac5dad23ce83a43e9c98f750e02de2f3\"\u003e\u003ccode\u003e71e8947\u003c/code\u003e\u003c/a\u003e chore(deps): Bump fast-xml-parser from 5.5.7 to 5.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/4925ad24cdbc42ff492d76cf9fe7a30b79976b60\"\u003e\u003ccode\u003e4925ad2\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1526\"\u003e#1526\u003c/a\u003e from docker/dependabot/npm_and_yarn/postcss-8.5.10\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/build-push-action/compare/bcafcacb16a39f128d818304e6c9c0c18556b85f...f9f3042f7e2789586610d6e8b85c8f03e5195baf\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nCloses #7494 from dependabot[bot]/dependabot/github_actions/docker/build-push-action-7.2.0.\n\nCloses #7494\n\ne3b69307a [dependabot[bot]] Bump docker/build-push-action from 7.1.0 to 7.2.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "49954ee4f8523ff851d2e1f5174fc90a8fd54487", "tree": "6d39b51f9ab66769eb2df5fc28f53e2ab92d562d", "parents": [ "077db39f5748b95ef8a86473d7287516bdb37202" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Jun 06 01:13:35 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sat Jun 06 01:13:35 2026 +0200" }, "message": "[KYUUBI #7491] Bump docker/setup-qemu-action from 4.0.0 to 4.1.0\n\nBumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.0.0 to 4.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/setup-qemu-action/releases\"\u003edocker/setup-qemu-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ereset\u003c/code\u003e input to uninstall current emulators by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/21\"\u003edocker/setup-qemu-action#21\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.77.0 to 0.91.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/250\"\u003edocker/setup-qemu-action#250\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/247\"\u003edocker/setup-qemu-action#247\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.12 to 1.1.15 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/265\"\u003edocker/setup-qemu-action#265\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.0.0 to 1.2.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/286\"\u003edocker/setup-qemu-action#286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.4.2 to 5.8.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/255\"\u003edocker/setup-qemu-action#255\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.3 to 3.4.2 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/257\"\u003edocker/setup-qemu-action#257\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump glob from 10.3.15 to 10.5.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/254\"\u003edocker/setup-qemu-action#254\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump handlebars from 4.7.8 to 4.7.9 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/262\"\u003edocker/setup-qemu-action#262\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.23 to 4.18.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/273\"\u003edocker/setup-qemu-action#273\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/285\"\u003edocker/setup-qemu-action#285\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/287\"\u003edocker/setup-qemu-action#287\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tmp from 0.2.5 to 0.2.6 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/291\"\u003edocker/setup-qemu-action#291\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.23.0 to 6.26.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/251\"\u003edocker/setup-qemu-action#251\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.2 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/pull/271\"\u003edocker/setup-qemu-action#271\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/setup-qemu-action/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/docker/setup-qemu-action/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/06116385d9baf250c9f4dcb4858b16962ea869c3\"\u003e\u003ccode\u003e0611638\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/21\"\u003e#21\u003c/a\u003e from crazy-max/uninst\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/ce59c818a5ff16552ddf7407ee7cb00bea682925\"\u003e\u003ccode\u003ece59c81\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/2ddad4401e17fa807e8a3c4bd289ccdd993f0868\"\u003e\u003ccode\u003e2ddad44\u003c/code\u003e\u003c/a\u003e uninstall current emulators\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/8c37cd6f3456e1f3f3026250eac496709e9e7e10\"\u003e\u003ccode\u003e8c37cd6\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/250\"\u003e#250\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/d1a0ff34af591b8e290e46f3fa114ef5bb81cd1c\"\u003e\u003ccode\u003ed1a0ff3\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/0a8f3dc12541cc2c3b19c182a1a2c90a2c8b8d93\"\u003e\u003ccode\u003e0a8f3dc\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.91.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/9430f61a7691bd1bfdc4d6ba70e558659d36fa7a\"\u003e\u003ccode\u003e9430f61\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/291\"\u003e#291\u003c/a\u003e from docker/dependabot/npm_and_yarn/tmp-0.2.6\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/978bd7796cb6698377e7af6726b726e5ced642d0\"\u003e\u003ccode\u003e978bd77\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/3479febc62cc0fbcb98c7c7fc0dac778c0d79d6a\"\u003e\u003ccode\u003e3479feb\u003c/code\u003e\u003c/a\u003e build(deps): bump tmp from 0.2.5 to 0.2.6\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-qemu-action/commit/b113c264143c28c2974bed61af25be32d32f4782\"\u003e\u003ccode\u003eb113c26\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-qemu-action/issues/255\"\u003e#255\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/setup-qemu-action/compare/ce360397dd3f832beb865e1373c09c0e9f86d70a...06116385d9baf250c9f4dcb4858b16962ea869c3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nCloses #7491 from dependabot[bot]/dependabot/github_actions/docker/setup-qemu-action-4.1.0.\n\nCloses #7491\n\n703fff751 [dependabot[bot]] Bump docker/setup-qemu-action from 4.0.0 to 4.1.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "077db39f5748b95ef8a86473d7287516bdb37202", "tree": "4489f9881baf19f42982a4e5cfff6371b3140655", "parents": [ "9307870fe954c69cc1b9dfa274d8511746940640" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jun 05 22:15:09 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 05 22:15:09 2026 +0200" }, "message": "[KYUUBI #7493] Bump docker/login-action from 4.0.0 to 4.2.0\n\nBumps [docker/login-action](https://github.com/docker/login-action) from 4.0.0 to 4.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/login-action/releases\"\u003edocker/login-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/976\"\u003edocker/login-action#976\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1050.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/960\"\u003edocker/login-action#960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.86.0 to 0.90.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/970\"\u003edocker/login-action#970\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 2.0.1 to 5.0.6 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/993\"\u003edocker/login-action#993\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.1.4 to 1.2.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/985\"\u003edocker/login-action#985\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.3.6 to 5.8.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/963\"\u003edocker/login-action#963\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump http-proxy-agent and https-proxy-agent to 9.0.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/961\"\u003edocker/login-action#961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/979\"\u003edocker/login-action#979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/991\"\u003edocker/login-action#991\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.3 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/986\"\u003edocker/login-action#986\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/login-action/compare/v4.1.0...v4.2.0\"\u003ehttps://github.com/docker/login-action/compare/v4.1.0...v4.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix scoped Docker Hub cleanup path when registry is omitted by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/945\"\u003edocker/login-action#945\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​aws-sdk/client-ecr\u003c/code\u003e and \u003ccode\u003e​aws-sdk/client-ecr-public\u003c/code\u003e to 3.1020.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/930\"\u003edocker/login-action#930\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.77.0 to 0.86.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/932\"\u003edocker/login-action#932\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/936\"\u003edocker/login-action#936\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.12 to 1.1.13 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/952\"\u003edocker/login-action#952\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.3.4 to 5.3.6 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/942\"\u003edocker/login-action#942\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.3 to 3.4.2 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/944\"\u003edocker/login-action#944\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump glob from 10.3.12 to 10.5.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/940\"\u003edocker/login-action#940\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump handlebars from 4.7.8 to 4.7.9 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/949\"\u003edocker/login-action#949\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump http-proxy-agent and https-proxy-agent to 8.0.0 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/937\"\u003edocker/login-action#937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.23 to 4.18.1 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/958\"\u003edocker/login-action#958\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump minimatch from 3.1.2 to 3.1.5 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/941\"\u003edocker/login-action#941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump picomatch from 4.0.3 to 4.0.4 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/948\"\u003edocker/login-action#948\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.23.0 to 6.24.1 in \u003ca href\u003d\"https://redirect.github.com/docker/login-action/pull/938\"\u003edocker/login-action#938\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/login-action/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/docker/login-action/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/650006c6eb7dba73a995cc03b0b2d7f5ca915bee\"\u003e\u003ccode\u003e650006c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/960\"\u003e#960\u003c/a\u003e from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/99df1a3f6d65e48177ea57671a50e2242eae4b63\"\u003e\u003ccode\u003e99df1a3\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/3ab375f324f46da5f6901efeda4be4e2566ebaa2\"\u003e\u003ccode\u003e3ab375f\u003c/code\u003e\u003c/a\u003e build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/39d85804ae465a1816c68ff58158ec66883981b4\"\u003e\u003ccode\u003e39d8580\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/970\"\u003e#970\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/4eefcd33ca7213989697445a78b6730274bfaba6\"\u003e\u003ccode\u003e4eefcd3\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/56d092c8b3f04006c22f4fc20a2b3d2442caed56\"\u003e\u003ccode\u003e56d092c\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.86.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/e2e31ca87063ae00fd41ad3b9c548dd8ec24c5ff\"\u003e\u003ccode\u003ee2e31ca\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/976\"\u003e#976\u003c/a\u003e from docker/dependabot/npm_and_yarn/actions/core-3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/0bced941e843afc786fbfd58b1c6c13ca11e09c9\"\u003e\u003ccode\u003e0bced94\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/3e75a0f266b07e09777a621d0ca5f4432ef9f10c\"\u003e\u003ccode\u003e3e75a0f\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e​actions/core\u003c/code\u003e from 3.0.0 to 3.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/login-action/commit/365bebd9d646160567ebad47824f026e09ee6970\"\u003e\u003ccode\u003e365bebd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/login-action/issues/984\"\u003e#984\u003c/a\u003e from docker/dependabot/github_actions/aws-actions/con...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/login-action/compare/b45d80f862d83dbcd57f89517bcf500b2ab88fb2...650006c6eb7dba73a995cc03b0b2d7f5ca915bee\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/login-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4.0.0\u0026new-version\u003d4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7493 from dependabot[bot]/dependabot/github_actions/docker/login-action-4.2.0.\n\nCloses #7493\n\n77898d088 [dependabot[bot]] Bump docker/login-action from 4.0.0 to 4.2.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "9307870fe954c69cc1b9dfa274d8511746940640", "tree": "de3c63a7d5a5b419fb5905426acdee0e5a534850", "parents": [ "2e5719018d0aef702128c7bc3223cee8325a88ad" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jun 05 22:13:28 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 05 22:13:28 2026 +0200" }, "message": "[KYUUBI #7492] Bump actions/checkout from 6 to 6.0.2\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6 to 6.0.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by \u003ca href\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2355\"\u003eactions/checkout#2355\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6.0.1...v6.0.2\"\u003ehttps://github.com/actions/checkout/compare/v6.0.1...v6.0.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all references from v5 and v4 to v6 by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2314\"\u003eactions/checkout#2314\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eClarify v6 README by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2328\"\u003eactions/checkout#2328\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6...v6.0.1\"\u003ehttps://github.com/actions/checkout/compare/v6...v6.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca href\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca href\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e​motss\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca href\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca href\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca href\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca href\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e​TingluoHuang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment variables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca href\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Ref and Commit outputs by \u003ca href\u003d\"https://github.com/lucacome\"\u003e\u003ccode\u003e​lucacome\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1180\"\u003eactions/checkout#1180\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDependency updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e- \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1777\"\u003eactions/checkout#1777\u003c/a\u003e, \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1872\"\u003eactions/checkout#1872\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 4 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1739\"\u003eactions/checkout#1739\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 3 to 4 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1697\"\u003eactions/checkout#1697\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCheck out other refs/* by commit by \u003ca href\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1774\"\u003eactions/checkout#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/checkout\u0027s own workflows to a known, good, stable version. by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1776\"\u003eactions/checkout#1776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck platform to set archive extension appropriately by \u003ca href\u003d\"https://github.com/cory-miller\"\u003e\u003ccode\u003e​cory-miller\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/checkout/pull/1732\"\u003eactions/checkout#1732\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.1.5\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/6d193bf28034eafb982f37bd894289fe649468fc\"\u003e\u003ccode\u003e6d193bf\u003c/code\u003e\u003c/a\u003e Bump braces from 3.0.2 to 3.0.3 (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/1777\"\u003e#1777\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/db0cee9a514becbbd4a101a5fbbbf47865ee316c\"\u003e\u003ccode\u003edb0cee9\u003c/code\u003e\u003c/a\u003e Bump the minor-npm-dependencies group across 1 directory with 4 updates (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/1872\"\u003e#1872\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/b6849436894e144dbce29d7d7fda2ae3bf9d8365\"\u003e\u003ccode\u003eb684943\u003c/code\u003e\u003c/a\u003e Add Ref and Commit outputs (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/1180\"\u003e#1180\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/checkout/commit/2d7d9f7ff5b310f983d059b68785b3c74d8b8edd\"\u003e\u003ccode\u003e2d7d9f7\u003c/code\u003e\u003c/a\u003e Provide explanation for where user email came from (\u003ca href\u003d\"https://redirect.github.com/actions/checkout/issues/1869\"\u003e#1869\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/checkout/compare/v6...v6.0.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/checkout\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6\u0026new-version\u003d6.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7492 from dependabot[bot]/dependabot/github_actions/actions/checkout-6.0.2.\n\nCloses #7492\n\n9dd983909 [dependabot[bot]] Bump actions/checkout from 6 to 6.0.2\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "2e5719018d0aef702128c7bc3223cee8325a88ad", "tree": "c96593e69c20012d1f8c67db9bbd4574c3632259", "parents": [ "56a3e9c7643f99ff7db1c3124bed33258ca67c3e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Jun 05 22:09:32 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 05 22:09:32 2026 +0200" }, "message": "[KYUUBI #7490] Bump actions/stale from 10.2.0 to 10.3.0\n\nBumps [actions/stale](https://github.com/actions/stale) from 10.2.0 to 10.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/stale/releases\"\u003eactions/stale\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnhancement: ignore stale labeling events by \u003ca href\u003d\"https://github.com/shamoon\"\u003e\u003ccode\u003e​shamoon\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1311\"\u003eactions/stale#1311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade dependencies (\u003ccode\u003e​actions/core\u003c/code\u003e, \u003ccode\u003e​octokit/plugin-retry\u003c/code\u003e, \u003ca href\u003d\"https://github.com/typescript-eslint\"\u003e\u003ccode\u003e​typescript-eslint\u003c/code\u003e\u003c/a\u003e) by \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1335\"\u003eactions/stale#1335\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/shamoon\"\u003e\u003ccode\u003e​shamoon\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1311\"\u003eactions/stale#1311\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/stale/compare/v10...v10.3.0\"\u003ehttps://github.com/actions/stale/compare/v10...v10.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899\"\u003e\u003ccode\u003eeb5cf3a\u003c/code\u003e\u003c/a\u003e chore: upgrade dependencies and bump version to 10.3.0 (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/db5d06a4c82d5e94513c09c406638111df61f63e\"\u003e\u003ccode\u003edb5d06a\u003c/code\u003e\u003c/a\u003e Enhancement: ignore stale labeling events (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1311\"\u003e#1311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/actions/stale/compare/v10.2.0...v10.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/stale\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d10.2.0\u0026new-version\u003d10.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7490 from dependabot[bot]/dependabot/github_actions/actions/stale-10.3.0.\n\nCloses #7490\n\ncd729b43f [dependabot[bot]] Bump actions/stale from 10.2.0 to 10.3.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "56a3e9c7643f99ff7db1c3124bed33258ca67c3e", "tree": "da508d3fe378e97f5986123c76ace754bab02fec", "parents": [ "7067644e1bf469a761b0516ce73b432a2ebf9f9d" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 05 22:02:35 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri Jun 05 22:02:35 2026 +0200" }, "message": "[KYUUBI #7485] [CI] Run \"Docs\" workflow for documentation changes only\n\n### Why are the changes needed?\nThese changes are needed to prevent unnecessary `Docs` workflow runs by ensuring they only trigger when files in `docs/**` or the workflow itself are changed.\n\nAlso updated `.github/workflows/master.yml` and `.github/workflows/python.yml` to ignore changes in `.github/workflows/docs.yml`, preventing redundant triggers of the main test suites when only documentation workflow updated.\n\n### How was this patch tested?\nReview/CI\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7485 from dnskr/docs-path-filters-to-workflow.\n\nCloses #7485\n\n5bd9f7432 [Denis Krivenko] [CI] Run \"Docs\" workflow for documentation changes only\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "7067644e1bf469a761b0516ce73b432a2ebf9f9d", "tree": "9c026d85ae3c90740090120ea60bdf58c5e73fee", "parents": [ "aa58942b57eb21a67ce97a4b6404b2d9c0cce878" ], "author": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Tue Jun 02 15:28:25 2026 +0900" }, "committer": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Tue Jun 02 15:28:25 2026 +0900" }, "message": "[KYUUBI #7483] Restrict Engine UI proxy targets\n\n### Why are the changes needed?\n\nAllow Kyuubi server admin to explicitly configure the proxy destinations or even disable the proxy.\n\nAdd the below 2 parameters:\n\n- kyuubi.frontend.rest.engine.ui.proxy.enabled (default: false): Whether to route\n Engine UI traffic via Kyuubi REST frontend proxy. When disabled, the Web UI links\n directly to the Kyuubi engine URL.\n- kyuubi.frontend.rest.engine.ui.proxy.hosts (default: none): A comma-separated list\n of hosts that Engine UI proxy requests can route to when\n `kyuubi.frontend.rest.engine.ui.proxy.enabled` is enabled. Wildcard is allowed.\n\n### How was this patch tested?\n\nBuilt Kyuubi and verified locally\n```\n# Build Kyuubi\n./build/dist --web-ui\n# Run Kyuubi Server\n./dist/bin/kyuubi start\n# Start Kyuubi Engine\n./dist/bin/kyuubi-beeline -u \u0027jdbc:hive2://\u003cyour local IP address\u003e:10009/\u0027 -n anonymous\n# Browse Web UI (http://localhost:10009)\n```\nAlso, added unit tests.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: OpenCode (GPT-5.5)\n\nCloses #7483 from aajisaka/kyuubi-restrict-engine-ui.\n\nCloses #7483\n\ndf814c31c [Akira Ajisaka] Update migration guide\n07878fc5c [Akira Ajisaka] Strict host validation\nf049349fd [Akira Ajisaka] Align Engine UI proxy configuration\n7b84f1435 [Akira Ajisaka] Restrict Engine UI proxy targets\n\nAuthored-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\nSigned-off-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\n" }, { "commit": "aa58942b57eb21a67ce97a4b6404b2d9c0cce878", "tree": "f84bf52e97b3e6de4e5df60ea8143666c830ae24", "parents": [ "f84132aea1afaa36c1ceecc7d1288a591add4d85" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sun May 31 16:11:02 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Sun May 31 16:11:02 2026 +0200" }, "message": "[KYUUBI #7475] [CI] Add ASF allowlist check workflow\n\n### Why are the changes needed?\nThese changes are needed to ensure compliancy with [ASF GitHub Actions Policy](https://infra.apache.org/github-actions-policy.html).\n\nThe workflow verifies all `uses:` refs in a project\u0027s workflow files are on the ASF Infrastructure [approved allowlist](https://github.com/apache/infrastructure-actions/blob/d3e898ebd3169ee0a078359ff8434a09cd081375/approved_patterns.yml).\nIt catches violations before merge, preventing the silent CI failures that occur when an action is not on the org-level allowlist.\nSee more details [here](https://github.com/apache/infrastructure-actions/blob/d3e898ebd3169ee0a078359ff8434a09cd081375/allowlist-check/README.md).\n\nRelated to [[Umbrella] Ensure GitHub Actions compliance with ASF Policy #7456](https://github.com/apache/kyuubi/issues/7456).\n\nSimilar PRs:\n - https://github.com/apache/airflow/pull/64450\n - https://github.com/apache/iceberg/pull/15797\n - https://github.com/apache/hive/pull/6417\n\n### How was this patch tested?\nReview.\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7475 from dnskr/add-asf-allowlist-check.\n\nCloses #7475\n\n8736a3414 [Denis Krivenko] Use ubuntu-slim runner for ASF Allowlist Check\naa8e87bb4 [Denis Krivenko] Replace \u0027Horizontal Tab\u0027 symbol with space\ncb0eb281c [Denis Krivenko] [CI] Add ASF allowlist check workflow\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "f84132aea1afaa36c1ceecc7d1288a591add4d85", "tree": "795aff3c40486a90273cd4c1d786d98eec9e1b07", "parents": [ "7f7b7c12481a525f21fa7be78bf76d6e2ccf5880" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun May 31 01:43:32 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Sun May 31 01:43:32 2026 +0800" }, "message": "[KYUUBI #7480] Bump actions/dependency-review-action from 4 to 5\n\nBumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4 to 5.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/dependency-review-action/releases\"\u003eactions/dependency-review-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e5.0.0\u003c/h2\u003e\n\u003cp\u003eThis is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version \u003ca href\u003d\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003ev2.327.1\u003c/a\u003e to run.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd .github/copilot-instructions.md for Copilot coding agent by \u003ca href\u003d\"https://github.com/ahpook\"\u003e\u003ccode\u003e​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1067\"\u003eactions/dependency-review-action#1067\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate Node.js runtime from 20 to 24 by \u003ca href\u003d\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e​scottschreckengaust\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump spdx-license-ids from 3.0.20 to 3.0.23 by \u003ca href\u003d\"https://github.com/mongolyy\"\u003e\u003ccode\u003e​mongolyy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: bump actions/checkout from v4 to v6 in workflow examples by \u003ca href\u003d\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e​Marukome0743\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by \u003ca href\u003d\"https://github.com/tspascoal\"\u003e\u003ccode\u003e​tspascoal\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1076\"\u003eactions/dependency-review-action#1076\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve security findings by \u003ca href\u003d\"https://github.com/AshelyTC\"\u003e\u003ccode\u003e​AshelyTC\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1094\"\u003eactions/dependency-review-action#1094\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ev5.0.0 release branch by \u003ca href\u003d\"https://github.com/ahpook\"\u003e\u003ccode\u003e​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1098\"\u003eactions/dependency-review-action#1098\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/scottschreckengaust\"\u003e\u003ccode\u003e​scottschreckengaust\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1084\"\u003eactions/dependency-review-action#1084\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mongolyy\"\u003e\u003ccode\u003e​mongolyy\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1091\"\u003eactions/dependency-review-action#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Marukome0743\"\u003e\u003ccode\u003e​Marukome0743\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1077\"\u003eactions/dependency-review-action#1077\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eDependency Review Action 4.9.0\u003c/h2\u003e\n\u003cp\u003eThis feature release contains a couple of notable changes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThere is a new configuration option \u003ccode\u003eshow_patched_versions\u003c/code\u003e which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks \u003ca href\u003d\"https://github.com/felickz\"\u003e\u003ccode\u003e​felickz\u003c/code\u003e\u003c/a\u003e!\u003c/li\u003e\n\u003cli\u003eRuns which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch \u003ca href\u003d\"https://github.com/jantiebot\"\u003e\u003ccode\u003e​jantiebot\u003c/code\u003e\u003c/a\u003e!\u003c/li\u003e\n\u003cli\u003eThere are a couple of fixes to purl parsing which should improve match accuracy for \u003ccode\u003eallow-package-dependency\u003c/code\u003e lists, including case (in)sensitivity and url-encoded namespaces Thanks \u003ca href\u003d\"https://github.com/juxtin\"\u003e\u003ccode\u003e​juxtin\u003c/code\u003e\u003c/a\u003e!\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCompare normalized purls to account for encoding quirks by \u003ca href\u003d\"https://github.com/juxtin\"\u003e\u003ccode\u003e​juxtin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1056\"\u003eactions/dependency-review-action#1056\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake purl comparisons case insensitive by \u003ca href\u003d\"https://github.com/juxtin\"\u003e\u003ccode\u003e​juxtin\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1057\"\u003eactions/dependency-review-action#1057\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFeat: Add \u003ccode\u003ePatched Version\u003c/code\u003e to \u003ccode\u003eVulnerabilities\u003c/code\u003e summary by \u003ca href\u003d\"https://github.com/felickz\"\u003e\u003ccode\u003e​felickz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1045\"\u003eactions/dependency-review-action#1045\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: only get scorecard levels if user wants to see the OpenSSF scorecard by \u003ca href\u003d\"https://github.com/jantiebot\"\u003e\u003ccode\u003e​jantiebot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1060\"\u003eactions/dependency-review-action#1060\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/stale from 10.1.0 to 10.2.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1058\"\u003eactions/dependency-review-action#1058\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 4 to 6 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1021\"\u003eactions/dependency-review-action#1021\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdates for release 4.9.0 by \u003ca href\u003d\"https://github.com/ahpook\"\u003e\u003ccode\u003e​ahpook\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1064\"\u003eactions/dependency-review-action#1064\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jantiebot\"\u003e\u003ccode\u003e​jantiebot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1060\"\u003eactions/dependency-review-action#1060\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/dependency-review-action/compare/v4.8.3...v4.9.0\"\u003ehttps://github.com/actions/dependency-review-action/compare/v4.8.3...v4.9.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e4.8.3\u003c/h2\u003e\n\u003ch2\u003eDependency Review Action v4.8.3\u003c/h2\u003e\n\u003cp\u003eThis is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.\u003c/p\u003e\n\u003cp\u003eWe have also updated the release process to use a long-lived \u003ccode\u003ev4\u003c/code\u003e \u003cstrong\u003ebranch\u003c/strong\u003e for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eGitHub Actions can\u0027t push to our protected main by \u003ca href\u003d\"https://github.com/dangoor\"\u003e\u003ccode\u003e​dangoor\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/1017\"\u003eactions/dependency-review-action#1017\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/stale from 9.1.0 to 10.1.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/pull/995\"\u003eactions/dependency-review-action#995\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294\"\u003e\u003ccode\u003ea1d282b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/issues/1098\"\u003e#1098\u003c/a\u003e from actions/ahpook/v5-release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695\"\u003e\u003ccode\u003eeb6c199\u003c/code\u003e\u003c/a\u003e update examples to show \u003ca href\u003d\"https://github.com/v5\"\u003e\u003ccode\u003e​v5\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c\"\u003e\u003ccode\u003e3943c2c\u003c/code\u003e\u003c/a\u003e v5.0.0 release branch\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033\"\u003e\u003ccode\u003e454943c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/issues/1094\"\u003e#1094\u003c/a\u003e from actions/ashelytc/security-findings\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463\"\u003e\u003ccode\u003e6d92a12\u003c/code\u003e\u003c/a\u003e revert \u003ccode\u003e​typescript-eslint/parser\u003c/code\u003e update\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0\"\u003e\u003ccode\u003ea8e5a7e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/issues/1076\"\u003e#1076\u003c/a\u003e from tspascoal/fix-version-matching-for-non-string-s...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101\"\u003e\u003ccode\u003eb6b7079\u003c/code\u003e\u003c/a\u003e update \u003ccode\u003e​typescript-eslint/parser\u003c/code\u003e to 8.40.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208\"\u003e\u003ccode\u003e821a21d\u003c/code\u003e\u003c/a\u003e update more dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63\"\u003e\u003ccode\u003e05aaaae\u003c/code\u003e\u003c/a\u003e run npm audit fix\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea\"\u003e\u003ccode\u003e55d3e75\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/dependency-review-action/issues/1077\"\u003e#1077\u003c/a\u003e from Marukome0743/docs/checkout\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/dependency-review-action/compare/v4...v5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/dependency-review-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4\u0026new-version\u003d5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7480 from dependabot[bot]/dependabot/github_actions/actions/dependency-review-action-5.\n\nCloses #7480\n\n62754f84d [dependabot[bot]] Bump actions/dependency-review-action from 4 to 5\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "7f7b7c12481a525f21fa7be78bf76d6e2ccf5880", "tree": "e975eee3a563e40a12fd13fbe8e69534426d53a6", "parents": [ "3c2a7934ff685425abf5688464e8022797168ae9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun May 31 01:42:47 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Sun May 31 01:42:47 2026 +0800" }, "message": "[KYUUBI #7479] Bump actions/upload-artifact from 4 to 7\n\nBumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/upload-artifact/releases\"\u003eactions/upload-artifact\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003ev7 What\u0027s new\u003c/h2\u003e\n\u003ch3\u003eDirect Uploads\u003c/h3\u003e\n\u003cp\u003eAdds support for uploading single files directly (unzipped). Callers can set the new \u003ccode\u003earchive\u003c/code\u003e parameter to \u003ccode\u003efalse\u003c/code\u003e to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The \u003ccode\u003ename\u003c/code\u003e parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.\u003c/p\u003e\n\u003ch3\u003eESM\u003c/h3\u003e\n\u003cp\u003eTo support new versions of the \u003ccode\u003eactions/*\u003c/code\u003e packages, we\u0027ve upgraded the package to ESM.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd proxy integration test by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade the module to ESM and bump dependencies by \u003ca href\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/762\"\u003eactions/upload-artifact#762\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport direct file uploads by \u003ca href\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/764\"\u003eactions/upload-artifact#764\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/754\"\u003eactions/upload-artifact#754\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/upload-artifact/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003ev6 - What\u0027s new\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nactions/upload-artifactv6 now runs on Node.js 24 (\u003ccode\u003eruns.using: node24\u003c/code\u003e) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch3\u003eNode.js 24\u003c/h3\u003e\n\u003cp\u003eThis release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpload Artifact Node 24 support by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/719\"\u003eactions/upload-artifact#719\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update \u003ccode\u003e​actions/artifact\u003c/code\u003e for Node.js 24 punycode deprecation by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/744\"\u003eactions/upload-artifact#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eprepare release v6.0.0 for Node.js 24 support by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/745\"\u003eactions/upload-artifact#745\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\"\u003ehttps://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBREAKING CHANGE:\u003c/strong\u003e this update supports Node \u003ccode\u003ev24.x\u003c/code\u003e. This is not a breaking change per-se but we\u0027re treating it as such.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/GhadimiR\"\u003e\u003ccode\u003e​GhadimiR\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/681\"\u003eactions/upload-artifact#681\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/712\"\u003eactions/upload-artifact#712\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReadme: spell out the first use of GHES by \u003ca href\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/727\"\u003eactions/upload-artifact#727\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate GHES guidance to include reference to Node 20 version by \u003ca href\u003d\"https://github.com/patrikpolyak\"\u003e\u003ccode\u003e​patrikpolyak\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/725\"\u003eactions/upload-artifact#725\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/artifact\u003c/code\u003e to \u003ccode\u003ev4.0.0\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ePrepare \u003ccode\u003ev5.0.0\u003c/code\u003e by \u003ca href\u003d\"https://github.com/danwkennedy\"\u003e\u003ccode\u003e​danwkennedy\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/pull/734\"\u003eactions/upload-artifact#734\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\"\u003e\u003ccode\u003e043fb46\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/797\"\u003e#797\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94\"\u003e\u003ccode\u003e634250c\u003c/code\u003e\u003c/a\u003e Include changes in typespec/ts-http-runtime 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8\"\u003e\u003ccode\u003ee454baa\u003c/code\u003e\u003c/a\u003e Readme: bump all the example versions to v7 (\u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/796\"\u003e#796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e\"\u003e\u003ccode\u003e74fad66\u003c/code\u003e\u003c/a\u003e Update the readme with direct upload details (\u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/795\"\u003e#795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f\"\u003e\u003ccode\u003ebbbca2d\u003c/code\u003e\u003c/a\u003e Support direct file uploads (\u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296\"\u003e\u003ccode\u003e589182c\u003c/code\u003e\u003c/a\u003e Upgrade the module to ESM and bump dependencies (\u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/762\"\u003e#762\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5\"\u003e\u003ccode\u003e47309c9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/754\"\u003e#754\u003c/a\u003e from actions/Link-/add-proxy-integration-tests\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0\"\u003e\u003ccode\u003e02a8460\u003c/code\u003e\u003c/a\u003e Add proxy integration test\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f\"\u003e\u003ccode\u003eb7c566a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/upload-artifact/issues/745\"\u003e#745\u003c/a\u003e from actions/upload-artifact-v6-release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b\"\u003e\u003ccode\u003ee516bc8\u003c/code\u003e\u003c/a\u003e docs: correct description of Node.js 24 support in README\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/upload-artifact/compare/v4...v7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/upload-artifact\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4\u0026new-version\u003d7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7479 from dependabot[bot]/dependabot/github_actions/actions/upload-artifact-7.\n\nCloses #7479\n\n707b620ef [dependabot[bot]] Bump actions/upload-artifact from 4 to 7\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "3c2a7934ff685425abf5688464e8022797168ae9", "tree": "079857576f19b2accff87c155ab4738c32c131ae", "parents": [ "7fa2656e238508525cf667a053943e941b823019" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun May 31 01:41:48 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Sun May 31 01:41:48 2026 +0800" }, "message": "[KYUUBI #7478] Bump codecov/codecov-action from 3 to 6\n\nBumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3 to 6.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/codecov/codecov-action/releases\"\u003ecodecov/codecov-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003e⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRevert \u0026quot;Revert \u0026quot;build(deps): bump actions/github-script from 7.0.1 to 8.0.0\u0026quot;\u0026quot; by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1929\"\u003ecodecov/codecov-action#1929\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTh/6.0.0 by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1928\"\u003ecodecov/codecov-action#1928\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.4\u003c/h2\u003e\n\u003cp\u003eThis is a mirror of \u003ccode\u003ev5.5.2\u003c/code\u003e. \u003ccode\u003ev6\u003c/code\u003e will be released which requires \u003ccode\u003enode24\u003c/code\u003e\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRevert \u0026quot;build(deps): bump actions/github-script from 7.0.1 to 8.0.0\u0026quot; by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1926\"\u003ecodecov/codecov-action#1926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 5.5.4 by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1927\"\u003ecodecov/codecov-action#1927\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump actions/github-script from 7.0.1 to 8.0.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1874\"\u003ecodecov/codecov-action#1874\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): bump to 5.5.3 by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1922\"\u003ecodecov/codecov-action#1922\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echeck gpg only when skip-validation \u003d false by \u003ca href\u003d\"https://github.com/maxweng-sentry\"\u003e\u003ccode\u003e​maxweng-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1894\"\u003ecodecov/codecov-action#1894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: \u003ccode\u003edisable_search\u003c/code\u003e alignment by \u003ca href\u003d\"https://github.com/freemanzMrojo\"\u003e\u003ccode\u003e​freemanzMrojo\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1881\"\u003ecodecov/codecov-action#1881\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(release): 5.5.2 by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1902\"\u003ecodecov/codecov-action#1902\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/maxweng-sentry\"\u003e\u003ccode\u003e​maxweng-sentry\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1894\"\u003ecodecov/codecov-action#1894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/freemanzMrojo\"\u003e\u003ccode\u003e​freemanzMrojo\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1881\"\u003ecodecov/codecov-action#1881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href\u003d\"https://github.com/webknjaz\"\u003e\u003ccode\u003e​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href\u003d\"https://github.com/datalater\"\u003e\u003ccode\u003e​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md\"\u003ecodecov/codecov-action\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.5.2\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.1\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: overwrite pr number on fork by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1871\"\u003ecodecov/codecov-action#1871\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 4.2.2 to 5.0.0 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1868\"\u003ecodecov/codecov-action#1868\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1867\"\u003ecodecov/codecov-action#1867\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update to use local app/ dir by \u003ca href\u003d\"https://github.com/thomasrockhu-codecov\"\u003e\u003ccode\u003e​thomasrockhu-codecov\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1872\"\u003ecodecov/codecov-action#1872\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix typo in README by \u003ca href\u003d\"https://github.com/datalater\"\u003e\u003ccode\u003e​datalater\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1866\"\u003ecodecov/codecov-action#1866\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument a \u003ccode\u003ecodecov-cli\u003c/code\u003e version reference example by \u003ca href\u003d\"https://github.com/webknjaz\"\u003e\u003ccode\u003e​webknjaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1774\"\u003ecodecov/codecov-action#1774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1861\"\u003ecodecov/codecov-action#1861\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1833\"\u003ecodecov/codecov-action#1833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: upgrade wrapper to 0.2.4 by \u003ca href\u003d\"https://github.com/jviall\"\u003e\u003ccode\u003e​jviall\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1864\"\u003ecodecov/codecov-action#1864\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin actions/github-script by Git SHA by \u003ca href\u003d\"https://github.com/martincostello\"\u003e\u003ccode\u003e​martincostello\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1859\"\u003ecodecov/codecov-action#1859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: check reqs exist by \u003ca href\u003d\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1835\"\u003ecodecov/codecov-action#1835\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: Typo in README by \u003ca href\u003d\"https://github.com/spalmurray\"\u003e\u003ccode\u003e​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1838\"\u003ecodecov/codecov-action#1838\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Refine OIDC docs by \u003ca href\u003d\"https://github.com/spalmurray\"\u003e\u003ccode\u003e​spalmurray\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1837\"\u003ecodecov/codecov-action#1837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1829\"\u003ecodecov/codecov-action#1829\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.3\u003c/h2\u003e\n\u003ch3\u003eWhat\u0027s Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by \u003ccode\u003e​app/dependabot\u003c/code\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1822\"\u003ecodecov/codecov-action#1822\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: OIDC on forks by \u003ca href\u003d\"https://github.com/joseph-sentry\"\u003e\u003ccode\u003e​joseph-sentry\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/pull/1823\"\u003ecodecov/codecov-action#1823\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\"\u003ehttps://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.4.2\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354\"\u003e\u003ccode\u003ee79a696\u003c/code\u003e\u003c/a\u003e chore(release): 6.0.1 (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1949\"\u003e#1949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79\"\u003e\u003ccode\u003e51e6422\u003c/code\u003e\u003c/a\u003e fix: prevent template injection in run: steps (VULN-1652) (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1947\"\u003e#1947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2\"\u003e\u003ccode\u003e57e3a13\u003c/code\u003e\u003c/a\u003e Th/6.0.0 (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1928\"\u003e#1928\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/f67d33dda8a42b51c42a8318a1f66468119e898b\"\u003e\u003ccode\u003ef67d33d\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Revert \u0026quot;build(deps): bump actions/github-script from 7.0.1 to 8.0.0\u0026quot;\u0026quot;...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/75cd11691c0faa626561e295848008c8a7dddffe\"\u003e\u003ccode\u003e75cd116\u003c/code\u003e\u003c/a\u003e chore(release): 5.5.4 (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1927\"\u003e#1927\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/87d39f4a2cec2673cf9505764fb20a38792ea722\"\u003e\u003ccode\u003e87d39f4\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;build(deps): bump actions/github-script from 7.0.1 to 8.0.0\u0026quot; (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1926\"\u003e#1926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/1af58845a975a7985b0beb0cbe6fbbb71a41dbad\"\u003e\u003ccode\u003e1af5884\u003c/code\u003e\u003c/a\u003e chore(release): bump to 5.5.3 (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1922\"\u003e#1922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/c143300dea6c9a730986ff862c5bf4d458927ef8\"\u003e\u003ccode\u003ec143300\u003c/code\u003e\u003c/a\u003e build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1874\"\u003e#1874\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/671740ac38dd9b0130fbe1cec585b89eea48d3de\"\u003e\u003ccode\u003e671740a\u003c/code\u003e\u003c/a\u003e chore(release): 5.5.2 (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1902\"\u003e#1902\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/codecov/codecov-action/commit/96b38e9e60ee60a8c3911f4612407bba2f9195fb\"\u003e\u003ccode\u003e96b38e9\u003c/code\u003e\u003c/a\u003e chore: \u003ccode\u003edisable_search\u003c/code\u003e alignment (\u003ca href\u003d\"https://redirect.github.com/codecov/codecov-action/issues/1881\"\u003e#1881\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/codecov/codecov-action/compare/v3...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcodecov/codecov-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d3\u0026new-version\u003d6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7478 from dependabot[bot]/dependabot/github_actions/codecov/codecov-action-6.\n\nCloses #7478\n\n7005239d7 [dependabot[bot]] Bump codecov/codecov-action from 3 to 6\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "7fa2656e238508525cf667a053943e941b823019", "tree": "8c74036df4e5fb33167a84f0af05f097038bc9dc", "parents": [ "e68887638ca2b89674b17f78a10f649f252d596b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun May 31 01:40:43 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Sun May 31 01:40:43 2026 +0800" }, "message": "[KYUUBI #7477] Bump actions/setup-java from 4 to 5\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 4 to 5.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-java/releases\"\u003eactions/setup-java\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to node 24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/888\"\u003eactions/setup-java#888\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eMake sure your runner is updated to this version or newer to use this release. v2.327.1 \u003ca href\u003d\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/p\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Publish Immutable Action by \u003ca href\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/798\"\u003eactions/setup-java#798\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/730\"\u003eactions/setup-java#730\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade undici from 5.28.5 to 5.29.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/833\"\u003eactions/setup-java#833\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade form-data to bring in fix for critical vulnerability by \u003ca href\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/887\"\u003eactions/setup-java#887\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/checkout from 4 to 5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/896\"\u003eactions/setup-java#896\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePrevent default installation of JetBrains pre-releases by \u003ca href\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/859\"\u003eactions/setup-java#859\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove Error Handling for Setup-Java Action to Help Debug Intermittent Failures by \u003ca href\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/848\"\u003eactions/setup-java#848\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e​gowridurgad\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/848\"\u003eactions/setup-java#848\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/888\"\u003eactions/setup-java#888\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v4...v5.0.0\"\u003ehttps://github.com/actions/setup-java/compare/v4...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.8.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLicense and Audit Fixes by \u003ca href\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/960\"\u003eactions/setup-java#960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate SapMachine URLs by \u003ca href\u003d\"https://github.com/RealCLanger\"\u003e\u003ccode\u003e​RealCLanger\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/965\"\u003eactions/setup-java#965\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v4...v4.8.0\"\u003ehttps://github.com/actions/setup-java/compare/v4...v4.8.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.7.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eDocumentation changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Documentation to Recommend Using GraalVM JDK 17 Version to 17.0.12 to Align with GFTC License Terms by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/704\"\u003eactions/setup-java#704\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove duplicated GraalVM section in documentation by \u003ca href\u003d\"https://github.com/Marcono1234\"\u003e\u003ccode\u003e​Marcono1234\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/716\"\u003eactions/setup-java#716\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​action/cache\u003c/code\u003e from 4.0.0 to 4.0.2 by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/766\"\u003eactions/setup-java#766\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​actions/glob\u003c/code\u003e from 0.4.0 to 0.5.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/744\"\u003eactions/setup-java#744\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade ts-jest from 29.1.2 to 29.2.5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/743\"\u003eactions/setup-java#743\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​action/cache\u003c/code\u003e to 4.0.3 by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-java/pull/773\"\u003eactions/setup-java#773\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v4...v4.7.1\"\u003ehttps://github.com/actions/setup-java/compare/v4...v4.7.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.7.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/be666c2fcd27ec809703dec50e508c2fdc7f6654\"\u003e\u003ccode\u003ebe666c2\u003c/code\u003e\u003c/a\u003e Chore: Version Update and Checkout Update to v6 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/973\"\u003e#973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/f7a6fefba97e80156950e16f2a9dafc8579b7d05\"\u003e\u003ccode\u003ef7a6fef\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 5 to 6 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/961\"\u003e#961\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/d81c4e45f3ac973cc936d79104023e20054ba578\"\u003e\u003ccode\u003ed81c4e4\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003e​actions/cache\u003c/code\u003e to v5 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/968\"\u003e#968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/1b1bbe1085cb6ab21b5b19b7bebc091a9430026a\"\u003e\u003ccode\u003e1b1bbe1\u003c/code\u003e\u003c/a\u003e readme update (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/972\"\u003e#972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/5d7b2146334bacf88728daaa70414a99f5164e0f\"\u003e\u003ccode\u003e5d7b214\u003c/code\u003e\u003c/a\u003e Retry on HTTP 522 Connection timed out (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/964\"\u003e#964\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/f2beeb24e141e01a676f977032f5a29d81c9e27e\"\u003e\u003ccode\u003ef2beeb2\u003c/code\u003e\u003c/a\u003e Bump actions/publish-action from 0.3.0 to 0.4.0 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/912\"\u003e#912\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/4e7e684fbb6e33f88ecb2cf1e6b3797739cf499b\"\u003e\u003ccode\u003e4e7e684\u003c/code\u003e\u003c/a\u003e feat: Add support for \u003ccode\u003e.sdkmanrc\u003c/code\u003e file in \u003ccode\u003ejava-version-file\u003c/code\u003e parameter (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/736\"\u003e#736\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/46c56d6f92c88cf540acf95a12a4a41197499222\"\u003e\u003ccode\u003e46c56d6\u003c/code\u003e\u003c/a\u003e Add GitHub Token Support for GraalVM and Refactor Code (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/849\"\u003e#849\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/66b945764b75604b3cfd644c3ada5232cf6c90c6\"\u003e\u003ccode\u003e66b9457\u003c/code\u003e\u003c/a\u003e Update SapMachine URLs (\u003ca href\u003d\"https://redirect.github.com/actions/setup-java/issues/955\"\u003e#955\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-java/commit/6ba5449b7dcda52941806a19f0cf626b6420191e\"\u003e\u003ccode\u003e6ba5449\u003c/code\u003e\u003c/a\u003e Enhance error logging for network failures to include endpoint/IP details, ad...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-java/compare/v4...v5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-java\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4\u0026new-version\u003d5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7477 from dependabot[bot]/dependabot/github_actions/actions/setup-java-5.\n\nCloses #7477\n\n20ff78722 [dependabot[bot]] Bump actions/setup-java from 4 to 5\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "e68887638ca2b89674b17f78a10f649f252d596b", "tree": "ba7177eba801951a50c06dc3589a4c03e4f6a9f3", "parents": [ "6f80f9a39d3137c3772e20017523c69eb6756bb3" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat May 30 14:09:59 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Sat May 30 14:09:59 2026 +0800" }, "message": "[KYUUBI #7481] Bump docker/setup-buildx-action from 4.0.0 to 4.1.0\n\nBumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.0.0 to 4.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/setup-buildx-action/releases\"\u003edocker/setup-buildx-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/489\"\u003edocker/setup-buildx-action#489\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.12 to 5.0.6 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/547\"\u003edocker/setup-buildx-action#547\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/508\"\u003edocker/setup-buildx-action#508\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-builder from 1.0.0 to 1.2.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/540\"\u003edocker/setup-buildx-action#540\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.4.2 to 5.8.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/496\"\u003edocker/setup-buildx-action#496\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.3 to 3.4.2 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/499\"\u003edocker/setup-buildx-action#499\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump glob from 10.3.12 to 13.0.6 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/495\"\u003edocker/setup-buildx-action#495\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump handlebars from 4.7.8 to 4.7.9 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/504\"\u003edocker/setup-buildx-action#504\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.23 to 4.18.1 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/523\"\u003edocker/setup-buildx-action#523\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump picomatch from 4.0.3 to 4.0.4 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/503\"\u003edocker/setup-buildx-action#503\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump postcss from 8.5.6 to 8.5.10 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/537\"\u003edocker/setup-buildx-action#537\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump tar from 6.2.1 to 7.5.15 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/545\"\u003edocker/setup-buildx-action#545\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.23.0 to 6.25.0 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/492\"\u003edocker/setup-buildx-action#492\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.2 in \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/pull/520\"\u003edocker/setup-buildx-action#520\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003e\u003ccode\u003ed7f5e7f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/489\"\u003e#489\u003c/a\u003e from docker/dependabot/npm_and_yarn/docker/actions-to...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/92bc5c9777806d0a73d9d668ba2114fa1177f164\"\u003e\u003ccode\u003e92bc5c9\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/da11e35abee0f20cb4f1c1b7c461d37c29be52f5\"\u003e\u003ccode\u003eda11e35\u003c/code\u003e\u003c/a\u003e build(deps): bump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.90.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/f021e162ef95b6fba51af1c6674f537f25bce851\"\u003e\u003ccode\u003ef021e16\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/492\"\u003e#492\u003c/a\u003e from docker/dependabot/npm_and_yarn/undici-6.24.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/b5af94fab700aee0c64d6077e0e34ae987815b67\"\u003e\u003ccode\u003eb5af94f\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/16ad9776a801d0c47f0a05f007b88a3789aa8ab6\"\u003e\u003ccode\u003e16ad977\u003c/code\u003e\u003c/a\u003e build(deps): bump undici from 6.23.0 to 6.25.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/d7a12d7df895b33bd02a9b4bf62a12f2b9a24458\"\u003e\u003ccode\u003ed7a12d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/495\"\u003e#495\u003c/a\u003e from docker/dependabot/npm_and_yarn/glob-10.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/28ff27de4eed7518d361591f2cd1dfb69c34a7cb\"\u003e\u003ccode\u003e28ff27d\u003c/code\u003e\u003c/a\u003e build(deps): bump glob from 10.3.12 to 13.0.6\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/daf436b50e13d9053b9730cbc16516891878b019\"\u003e\u003ccode\u003edaf436b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/setup-buildx-action/issues/496\"\u003e#496\u003c/a\u003e from docker/dependabot/npm_and_yarn/fast-xml-parser-5...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/setup-buildx-action/commit/9725348367859764880f2f2e688a6b0c353e3f35\"\u003e\u003ccode\u003e9725348\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/setup-buildx-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4.0.0\u0026new-version\u003d4.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7481 from dependabot[bot]/dependabot/github_actions/docker/setup-buildx-action-4.1.0.\n\nCloses #7481\n\n4f55cdb37 [dependabot[bot]] Bump docker/setup-buildx-action from 4.0.0 to 4.1.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "6f80f9a39d3137c3772e20017523c69eb6756bb3", "tree": "751a7ddb41fccc498e0391fcb92d22af6ea0da8f", "parents": [ "b640e3b07467df3ef291d1b891d878127078eba7" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Sat May 30 14:09:11 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Sat May 30 14:09:11 2026 +0800" }, "message": "[KYUUBI #7484] Add CLAUDE.md and tell it to read AGENTS.md\n\n### Why are the changes needed?\n\nClaude Code does not seem to read `AGENTS.md` automatically.\n\n### How was this patch tested?\n\nReview.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #7484 from pan3793/claude.\n\nCloses #7484\n\ne65260422 [Cheng Pan] replace with import syntax\n41e3c422d [Cheng Pan] Add CLAUDE.md and tell it to read AGENTS.md\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "b640e3b07467df3ef291d1b891d878127078eba7", "tree": "a3778fd9d8ded9320920f4f628ca2ffeafa566e1", "parents": [ "36fd76246a6c9cfd1e922661ddcdbb3bb2d03178" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Fri May 29 17:46:58 2026 +0800" }, "committer": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Fri May 29 17:46:58 2026 +0800" }, "message": "[KYUUBI #7473] Migrate Java tests from JUnit 4 to JUnit 5\n\n### Why are the changes needed?\n\nCloses #7473.\n\nJUnit 4 has been in maintenance mode since 4.13.2 (Feb 2021); modern Java test deps (Mockito 5, Testcontainers, etc.) target JUnit 5. Our usage is shallow (no `Rule` / `ClassRule` / `Theories`), so the migration is mostly mechanical.\n\nMigrates all five modules with Java tests: `kyuubi-rest-client`, `kyuubi-util`, `kyuubi-hive-jdbc`, `kyuubi-hive-beeline`, and `externals/kyuubi-data-agent-engine`. Drops the direct `junit:junit` dependency and `junit.version` property from the root pom; transitive exclusions are kept. `junit-jupiter` is pinned to the latest stable, 5.14.4.\n\n### How was this patch tested?\n\n`build/mvn -Pfast test -pl \u003cmodule\u003e -am` on each of the five modules — all green. `kyuubi-data-agent-engine` has 7 live tests skipped via `Assumptions.assumeTrue` (require an external LLM API). `dev/reformat` clean.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-7\n\nCloses #7474 from wangzhigang1999/kyuubi-7473-junit5-migration.\n\nCloses #7473\n\na3b533935 [wangzhigang] [KYUUBI #7473] Adopt JUnit 5 idioms across migrated tests\nf91ac50b4 [wangzhigang] [KYUUBI #7473] Bump junit-jupiter from 5.11.4 to 5.14.4\n1b09b2a11 [wangzhigang] [KYUUBI #7473] Simplify assertTrue(x.equals(...)) to assertEquals\n5fa8033be [wangzhigang] [KYUUBI #7473] Migrate Java tests from JUnit 4 to JUnit 5\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\n" }, { "commit": "36fd76246a6c9cfd1e922661ddcdbb3bb2d03178", "tree": "c7be461d730eb4282709eda48399b6c6e2bec4df", "parents": [ "eb5c04f1f940a82af7af06393acc11dfb840a613" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue May 26 22:52:21 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue May 26 22:52:21 2026 +0800" }, "message": "[KYUUBI #6832] Initial impl Spark DSv2 YARN Connector that supports reading YARN aggregated logs\n\n### Why are the changes needed?\n\nClose #6832. This connector gives the Hadoop administrator a chance to analyze YARN aggregated logs at the cluster level, for example, aggregate container logs across applications by host to diagnose potential host hardware issues\n\nThe current initial implementation has several limitations:\n- feat: only support `TFile`, but not `IFile`\n- perf: only supports pushing down `app_id`, `user`, `host` filters, does not support pushing down `container_id`, `log_type`, though they are supposed to be selective\n- perf: listing aggregated log files runs in a single thread during the planning phase - for a large cluster, it should run in parallel on the driver side or launch a job to do that on the executor side.\n- etc.\n\n### How was this patch tested?\n\nUT is not added yet, as this requires a real YARN cluster with history agg logs.\n\n```\n$ kyuubi-beeline -u \u0027jdbc:kyuubi://spark-dev1.foo.bar:10009/default\u0027 \\\n --conf spark.jars\u003d/tmp/kyuubi-spark-connector-yarn_2.12-1.12.0-SNAPSHOT.jar \\\n --conf spark.sql.catalog.yarn\u003dorg.apache.kyuubi.spark.connector.yarn.YarnCatalog\n0: \u003e select\n. .\u003e mtime, app_id, container_id, host, log_type, message\n. .\u003e from yarn.app_logs\n. .\u003e where\n. .\u003e user \u003d \u0027hadoop\u0027\n. .\u003e and host \u003d \u0027spark-dev2.foo.bar\u0027\n. .\u003e and message like \u0027%ERROR%\u0027\n. .\u003e and message not like \u0027%RECEIVED SIGNAL TERM%\u0027\n. .\u003e and message not like \u0027%Aborting task%\u0027\n. .\u003e limit 2;\n...\n+--------------------------+---------------------------------+-----------------------------------------+---------------------+-----------+----------------------------------------------------+\n| mtime | app_id | container_id | host | log_type | message |\n+--------------------------+---------------------------------+-----------------------------------------+---------------------+-----------+----------------------------------------------------+\n| 2025-04-03 18:07:18.893 | application_1743671377509_0001 | container_1743671377509_0001_01_000001 | spark-dev2.foo.bar | stdout | 25/04/03 18:07:15 ERROR ApplicationMaster$AMEndpoint: Driver terminated with exit code 1! Shutting down. spark-dev1.foo.bar:16601 |\n| 2025-04-03 18:07:18.893 | application_1743671377509_0001 | container_1743671377509_0001_01_000001 | spark-dev2.foo.bar | stdout | 25/04/03 18:07:15 ERROR ApplicationMaster$AMEndpoint: Driver terminated with exit code 1! Shutting down. spark-dev1.foo.bar:16601 |\n+--------------------------+---------------------------------+-----------------------------------------+---------------------+-----------+----------------------------------------------------+\n2 rows selected (0.648 seconds)\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude Opus 4.7.\n\nCloses #7455 from pan3793/yarn-agg-log.\n\nCloses #6832\n\n89a9a15a3 [Cheng Pan] NoSuchTableException ctor compatibility\ne916678ff [Cheng Pan] bucket pruning when app_id is provided\n16abc8c93 [Cheng Pan] comments\n0cae4aa69 [Cheng Pan] add basic tests\ncac9677ee [Cheng Pan] support ignoreMissingFiles\n2d349bdb9 [Cheng Pan] add test yarn agg logs\na8ac84942 [Cheng Pan] fix scala 2.13 compile\n4dfcc21bb [Cheng Pan] unnecessary change\n75bbdae95 [Cheng Pan] Init YARN Aggregated Log connector\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "eb5c04f1f940a82af7af06393acc11dfb840a613", "tree": "f5e18277f463c2061bba6c84841cf6172f972915", "parents": [ "67619a41537a611e4bbfc51899508921d3b065bb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri May 22 20:07:55 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 22 20:07:55 2026 +0800" }, "message": "[KYUUBI #7465] Bump docker/build-push-action from 7.0.0 to 7.1.0\n\nBumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.0.0 to 7.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/docker/build-push-action/releases\"\u003edocker/build-push-action\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eGit context \u003ca href\u003d\"https://docs.docker.com/build/concepts/context/#url-queries\"\u003equery format\u003c/a\u003e support by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1505\"\u003edocker/build-push-action#1505\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e​docker/actions-toolkit\u003c/code\u003e from 0.79.0 to 0.87.0 by \u003ca href\u003d\"https://github.com/crazy-max\"\u003e\u003ccode\u003e​crazy-max\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1505\"\u003edocker/build-push-action#1505\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump brace-expansion from 1.1.12 to 1.1.13 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1500\"\u003edocker/build-push-action#1500\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump fast-xml-parser from 5.4.2 to 5.5.7 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1489\"\u003edocker/build-push-action#1489\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.3 to 3.4.2 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1491\"\u003edocker/build-push-action#1491\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump glob from 10.3.12 to 10.5.0 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1490\"\u003edocker/build-push-action#1490\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump handlebars from 4.7.8 to 4.7.9 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1497\"\u003edocker/build-push-action#1497\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump lodash from 4.17.23 to 4.18.1 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1510\"\u003edocker/build-push-action#1510\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump picomatch from 4.0.3 to 4.0.4 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1496\"\u003edocker/build-push-action#1496\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump undici from 6.23.0 to 6.24.1 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1486\"\u003edocker/build-push-action#1486\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump vite from 7.3.1 to 7.3.2 in \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/pull/1509\"\u003edocker/build-push-action#1509\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0\"\u003ehttps://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/bcafcacb16a39f128d818304e6c9c0c18556b85f\"\u003e\u003ccode\u003ebcafcac\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1509\"\u003e#1509\u003c/a\u003e from docker/dependabot/npm_and_yarn/vite-7.3.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/18e62f1158d9c45a4a84a58a6828d21f8ed3644b\"\u003e\u003ccode\u003e18e62f1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1510\"\u003e#1510\u003c/a\u003e from docker/dependabot/npm_and_yarn/lodash-4.18.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/46580d2c9d43b0888270cb6fa90956e483de56fc\"\u003e\u003ccode\u003e46580d2\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/3f80b252ca2331f6ec3e890f4346b5506ee1dc81\"\u003e\u003ccode\u003e3f80b25\u003c/code\u003e\u003c/a\u003e chore(deps): Bump lodash from 4.17.23 to 4.18.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/efeec9557c40a646afe433e39a1e94ca689103f0\"\u003e\u003ccode\u003eefeec95\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1505\"\u003e#1505\u003c/a\u003e from crazy-max/refactor-git-context\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/ddf04b08eb12882258ed936fea4a2806754ff349\"\u003e\u003ccode\u003eddf04b0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1511\"\u003e#1511\u003c/a\u003e from docker/dependabot/github_actions/crazy-max-dot-...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/db08d97a08e4a0d15f85d1c4e64dfd5f88cbe1a9\"\u003e\u003ccode\u003edb08d97\u003c/code\u003e\u003c/a\u003e chore(deps): Bump the crazy-max-dot-github group with 2 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/ef1fb9688fc3626d0fd5e462f502cbbdc6456feb\"\u003e\u003ccode\u003eef1fb96\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/docker/build-push-action/issues/1508\"\u003e#1508\u003c/a\u003e from docker/dependabot/github_actions/docker/login-a...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/2d8f2a1a378a5c302dcd7b2b4326cefa24180bb1\"\u003e\u003ccode\u003e2d8f2a1\u003c/code\u003e\u003c/a\u003e chore: update generated content\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/docker/build-push-action/commit/919ac7bd7d1aa8cb13fe4de76545abea8d8b5ed2\"\u003e\u003ccode\u003e919ac7b\u003c/code\u003e\u003c/a\u003e fix test since secrets are not written to temp path anymore\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/docker/build-push-action/compare/d08e5c354a6adb9ed34480a06d141179aa583294...bcafcacb16a39f128d818304e6c9c0c18556b85f\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003ddocker/build-push-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d7.0.0\u0026new-version\u003d7.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7465 from dependabot[bot]/dependabot/github_actions/docker/build-push-action-7.1.0.\n\nCloses #7465\n\n2ffbd112d [dependabot[bot]] Bump docker/build-push-action from 7.0.0 to 7.1.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "67619a41537a611e4bbfc51899508921d3b065bb", "tree": "5bd2ac69f0fb517658e90f523df03bdb5943fc88", "parents": [ "fc0a20d41f0276f9dcb734b0e9a43449583ba4ad" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri May 22 20:07:00 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 22 20:07:00 2026 +0800" }, "message": "[KYUUBI #7466] Bump actions/setup-python from 5 to 6\n\nBumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to node 24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1164\"\u003eactions/setup-python#1164\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eMake sure your runner is on version v2.327.1 or later to ensure compatibility with this release. \u003ca href\u003d\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eSee Release Notes\u003c/a\u003e\u003c/p\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for \u003ccode\u003epip-version\u003c/code\u003e by \u003ca href\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1129\"\u003eactions/setup-python#1129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnhance reading from .python-version by \u003ca href\u003d\"https://github.com/krystof-k\"\u003e\u003ccode\u003e​krystof-k\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/787\"\u003eactions/setup-python#787\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd version parsing from Pipfile by \u003ca href\u003d\"https://github.com/aradkdj\"\u003e\u003ccode\u003e​aradkdj\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1067\"\u003eactions/setup-python#1067\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eClarify pythonLocation behaviour for PyPy and GraalPy in environment variables by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1183\"\u003eactions/setup-python#1183\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eChange missing cache directory error to warning by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1182\"\u003eactions/setup-python#1182\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Architecture-Specific PATH Management for Python with --user Flag on Windows by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1122\"\u003eactions/setup-python#1122\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eInclude python version in PyPy python-version output by \u003ca href\u003d\"https://github.com/cdce8p\"\u003e\u003ccode\u003e​cdce8p\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1110\"\u003eactions/setup-python#1110\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate docs: clarification on pip authentication with setup-python by \u003ca href\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1156\"\u003eactions/setup-python#1156\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency updates:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade idna from 2.9 to 3.7 in /\u003cstrong\u003etests\u003c/strong\u003e/data by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/843\"\u003eactions/setup-python#843\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade form-data to fix critical vulnerabilities \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/182\"\u003e#182\u003c/a\u003e \u0026amp; \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/183\"\u003e#183\u003c/a\u003e by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1163\"\u003eactions/setup-python#1163\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1165\"\u003eactions/setup-python#1165\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/checkout from 4 to 5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1181\"\u003eactions/setup-python#1181\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​actions/tool-cache\u003c/code\u003e from 2.0.1 to 2.0.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1095\"\u003eactions/setup-python#1095\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/krystof-k\"\u003e\u003ccode\u003e​krystof-k\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/787\"\u003eactions/setup-python#787\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/cdce8p\"\u003e\u003ccode\u003e​cdce8p\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1110\"\u003eactions/setup-python#1110\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aradkdj\"\u003e\u003ccode\u003e​aradkdj\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1067\"\u003eactions/setup-python#1067\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/setup-python/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.6.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWorkflow updates related to Ubuntu 20.04 by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1065\"\u003eactions/setup-python#1065\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix for Candidate Not Iterable Error by \u003ca href\u003d\"https://github.com/aparnajyothi-y\"\u003e\u003ccode\u003e​aparnajyothi-y\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1082\"\u003eactions/setup-python#1082\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade semver and \u003ccode\u003e​types/semver\u003c/code\u003e by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1091\"\u003eactions/setup-python#1091\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade prettier from 2.8.8 to 3.5.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1046\"\u003eactions/setup-python#1046\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade ts-jest from 29.1.2 to 29.3.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1081\"\u003eactions/setup-python#1081\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v5...v5.6.0\"\u003ehttps://github.com/actions/setup-python/compare/v5...v5.6.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport free threaded Python versions like \u00273.13t\u0027 by \u003ca href\u003d\"https://github.com/colesbury\"\u003e\u003ccode\u003e​colesbury\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/973\"\u003eactions/setup-python#973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnhance Workflows: Include ubuntu-arm runners, Add e2e Testing for free threaded and Upgrade \u003ccode\u003e​action/cache\u003c/code\u003e from 4.0.0 to 4.0.3 by \u003ca href\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1056\"\u003eactions/setup-python#1056\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for .tool-versions file in setup-python by \u003ca href\u003d\"https://github.com/mahabaleshwars\"\u003e\u003ccode\u003e​mahabaleshwars\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1043\"\u003eactions/setup-python#1043\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix architecture for pypy on Linux ARM64 by \u003ca href\u003d\"https://github.com/mayeut\"\u003e\u003ccode\u003e​mayeut\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-python/pull/1011\"\u003eactions/setup-python#1011\u003c/a\u003e\nThis update maps arm64 to aarch64 for Linux ARM64 PyPy installations.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/a309ff8b426b58ec0e2a45f0f869d46889d02405\"\u003e\u003ccode\u003ea309ff8\u003c/code\u003e\u003c/a\u003e Bump urllib3 from 2.6.0 to 2.6.3 in /\u003cstrong\u003etests\u003c/strong\u003e/data (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1264\"\u003e#1264\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/bfe8cc55a7890e3d6672eda6460ef37bfcc70755\"\u003e\u003ccode\u003ebfe8cc5\u003c/code\u003e\u003c/a\u003e Upgrade \u003ca href\u003d\"https://github.com/actions\"\u003e\u003ccode\u003e​actions\u003c/code\u003e\u003c/a\u003e dependencies to Node 24 compatible versions (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1259\"\u003e#1259\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/4f41a90a1f38628c7ccc608d05fbafe701bc20ae\"\u003e\u003ccode\u003e4f41a90\u003c/code\u003e\u003c/a\u003e Bump urllib3 from 2.5.0 to 2.6.0 in /\u003cstrong\u003etests\u003c/strong\u003e/data (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1253\"\u003e#1253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/83679a892e2d95755f2dac6acb0bfd1e9ac5d548\"\u003e\u003ccode\u003e83679a8\u003c/code\u003e\u003c/a\u003e Bump \u003ccode\u003e​types/node\u003c/code\u003e from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/bfc4944b43a5d84377eca3cf6ab5b7992ba61923\"\u003e\u003ccode\u003ebfc4944\u003c/code\u003e\u003c/a\u003e Bump prettier from 3.5.3 to 3.6.2 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1234\"\u003e#1234\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/97aeb3efb8a852c559869050c7fb175b4efcc8cf\"\u003e\u003ccode\u003e97aeb3e\u003c/code\u003e\u003c/a\u003e Bump requests from 2.32.2 to 2.32.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1130\"\u003e#1130\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/443da59188462e2402e2942686db5aa6723f4bed\"\u003e\u003ccode\u003e443da59\u003c/code\u003e\u003c/a\u003e Bump actions/publish-action from 0.3.0 to 0.4.0 \u0026amp; Documentation update for pi...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/cfd55ca82492758d853442341ad4d8010466803a\"\u003e\u003ccode\u003ecfd55ca\u003c/code\u003e\u003c/a\u003e graalpy: add graalpy early-access and windows builds (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/880\"\u003e#880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/bba65e51ff35d50c6dbaaacd8a4681db13aa7cb4\"\u003e\u003ccode\u003ebba65e5\u003c/code\u003e\u003c/a\u003e Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md (\u003ca href\u003d\"https://redirect.github.com/actions/setup-python/issues/1094\"\u003e#1094\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-python/commit/18566f86b301499665bd3eb1a2247e0849c64fa5\"\u003e\u003ccode\u003e18566f8\u003c/code\u003e\u003c/a\u003e Improve wording and \u0026quot;fix example\u0026quot; (remove 3.13) on testing against pre-releas...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-python/compare/v5...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-python\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5\u0026new-version\u003d6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7466 from dependabot[bot]/dependabot/github_actions/actions/setup-python-6.\n\nCloses #7466\n\n74d4be6b0 [dependabot[bot]] Bump actions/setup-python from 5 to 6\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "fc0a20d41f0276f9dcb734b0e9a43449583ba4ad", "tree": "9806d9c833603e4d8576b387a2d35267c0c6164d", "parents": [ "38fee05725241a1facfdf65384e7c7cdb0e03370" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri May 22 20:06:03 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 22 20:06:03 2026 +0800" }, "message": "[KYUUBI #7464] Bump actions/stale from 9 to 10.2.0\n\nBumps [actions/stale](https://github.com/actions/stale) from 9 to 10.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/stale/releases\"\u003eactions/stale\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix checking state cache (fix \u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1136\"\u003e#1136\u003c/a\u003e) and switch to Octokit helper methods by \u003ca href\u003d\"https://github.com/itchyny\"\u003e\u003ccode\u003e​itchyny\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1152\"\u003eactions/stale#1152\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade js-yaml from 4.1.0 to 4.1.1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1304\"\u003eactions/stale#1304\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade lodash from 4.17.21 to 4.17.23 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1313\"\u003eactions/stale#1313\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by \u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1312\"\u003eactions/stale#1312\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/itchyny\"\u003e\u003ccode\u003e​itchyny\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1152\"\u003eactions/stale#1152\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/stale/compare/v10...v10.2.0\"\u003ehttps://github.com/actions/stale/compare/v10...v10.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev10.1.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Missing Input Reading for \u003ccode\u003eonly-issue-types\u003c/code\u003e by \u003ca href\u003d\"https://github.com/Bibo-Joshi\"\u003e\u003ccode\u003e​Bibo-Joshi\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1298\"\u003eactions/stale#1298\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eImprovement\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproves error handling when rate limiting is disabled on GHES. by \u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e​chiranjib-swain\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1300\"\u003eactions/stale#1300\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade eslint-config-prettier from 8.10.0 to 10.1.8 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1276\"\u003eactions/stale#1276\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​types/node\u003c/code\u003e from 20.10.3 to 24.2.0 and document breaking changes in v10 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1280\"\u003eactions/stale#1280\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/publish-action from 0.3.0 to 0.4.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1291\"\u003eactions/stale#1291\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/checkout from 4 to 6 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1306\"\u003eactions/stale#1306\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/chiranjib-swain\"\u003e\u003ccode\u003e​chiranjib-swain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1300\"\u003eactions/stale#1300\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/stale/compare/v10...v10.1.1\"\u003ehttps://github.com/actions/stale/compare/v10...v10.1.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev10.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eonly-issue-types\u003c/code\u003e option to filter issues by type by \u003ca href\u003d\"https://github.com/Bibo-Joshi\"\u003e\u003ccode\u003e​Bibo-Joshi\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1255\"\u003eactions/stale#1255\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Bibo-Joshi\"\u003e\u003ccode\u003e​Bibo-Joshi\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1255\"\u003eactions/stale#1255\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/stale/compare/v10...v10.1.0\"\u003ehttps://github.com/actions/stale/compare/v10...v10.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev10.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to node 24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/stale/pull/1279\"\u003eactions/stale#1279\u003c/a\u003e\nMake sure your runner is on version v2.327.1 or later to ensure compatibility with this release. \u003ca href\u003d\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eRelease Notes\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/b5d41d4e1d5dceea10e7104786b73624c18a190f\"\u003e\u003ccode\u003eb5d41d4\u003c/code\u003e\u003c/a\u003e build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1313\"\u003e#1313\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/dcd2b9469d2220b7e8d08aedc00c105d277fd46b\"\u003e\u003ccode\u003edcd2b94\u003c/code\u003e\u003c/a\u003e Fix punycode and url.parse Deprecation Warnings (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1312\"\u003e#1312\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/d6f8a33132340b15a7006f552936e4b9b39c00ec\"\u003e\u003ccode\u003ed6f8a33\u003c/code\u003e\u003c/a\u003e build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1304\"\u003e#1304\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/a21a0816299b11691f9592ef0d63d08e02f06d9d\"\u003e\u003ccode\u003ea21a081\u003c/code\u003e\u003c/a\u003e Fix checking state cache (fix \u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1136\"\u003e#1136\u003c/a\u003e), also switch to octokit methods (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/997185467fa4f803885201cee163a9f38240193d\"\u003e\u003ccode\u003e9971854\u003c/code\u003e\u003c/a\u003e build(deps): bump actions/checkout from 4 to 6 (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1306\"\u003e#1306\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/5611b9defa6b7799a950489b00163db69f7a3ece\"\u003e\u003ccode\u003e5611b9d\u003c/code\u003e\u003c/a\u003e build(deps): bump actions/publish-action from 0.3.0 to 0.4.0 (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1291\"\u003e#1291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/fad0de84e50d1aba7b0236cdaf0ea98a43286849\"\u003e\u003ccode\u003efad0de8\u003c/code\u003e\u003c/a\u003e Improves error handling when rate limiting is disabled on GHES. (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1300\"\u003e#1300\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/39bea7de61dd70ce4705a976f904f33d5e1e0f49\"\u003e\u003ccode\u003e39bea7d\u003c/code\u003e\u003c/a\u003e Add Missing Input Reading for \u003ccode\u003eonly-issue-types\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1298\"\u003e#1298\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/e46bbabb3ede15841d25946157759558dd16306e\"\u003e\u003ccode\u003ee46bbab\u003c/code\u003e\u003c/a\u003e build(deps-dev): bump \u003ccode\u003e​types/node\u003c/code\u003e from 20.10.3 to 24.2.0 and document breakin...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/stale/commit/65d1d4804d3060875fff9f9fa8a49e27f71ce7f0\"\u003e\u003ccode\u003e65d1d48\u003c/code\u003e\u003c/a\u003e build(deps-dev): bump eslint-config-prettier from 8.10.0 to 10.1.8 (\u003ca href\u003d\"https://redirect.github.com/actions/stale/issues/1276\"\u003e#1276\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/stale/compare/v9...v10.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/stale\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d9\u0026new-version\u003d10.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7464 from dependabot[bot]/dependabot/github_actions/actions/stale-10.2.0.\n\nCloses #7464\n\n95616ca09 [dependabot[bot]] Bump actions/stale from 9 to 10.2.0\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "38fee05725241a1facfdf65384e7c7cdb0e03370", "tree": "fbf8d57a69bb180ac5634aa405dd88a0acfab80b", "parents": [ "00d73d0d0874698e68e17a3408b4827423a5c9e1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri May 22 20:05:25 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 22 20:05:25 2026 +0800" }, "message": "[KYUUBI #7467] Bump actions/cache from 4 to 5\n\nBumps [actions/cache](https://github.com/actions/cache) from 4 to 5.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003eactions/cache\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\n\u003cstrong\u003e\u003ccode\u003eactions/cachev5\u003c/code\u003e runs on the Node.js 24 runtime and requires a minimum Actions Runner version of \u003ccode\u003e2.327.1\u003c/code\u003e.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIf you are using self-hosted runners, ensure they are updated before upgrading.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003chr /\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to use node24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1630\"\u003eactions/cache#1630\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v5.0.0 release by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1684\"\u003eactions/cache#1684\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v4.3.0...v5.0.0\"\u003ehttps://github.com/actions/cache/compare/v4.3.0...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd note on runner versions by \u003ca href\u003d\"https://github.com/GhadimiR\"\u003e\u003ccode\u003e​GhadimiR\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1642\"\u003eactions/cache#1642\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare \u003ccode\u003ev4.3.0\u003c/code\u003e release by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1655\"\u003eactions/cache#1655\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/GhadimiR\"\u003e\u003ccode\u003e​GhadimiR\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1642\"\u003eactions/cache#1642\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v4...v4.3.0\"\u003ehttps://github.com/actions/cache/compare/v4...v4.3.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.2.4\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1620\"\u003eactions/cache#1620\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eactions/cache\u003c/code\u003e to \u003ccode\u003e4.0.5\u003c/code\u003e and move \u003ccode\u003eprotobuf-ts/plugin\u003c/code\u003e to dev depdencies by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1634\"\u003eactions/cache#1634\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare release \u003ccode\u003e4.2.4\u003c/code\u003e by \u003ca href\u003d\"https://github.com/Link\"\u003e\u003ccode\u003e​Link\u003c/code\u003e\u003c/a\u003e- in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1636\"\u003eactions/cache#1636\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e​nebuk89\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1620\"\u003eactions/cache#1620\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v4...v4.2.4\"\u003ehttps://github.com/actions/cache/compare/v4...v4.2.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.2.3\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to use \u003ccode\u003e​actions/cache\u003c/code\u003e 4.0.3 package \u0026amp; prepare for new release by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1577\"\u003eactions/cache#1577\u003c/a\u003e (SAS tokens for cache entries are now masked in debug logs)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1577\"\u003eactions/cache#1577\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/cache/compare/v4.2.2...v4.2.3\"\u003ehttps://github.com/actions/cache/compare/v4.2.2...v4.2.3\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003eactions/cache\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleases\u003c/h1\u003e\n\u003ch2\u003eHow to prepare a release\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\u003cbr /\u003e\nRelevant for maintainers with write access only.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003col\u003e\n\u003cli\u003eSwitch to a new branch from \u003ccode\u003emain\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm test\u003c/code\u003e to ensure all tests are passing.\u003c/li\u003e\n\u003cli\u003eUpdate the version in \u003ca href\u003d\"https://github.com/actions/cache/blob/main/package.json\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/package.json\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003enpm run build\u003c/code\u003e to update the compiled files.\u003c/li\u003e\n\u003cli\u003eUpdate this \u003ca href\u003d\"https://github.com/actions/cache/blob/main/RELEASES.md\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/RELEASES.md\u003c/code\u003e\u003c/a\u003e with the new version and changes in the \u003ccode\u003e## Changelog\u003c/code\u003e section.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed cache\u003c/code\u003e to update the license report.\u003c/li\u003e\n\u003cli\u003eRun \u003ccode\u003elicensed status\u003c/code\u003e and resolve any warnings by updating the \u003ca href\u003d\"https://github.com/actions/cache/blob/main/.licensed.yml\"\u003e\u003ccode\u003ehttps://github.com/actions/cache/blob/main/.licensed.yml\u003c/code\u003e\u003c/a\u003e file with the exceptions.\u003c/li\u003e\n\u003cli\u003eCommit your changes and push your branch upstream.\u003c/li\u003e\n\u003cli\u003eOpen a pull request against \u003ccode\u003emain\u003c/code\u003e and get it reviewed and merged.\u003c/li\u003e\n\u003cli\u003eDraft a new release \u003ca href\u003d\"https://github.com/actions/cache/releases\"\u003ehttps://github.com/actions/cache/releases\u003c/a\u003e use the same version number used in \u003ccode\u003epackage.json\u003c/code\u003e\n\u003col\u003e\n\u003cli\u003eCreate a new tag with the version number.\u003c/li\u003e\n\u003cli\u003eAuto generate release notes and update them to match the changes you made in \u003ccode\u003eRELEASES.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eToggle the set as the latest release option.\u003c/li\u003e\n\u003cli\u003ePublish the release.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003cli\u003eNavigate to \u003ca href\u003d\"https://github.com/actions/cache/actions/workflows/release-new-action-version.yml\"\u003ehttps://github.com/actions/cache/actions/workflows/release-new-action-version.yml\u003c/a\u003e\n\u003col\u003e\n\u003cli\u003eThere should be a workflow run queued with the same version number.\u003c/li\u003e\n\u003cli\u003eApprove the run to publish the new version and update the major tags for this action.\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2\u003eChangelog\u003c/h2\u003e\n\u003ch3\u003e5.0.4\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eminimatch\u003c/code\u003e to v3.1.5 (fixes ReDoS via globstar patterns)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eundici\u003c/code\u003e to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003efast-xml-parser\u003c/code\u003e to v5.5.6\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.3\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v5.0.5 (Resolves: \u003ca href\u003d\"https://github.com/actions/cache/security/dependabot/33\"\u003ehttps://github.com/actions/cache/security/dependabot/33\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/core\u003c/code\u003e to v2.0.3\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.2\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump \u003ccode\u003eactions/cache\u003c/code\u003e to v5.0.3 \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1692\"\u003e#1692\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.1\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003eazure/storage-blob\u003c/code\u003e to \u003ccode\u003e^12.29.1\u003c/code\u003e via \u003ccode\u003eactions/cache5.0.1\u003c/code\u003e \u003ca href\u003d\"https://redirect.github.com/actions/cache/pull/1685\"\u003e#1685\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e5.0.0\u003c/h3\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\n\u003ccode\u003eactions/cachev5\u003c/code\u003e runs on the Node.js 24 runtime and requires a minimum Actions Runner version of \u003ccode\u003e2.327.1\u003c/code\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/27d5ce7f107fe9357f9df03efb73ab90386fccae\"\u003e\u003ccode\u003e27d5ce7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1747\"\u003e#1747\u003c/a\u003e from actions/yacaovsnc/update-dependency\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/f280785d7b6e1884c7d12b9136eb0f4a1574fcfd\"\u003e\u003ccode\u003ef280785\u003c/code\u003e\u003c/a\u003e licensed changes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/619aeb1606e195be0b36fd0ff68dcf1aff6b65a7\"\u003e\u003ccode\u003e619aeb1\u003c/code\u003e\u003c/a\u003e npm run build generated dist files\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/bcf16c2893940a4899761e55c7ac3c1cf88a04f6\"\u003e\u003ccode\u003ebcf16c2\u003c/code\u003e\u003c/a\u003e Update ts-http-runtime to 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/668228422ae6a00e4ad889ee87cd7109ec5666a7\"\u003e\u003ccode\u003e6682284\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1738\"\u003e#1738\u003c/a\u003e from actions/prepare-v5.0.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/e34039626f957d3e3e50843d15c1b20547fc90e2\"\u003e\u003ccode\u003ee340396\u003c/code\u003e\u003c/a\u003e Update RELEASES\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/8a671105293e81530f1af99863cdf94550aba1a6\"\u003e\u003ccode\u003e8a67110\u003c/code\u003e\u003c/a\u003e Add licenses\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/1865903e1b0cb750dda9bc5c58be03424cc62830\"\u003e\u003ccode\u003e1865903\u003c/code\u003e\u003c/a\u003e Update dependencies \u0026amp; patch security vulnerabilities\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/565629816435f6c0b50676926c9b05c254113c0c\"\u003e\u003ccode\u003e5656298\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/actions/cache/issues/1722\"\u003e#1722\u003c/a\u003e from RyPeck/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/cache/commit/4e380d19e192ace8e86f23f32ca6fdec98a673c6\"\u003e\u003ccode\u003e4e380d1\u003c/code\u003e\u003c/a\u003e Fix cache key in examples.md for bun.lock\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/cache/compare/v4...v5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/cache\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4\u0026new-version\u003d5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7467 from dependabot[bot]/dependabot/github_actions/actions/cache-5.\n\nCloses #7467\n\n641fac05a [dependabot[bot]] Bump actions/cache from 4 to 5\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "00d73d0d0874698e68e17a3408b4827423a5c9e1", "tree": "358ef043f025ea0effd6d2e262211335293cae5b", "parents": [ "8d536c0a5596fe9f83eb680d333667e4d26797a9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri May 22 20:04:40 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 22 20:04:40 2026 +0800" }, "message": "[KYUUBI #7468] Bump actions/setup-node from 4 to 6\n\nBumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/actions/setup-node/releases\"\u003eactions/setup-node\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBreaking Changes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eLimit automatic caching to npm, update workflows and documentation by \u003ca href\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e​priyagupta108\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1374\"\u003eactions/setup-node#1374\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDependency Upgrades\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1336\"\u003e#1336\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade prettier from 2.8.8 to 3.6.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1334\"\u003e#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/publish-action from 0.3.0 to 0.4.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1362\"\u003e#1362\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-node/compare/v5...v6.0.0\"\u003ehttps://github.com/actions/setup-node/compare/v5...v6.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnhance caching in setup-node with automatic package manager detection by \u003ca href\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e​priya-kinthali\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1348\"\u003eactions/setup-node#1348\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis update, introduces automatic caching when a valid \u003ccode\u003epackageManager\u003c/code\u003e field is present in your \u003ccode\u003epackage.json\u003c/code\u003e. This aims to improve workflow performance and make dependency management more seamless.\nTo disable this automatic caching, set \u003ccode\u003epackage-manager-cache: false\u003c/code\u003e\u003c/p\u003e\n\u003cpre lang\u003d\"yaml\"\u003e\u003ccode\u003esteps:\n- uses: actions/checkoutv5\n- uses: actions/setup-nodev5\n with:\n package-manager-cache: false\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade action to use node24 by \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1325\"\u003eactions/setup-node#1325\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eMake sure your runner is on version v2.327.1 or later to ensure compatibility with this release. \u003ca href\u003d\"https://github.com/actions/runner/releases/tag/v2.327.1\"\u003eSee Release Notes\u003c/a\u003e\u003c/p\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e​octokit/request-error\u003c/code\u003e and \u003ccode\u003e​actions/github\u003c/code\u003e by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1227\"\u003eactions/setup-node#1227\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade uuid from 9.0.1 to 11.1.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1273\"\u003eactions/setup-node#1273\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade undici from 5.28.5 to 5.29.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1295\"\u003eactions/setup-node#1295\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade form-data to bring in fix for critical vulnerability by \u003ca href\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e​gowridurgad\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1332\"\u003eactions/setup-node#1332\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions/checkout from 4 to 5 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1345\"\u003eactions/setup-node#1345\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e​priya-kinthali\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1348\"\u003eactions/setup-node#1348\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e​salmanmkc\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/actions/setup-node/pull/1325\"\u003eactions/setup-node#1325\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/actions/setup-node/compare/v4...v5.0.0\"\u003ehttps://github.com/actions/setup-node/compare/v4...v5.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.4.0\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e\"\u003e\u003ccode\u003e48b55a0\u003c/code\u003e\u003c/a\u003e Update Node.js versions in versions.yml and bump package to v6.4.0 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1533\"\u003e#1533\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/ab72c7e7eba0eaa11f8cab0f5679243900c2cac9\"\u003e\u003ccode\u003eab72c7e\u003c/code\u003e\u003c/a\u003e Upgrade \u003ca href\u003d\"https://github.com/actions\"\u003e\u003ccode\u003e​actions\u003c/code\u003e\u003c/a\u003e dependencies (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1525\"\u003e#1525\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/53b83947a5a98c8d113130e565377fae1a50d02f\"\u003e\u003ccode\u003e53b8394\u003c/code\u003e\u003c/a\u003e Bump minimatch from 3.1.2 to 3.1.5 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1498\"\u003e#1498\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/54045abd5dcd3b0fee9ca02fa24c57545834c9cc\"\u003e\u003ccode\u003e54045ab\u003c/code\u003e\u003c/a\u003e Scope test lockfiles by package manager and update cache tests (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1495\"\u003e#1495\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/c882bffdbd4df51ace6b940023952e8669c9932a\"\u003e\u003ccode\u003ec882bff\u003c/code\u003e\u003c/a\u003e Replace uuid with crypto.randomUUID() (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1378\"\u003e#1378\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/774c1d62961e73038a114d59c8847023c003194d\"\u003e\u003ccode\u003e774c1d6\u003c/code\u003e\u003c/a\u003e feat(node-version-file): support parsing \u003ccode\u003edevEngines\u003c/code\u003e field (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1283\"\u003e#1283\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/efcb663fc60e97218a2b2d6d827f7830f164739e\"\u003e\u003ccode\u003eefcb663\u003c/code\u003e\u003c/a\u003e fix: remove hardcoded bearer (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1467\"\u003e#1467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/d02c89dce7e1ba9ef629ce0680989b3a1cc72edb\"\u003e\u003ccode\u003ed02c89d\u003c/code\u003e\u003c/a\u003e Fix npm audit issues (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1491\"\u003e#1491\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/6044e13b5dc448c55e2357c09f80417699197238\"\u003e\u003ccode\u003e6044e13\u003c/code\u003e\u003c/a\u003e Docs: bump actions/checkout from v5 to v6 (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1468\"\u003e#1468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/actions/setup-node/commit/8e494633d082d609d1e9ff931be32f8a44f1f657\"\u003e\u003ccode\u003e8e49463\u003c/code\u003e\u003c/a\u003e Fix README typo (\u003ca href\u003d\"https://redirect.github.com/actions/setup-node/issues/1226\"\u003e#1226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/actions/setup-node/compare/v4...v6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-node\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d4\u0026new-version\u003d6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #7468 from dependabot[bot]/dependabot/github_actions/actions/setup-node-6.\n\nCloses #7468\n\nfa5f3cad9 [dependabot[bot]] Bump actions/setup-node from 4 to 6\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "8d536c0a5596fe9f83eb680d333667e4d26797a9", "tree": "9b4158172fd57b67084bfa07d62a632c8d1e89fb", "parents": [ "ce49b3f1e77b39a9a5f384be552632d40a8fe9a4" ], "author": { "name": "lifumao", "email": "lifumao@tencent.com", "time": "Fri May 22 20:02:41 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 22 20:02:41 2026 +0800" }, "message": "[KYUUBI #7457] Bump log4j from 2.25.4 to 2.26.0\n\n### Why are the changes needed?\n\nFix https://github.com/apache/kyuubi/issues/7457. Log4j throws NPE when rendering a Throwable with concurrently-mutated suppressions, it is fixed in https://github.com/apache/logging-log4j2/releases/tag/rel%2F2.26.0 (see https://github.com/apache/logging-log4j2/issues/3929).\n\n### How was this patch tested?\n\nExisting GA.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #7469 from maomaodev/kyuubi-7457.\n\nCloses #7457\n\n91b1a36db [lifumao] [KYUUBI #7457] Bump log4j from 2.25.4 to 2.26.0\n\nAuthored-by: lifumao \u003clifumao@tencent.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "ce49b3f1e77b39a9a5f384be552632d40a8fe9a4", "tree": "a68d27a72dab780bd40e9190317e2c405938d8ac", "parents": [ "e451d40f48dc4947e67583a80ce6ed8159cc63fe" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Fri May 22 20:01:10 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 22 20:01:10 2026 +0800" }, "message": "[KYUUBI #7445] Add AGENTS.md to guide AI coding agents\n\n### Why are the changes needed?\n\nResolves #7445. Adds `AGENTS.md` at the repo root — a terse, command-oriented guide for AI coding agents contributing to Kyuubi. Complements `CONTRIBUTING.md`. Content is distilled from review feedback on landed PRs and aligned with sibling Apache projects (Spark, Iceberg, Airflow, DataFusion); the methodology and underlying rule set are linked in #7445.\n\n### How was this patch tested?\n\nDocumentation-only change. Every referenced command, Maven profile, script path, class name, and file path was verified against the current `master`. Maven invocations (`-Pfast`, `-DwildcardSuites`, `-Dtest`, `dev/reformat` via Spotless) were run on tiny modules to confirm the documented usage actually executes.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nAssisted-by: Claude:claude-opus-4-7\n\nCloses #7452 from wangzhigang1999/kyuubi-7445-agents-md.\n\nCloses #7445\n\n7783fe395 [Cheng Pan] Apply suggestion from @pan3793\n362fc3a75 [Cheng Pan] Apply suggestion from @pan3793\n705cf4f43 [wangzhigang] [KYUUBI #7445] AGENTS.md \u0026 PR template: relax Assisted-by format per review\nbb861cbf6 [wangzhigang] [KYUUBI #7445] AGENTS.md \u0026 PR template: adopt Assisted-by: \u003cAGENT\u003e:\u003cMODEL_ID\u003e\ncaf20d9b2 [wangzhigang] [KYUUBI #7445] Retrigger CI\nd0c685c73 [wangzhigang] [KYUUBI #7445] AGENTS.md: another review pass\n91cf6c0e9 [wangzhigang] [KYUUBI #7445] Trim AGENTS.md: drop Source Notation, tighten to Spark/Iceberg style\nf17ae4150 [wangzhigang] [KYUUBI #7445] Refine SparkSession.active legacy note in AGENTS.md Never list\n44ec7dc29 [wangzhigang] [KYUUBI #7445] Note RAT scanning; soften SparkSession.active and process.destroy primary rules\n7fd8c1c44 [wangzhigang] [KYUUBI #7445] Tighten AGENTS.md after third review pass\n6dfe98f8d [wangzhigang] [KYUUBI #7445] Remove hard line wraps from AGENTS.md\n335d6edcf [wangzhigang] [KYUUBI #7445] Correct AGENTS.md after second review pass\ndbc13bd42 [wangzhigang] [KYUUBI #7445] Fix command and path references in AGENTS.md\na09dabf83 [wangzhigang] [KYUUBI #7445] Add AGENTS.md to guide AI coding agents\n\nLead-authored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nCo-authored-by: Cheng Pan \u003cpan3793@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "e451d40f48dc4947e67583a80ce6ed8159cc63fe", "tree": "59299607a0811ea8a3fde81657f8ffe526c07ea1", "parents": [ "92857e8aeb0a4c25c17d22ea3237620d1c52a1c4" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Thu May 21 21:58:23 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Thu May 21 21:58:23 2026 +0200" }, "message": "[KYUUBI #7460] [CI] Enable Dependabot for GitHub Actions\n\n### Why are the changes needed?\nThese changes are needed to be compliant with [ASF GitHub Actions Policy](https://infra.apache.org/github-actions-policy.html).\nThe implementation follows instructions at [Dependabot for Dependency Management](https://infra.apache.org/dependabot.html) page.\n\nRelated to [[Umbrella] Ensure GitHub Actions compliance with ASF Policy #7456](https://github.com/apache/kyuubi/issues/7456).\n\n### How was this patch tested?\nReview.\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7460 from dnskr/enable-dependabot-for-github-actions.\n\nCloses #7460\n\nc6e84b33a [Denis Krivenko] [CI] Enable Dependabot for GitHub Actions\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "92857e8aeb0a4c25c17d22ea3237620d1c52a1c4", "tree": "d38171136e82ca86ef9cd5acb6fa578662ce19aa", "parents": [ "ae352b8afe5399cb3046b9da623a18c8f30e921e" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Thu May 21 21:55:50 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Thu May 21 21:55:50 2026 +0200" }, "message": "[KYUUBI #7461] [CI] Set default max-parallel value for all matrices\n\n### Why are the changes needed?\nThese changes are needed to ensure compliancy with [ASF GitHub Actions Policy](https://infra.apache.org/github-actions-policy.html).\nThe default value is set to `15`, which is the recommended job concurrency level.\nAll other matrices already have specified `max-parallel` value.\n\nSimilar PR: https://github.com/apache/airflow/pull/61954\n\nRelated to [[Umbrella] Ensure GitHub Actions compliance with ASF Policy #7456](https://github.com/apache/kyuubi/issues/7456).\n\n### How was this patch tested?\nReview.\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7461 from dnskr/set-max-parallel-for-all-matrices.\n\nCloses #7461\n\ne8c82f69f [Denis Krivenko] [CI] Set default max-parallel value for all matrices\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "ae352b8afe5399cb3046b9da623a18c8f30e921e", "tree": "741f363800b8cc23fc73429409aab33ff926dc84", "parents": [ "d5a62ab6c2c90b280cdf04b62f430f8e1e1a0505" ], "author": { "name": "lifumao", "email": "lifumao@tencent.com", "time": "Mon May 18 13:31:51 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon May 18 13:31:51 2026 +0800" }, "message": "[KYUUBI #6943][1/2] HiveScan supports DPP\n\n### Why are the changes needed?\n\nPart 1 of 2 to add KSHC support for dynamic partition pruning (DPP). See https://github.com/apache/kyuubi/issues/6943.\n- [x] Add DPP support in `HiveScan` for non-Parquet/ORC tables.\n- [ ] Add DPP support in `ParquetScan` / `ORCScan` for Parquet/ORC tables.\n\n### How was this patch tested?\n\n1. Unit tests\n2. Manual test: TPC-DS benchmark (11 GB text dataset).\n\n- **Spark configuration used for the benchmark(Spark 3.5.7, Kyuubi 1.12.0-SNAPSHOT):**\n```\nspark.driver.cores 1\nspark.driver.memory 4g\nspark.executor.cores 1\nspark.executor.instances 10\nspark.executor.memory 4g\nspark.master yarn\nspark.shuffle.service.enabled true\nspark.yarn.appMasterEnv.JAVA_HOME /usr/local/jdk-17\nspark.executorEnv.JAVA_HOME /usr/local/jdk-17\n```\n\n- **Overall performance (sum of 99)**\n\n| Dimension | Vanilla Spark | KSHC Before | KSHC Now |\n| ----------------- | ------------: | ----------: | ----------: |\n| Total time | 5950.10 s | 2836.49 s | 2691.95 s |\n| vs. Vanilla Spark | — | −52.33% | −54.76% |\n| vs. KSHC Before | — | — | **−5.10%** |\n\nKSHC Now provides a 5.10% (~144 s) speedup over KSHC Before, with no correctness regression.\n\n- **DPP hit subset (70/99)**\n\nDPP trigger was detected by matching `runtime partition filter` in the driver logs.\n\n```\n3,4,5,6,7,8,10,11,12,13,14,15,17,18,19,20,23,25,26,27,29,30,31,32,33,\n35,36,38,40,42,45,46,47,48,49,50,51,52,53,54,55,56,57,58,60,63,64,65,\n66,67,69,70,71,72,74,75,77,78,79,80,81,83,85,86,87,89,91,92,97,98\n```\n\n| Dimension | Vanilla Spark | KSHC Before | KSHC Now |\n| ----------------- | ------------: | ----------: | ----------: |\n| Subset total time | 3418.34 s | 2180.60 s | 2028.51 s |\n| vs. Vanilla Spark | — | −36.21% | −40.66% |\n| vs. KSHC Before | — | — | **−6.97%** |\n\nOn the DPP-hit subset, KSHC Now provides a 6.97% speedup over KSHC Before, noticeably larger than the overall 5.10%, indicating the performance benefit mainly comes from queries where DPP is triggered.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nPartially assisted by Claude Code (Claude Opus 4.7) for unit test, code style fixes, and analysis of TPC-DS benchmark results. Core design and implementation are human-authored.\n\nCloses #7436 from maomaodev/kyuubi-6943.\n\nCloses #6943\n\na77a1d0ec [lifumao] fix style\nc7ed36838 [lifumao] remove config\na0141341a [lifumao] fix doc\n7829bf8e3 [lifumao] fix ut\n824df8ee3 [lifumao] use SupportsRuntimeFiltering\na32b4e8c0 [lifumao] fix ut\n50afc82f4 [lifumao] [KYUUBI #6943][1/2]HiveScan support dpp\n\nAuthored-by: lifumao \u003clifumao@tencent.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "d5a62ab6c2c90b280cdf04b62f430f8e1e1a0505", "tree": "ac3c1e84287ce8c005c27b1fee413452f59fa2a2", "parents": [ "1699e175a2391a902b57ec4e55c286f0ab674f9d" ], "author": { "name": "lifumao", "email": "lifumao@tencent.com", "time": "Mon May 18 00:12:34 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon May 18 00:12:34 2026 +0800" }, "message": "[KYUUBI #7443] Fix NullPointerException when configuring the wrong SPARK_HOME\n\n### Why are the changes needed?\n\nFix NullPointerException when configuring the wrong SPARK_HOME. For example:\n```\nbin/kyuubi-beeline \\\n -u \u0027jdbc:kyuubi://localhost:10009/default\u0027 \\\n --conf kyuubi.engineEnv.SPARK_HOME\u003d/path/of/not/exist\n```\n\n### How was this patch tested?\n\n1. Unit test\n2. Manual test\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nPartially assisted by Claude Code (Claude Opus 4.7) for unit test.\n\nCloses #7450 from maomaodev/kyuubi-7443.\n\nCloses #7443\n\ncb2e3618c [lifumao] Fix NullPointerException when configuring the wrong SPARK_HOME\n\nAuthored-by: lifumao \u003clifumao@tencent.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "1699e175a2391a902b57ec4e55c286f0ab674f9d", "tree": "8702f223dd68a4965602df95b73241c05e9d2c99", "parents": [ "7282a68075e45927b308d2150c4b72eae66d9527" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Fri May 15 14:02:36 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 15 14:02:36 2026 +0800" }, "message": "[KYUUBI #7446] [CI] Upgrade actions/checkout to the latest v6 version\n\n### Why are the changes needed?\nThe changes are needed to keep CI dependencies up to date.\n\n### How was this patch tested?\nCI\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7446 from dnskr/upgrade-actions/checkout@v6.\n\nCloses #7446\n\n33121e414 [Denis Krivenko] [CI] Upgrade upgrade-actions/checkout to v6\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "7282a68075e45927b308d2150c4b72eae66d9527", "tree": "c4d0e7366672c91616608119a7495d04e5e07fe4", "parents": [ "6cf487ed32bb0a5af8413a4e4ba09aca6eabf80f" ], "author": { "name": "kongjiexin", "email": "kongjiexin888@gmail.com", "time": "Fri May 15 14:01:40 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Fri May 15 14:01:40 2026 +0800" }, "message": "[KYUUBI #7438] Make JSON event logger permission management configurable\n\n### Why are the changes needed?\nThe built-in JSON event logger currently creates event log directories and actively sets permissions on directories and log files.\n\nThis default behavior is useful for the built-in permission model, but it can conflict with deployments where access control is managed by Apache Ranger, inherited HDFS ACLs, or other external authorization systems. In those environments, an engine user may have permission to create and write event logs, while still not being allowed to call `setPermission` on the target path.\n\nThis patch adds `kyuubi.event.json.log.manage.permissions.enabled`, defaulting to `true`, to keep the existing behavior unchanged. When set to `false`, the JSON event logger no longer actively manages directory or file permissions, leaving access control to Ranger, HDFS ACLs, filesystem defaults, or other external permission systems.\n\nThis helps multi-tenant Kyuubi deployments use a shared JSON event log root without requiring\neach engine user to own or chmod the target HDFS path.\n\n### How was this patch tested?\n- [x] Added tests for default JSON event log file permission management.\n- [x] Added tests for writing JSON event logs when permission management is disabled.\n- [x] Ran:\n```bash\nbuild/mvn -pl kyuubi-events -am -DwildcardSuites\u003dorg.apache.kyuubi.events.handler.JsonLoggingEventHandlerSuite test\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\nThis patch was prepared with assistance from OpenAI Codex; the contributor reviewed and validated the changes.\n\nCloses #7439 from kongjiexin888-source/json-event-log-permission-management.\n\nCloses #7438\n\nafbd81598 [kongjiexin] Make JSON event logger permission management configurable\n\nAuthored-by: kongjiexin \u003ckongjiexin888@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "6cf487ed32bb0a5af8413a4e4ba09aca6eabf80f", "tree": "a4579f2223dd1b110d5807d9dccf12567a8850ce", "parents": [ "62a7786b9141225b75a3f1e75b1b3b70b502c609" ], "author": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Thu May 14 10:50:37 2026 +0900" }, "committer": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Thu May 14 10:50:37 2026 +0900" }, "message": "[KYUUBI #7418] Rename kyuubi.engine.security.* parameters to kyuubi.internal.security.* and document them\n\n### Why are the changes needed?\n\n`kyuubi.engine.security.*` parameters are misleading because they affect not only Kyuubi engines but also Kyuubi Servers\u0027 internal communication. Rename these parameters to `kyuubi.internal.security.*` with a fallback and document them. Also add a new document to explain how to configure secure internal communication.\n\n### How was this patch tested?\n\nCovered by CI\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #7418 from aajisaka/public-engine-secure.\n\nCloses #7418\n\n861cea95f [Akira Ajisaka] Improve the doc\nc9f620391 [Akira Ajisaka] Fix doc formatting\n8be695c3c [Akira Ajisaka] Add internal secure access doc\n7658c05dc [Akira Ajisaka] Rename the config to kyuubi.internal.security.* with a fallback\n218d06ce7 [Akira Ajisaka] Document the features are available only when kyuubi.engine.security.enabled is true\ned1e76258 [Akira Ajisaka] Make kyuubi.engine.security parameters public\n\nAuthored-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\nSigned-off-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\n" }, { "commit": "62a7786b9141225b75a3f1e75b1b3b70b502c609", "tree": "f9bd135068784aa4bc299694850ffd7492d5de19", "parents": [ "98f81f2deab63b1b835be8ac9710f1290cca5f8f" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Wed May 13 13:49:28 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Wed May 13 13:49:28 2026 +0200" }, "message": "[KYUUBI #7440] Update Apache Gluten references after graduation\n\n### Why are the changes needed?\nThe PR updates Apache Gluten references after graduation to a Top Level Project.\nThe PR addresses the issue https://github.com/apache/kyuubi/issues/7361.\n\n### How was this patch tested?\nCI and review.\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7440 from dnskr/update-apache-gluten-references.\n\nCloses #7440\n\n51f5b18a6 [Denis Krivenko] Refine Gluten documentation\n78bf984e7 [Denis Krivenko] Update Apache Gluten references after graduation\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "98f81f2deab63b1b835be8ac9710f1290cca5f8f", "tree": "b565f8c6cd6c09d11694dec7feda0870a7fc899a", "parents": [ "be35121c5d6d53150459ad14afe661cb3ce3e69c" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Wed May 13 11:45:46 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed May 13 11:45:46 2026 +0800" }, "message": "[KYUUBI #7305] Route JDBC engine metadata calls through DatabaseMetaData\n\n### Why are the changes needed?\n\nThe JDBC engine used to answer metadata requests with dialect-specific, hand-written `INFORMATION_SCHEMA` SQL for `getCatalogs`, `getSchemas`, `getTables`, `getColumns`, `getTypeInfo`, `getFunctions`, `getPrimaryKeys`, and `getCrossReference`.\n\nThat path was hard to keep aligned with the JDBC contract. Clients could see swapped or missing catalog/schema columns, backend-specific labels such as Impala\u0027s `TABLE_MD`, and inconsistent metadata filter handling across dialects.\n\nThis PR replaces those per-dialect SQL builders with the standard JDBC `DatabaseMetaData.getXxx(...)` APIs from the backend driver, while keeping catalog-vs-schema conventions and metadata-only label normalization in `JdbcDialect`.\n\nConcretely this is the cause of #7305 (\"DBeaver returned all tables in all databases when connecting\"): the default `JdbcDialect` threw `featureNotSupported` for `getCatalogsOperation` / `getSchemasOperation`, so DBeaver could not obtain a database list and fell back to `getTables(null, null, ...)`, which the Hive client rewrites to schemaPattern\u003d`\"%\"`. Routing `getCatalogs` / `getSchemas` through `DatabaseMetaData` lets the backend driver answer them directly, so DBeaver gets a real catalog/schema list and the all-databases fallback no longer fires. This is the direction pan3793 suggested on #7419, which this PR supersedes.\n\n### What changes?\n\n- Replace the hand-written metadata SQL path with backend `DatabaseMetaData` calls.\n- Add dialect support for database-term handling and metadata column-label normalization.\n- Pass the resolved session dialect consistently through metadata operations.\n- Apply the URL-level database before running per-session initialize SQL.\n- Add `ResultSetFetchIterator` for correct metadata streaming, partial fetch, and idempotent close behavior.\n\n### Compatibility notes\n\nMetadata result sets now follow the JDBC spec more closely. Clients using spec column names should benefit; clients depending on the old non-spec labels or catalog/schema layout may need updates.\n\nWhen the JDBC URL carries a database, `JdbcSessionImpl` now switches to it before executing the per-session initialize SQL, so init SQL runs in the URL-specified database rather than the driver\u0027s default.\n\n### How was this patch tested?\n\n- Updated existing per-dialect `OperationSuite` coverage for MySQL, PostgreSQL, Oracle, Phoenix, ClickHouse, Doris, StarRocks, and Impala.\n- Added backend metadata contract suites that verify the Hive JDBC client over Thrift sees JDBC-spec column names, key fields, and metadata filters.\n- Added `ResultSetFetchIteratorSuite` for prefetch, partial fetch, and close behavior.\n- Verified end-to-end via beeline against all eight dialects (MySQL, PostgreSQL, Oracle, Phoenix, ClickHouse, Doris, StarRocks, Impala): metadata operations return JDBC-spec column layouts and `SELECT` against existing tables succeeds.\n- Full DDL/DML cycles (`DROP IF EXISTS` -\u003e `CREATE` -\u003e `INSERT` -\u003e `SELECT` -\u003e `DROP`) verified on StarRocks, Doris, MySQL, PostgreSQL, and ClickHouse; Oracle / Phoenix / Impala excluded since their DDL grammar diverges.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nYes. Claude Opus 4.7 helped draft parts of the test cases and local test-environment setup. The implementation, test results, and final changes were reviewed and validated by the author.\n\n---\n\nCloses #7305. Supersedes #7419.\n\nCloses #7442 from wangzhigang1999/KYUUBI-7305.\n\nCloses #7305\n\n7e6d727a9 [wangzhigang] [KYUUBI #7305] Address review nits\nd92796691 [wangzhigang] [KYUUBI #7305] Replace higher-order function operations with concrete classes\n94883e4ae [wangzhigang] [KYUUBI #7305] Polish ImpalaSchemaHelper comment with upstream source link\n15bdd03ef [wangzhigang] [KYUUBI #7305] Inline DatabaseTermSupport into MySQL/ClickHouse dialects\n2c5d2d6a5 [wangzhigang] [KYUUBI #7305] Add phoenix-queryserver-client as test dep for jdbc-it\ne444fcb3c [wangzhigang] [KYUUBI #7305] Apply URL catalog + fix PG getSchemas test assertion\n1b11f7335 [wangzhigang] [KYUUBI #7305] Extract metadata call lambdas to named vals for readability\n87a97858f [wangzhigang] [KYUUBI #7305] Hive JDBC metadata contract tests across 8 dialects\nb699942da [wangzhigang] [KYUUBI #7305] Route JDBC engine metadata calls through DatabaseMetaData\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "be35121c5d6d53150459ad14afe661cb3ce3e69c", "tree": "07a5754e1481791c647f47472b1b7dad24b43cee", "parents": [ "c1f5f51c6e1db33a65d0edb9b6a211d97bdcaab1" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Tue May 12 21:50:59 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Tue May 12 21:50:59 2026 +0200" }, "message": "[KYUUBI #7444] Upgrade actions/first-interactionto v3\n\n### Why are the changes needed?\nThe changes are needed to keep dependencies up-to-date and resolve the issue [[Bug] Greetings on PRs do not work #1727\n](https://github.com/apache/kyuubi/issues/1727)\n\nIf the changes do not solve the problem, we can add additional permissions similar to https://github.com/actions/first-interaction/issues/10#issuecomment-2201870495\n\nImplemented based on [README example](https://github.com/actions/first-interaction/blob/a1db7729b356323c7988c20ed6f0d33fe31297be/README.md).\n\n### How was this patch tested?\nTested in private repository.\n\nOnly first issue has comment:\n\u003cimg width\u003d\"828\" height\u003d\"281\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/ecdff963-705a-471e-b3f5-92faf5ced172\" /\u003e\n\u003cimg width\u003d\"820\" height\u003d\"522\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/bc358e6f-f5f6-4b4c-8417-7837249da705\" /\u003e\n\nOnly PR issue has comment:\n\u003cimg width\u003d\"838\" height\u003d\"294\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/c04c792b-9ccc-4f6c-a834-15cacbf57c33\" /\u003e\n\u003cimg width\u003d\"837\" height\u003d\"654\" alt\u003d\"image\" src\u003d\"https://github.com/user-attachments/assets/5ef7ebcf-7d3b-44bf-8cdb-1c252fcd7ed2\" /\u003e\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7444 from dnskr/upgrade-actions/first-interaction-to-v3.\n\nCloses #7444\n\nb4361ff03 [Denis Krivenko] Upgrade actions/first-interactionto v3\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "c1f5f51c6e1db33a65d0edb9b6a211d97bdcaab1", "tree": "df58d009fc2cd5f3814738f0b06bdf3b044fd2b2", "parents": [ "0711f44a7c94f207e489318f68ec21a4c430d03a" ], "author": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Mon May 11 18:03:53 2026 +0200" }, "committer": { "name": "Denis Krivenko", "email": "dnskrv88@gmail.com", "time": "Mon May 11 18:03:53 2026 +0200" }, "message": "[KYUUBI #7441] [DOC] Update Apache Paimon references after graduation\n\n### Why are the changes needed?\nThe PR removes \"(Incubating)\" from the Apache Paimon references and it\u0027s needed to keep documentation up to date.\nSee [Apache Software Foundation Announces New Top-Level Project Apache® Paimon](https://news.apache.org/foundation/entry/apache-software-foundation-announces-new-top-level-project-apache-paimon).\n\n### How was this patch tested?\nBuilt the documentation with the following command and verified the text:\n```shell\nmake html\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #7441 from dnskr/update-apache-paimon-references.\n\nCloses #7441\n\n185a753fe [Denis Krivenko] Fix link for Apache Paimon Trino\n94ebbc128 [Denis Krivenko] Fix link for Apache Paimon Trino\n8fa66fc7e [Denis Krivenko] [DOC] Update Apache Paimon references after graduation\n\nAuthored-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\nSigned-off-by: Denis Krivenko \u003cdnskrv88@gmail.com\u003e\n" }, { "commit": "0711f44a7c94f207e489318f68ec21a4c430d03a", "tree": "abe15392149fc2a9d8c991c4594f7426aff7efcd", "parents": [ "25ae677dbf5904bf314cc67389dbc98bafea786e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed May 06 14:23:47 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed May 06 14:23:47 2026 +0800" }, "message": "[KYUUBI #7432] Bump org.postgresql:postgresql from 42.7.2 to 42.7.11\n\nBumps [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) from 42.7.2 to 42.7.11.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/releases\"\u003eorg.postgresql:postgresql\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev42.7.11\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: Limit SCRAM PBKDF2 iterations accepted from the server.\npgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.\nSee the \u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq\"\u003eSecurity Advisory\u003c/a\u003e for more detail.\nThe following \u003ca href\u003d\"https://nvd.nist.gov/vuln/detail/CVE-2026-42198\"\u003eCVE-2026-42198\u003c/a\u003e has been issued.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: Add sources and javadocs to shaded published lib generation \u003ca href\u003d\"https://github.com/sehrope\"\u003e\u003ccode\u003e​sehrope\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4043\"\u003e#4043\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eupdate Changelog and website for release of 42.7.11 \u003ca href\u003d\"https://github.com/davecramer\"\u003e\u003ccode\u003e​davecramer\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4042\"\u003e#4042\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix scram fix location in changelog and update published artifact developer list \u003ca href\u003d\"https://github.com/sehrope\"\u003e\u003ccode\u003e​sehrope\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4041\"\u003e#4041\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRestrict test with scram_iterations to v16+ and release notes \u003ca href\u003d\"https://github.com/sehrope\"\u003e\u003ccode\u003e​sehrope\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4040\"\u003e#4040\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore(deps): update ubuntu:24.04 docker digest to 84e77de \u003ca href\u003d\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e​renovate-bot\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4017\"\u003e#4017\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003etest: add tests for QueryExecutor#getTransactionState \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4006\"\u003e#4006\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore(deps): update actions/create-github-app-token action to v2.2.2 \u003ca href\u003d\"https://github.com/renovate-bot\"\u003e\u003ccode\u003e​renovate-bot\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3983\"\u003e#3983\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: fix flaky CopyBothResponseTest by using WAL flush LSN \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3979\"\u003e#3979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: fix flaky replication restart tests by waiting for confirmed_flush_lsn \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3975\"\u003e#3975\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003etest: fix flaky LogicalReplicationStatusTest by polling pg_stat_replication \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3974\"\u003e#3974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: replace Appveyor with ikalnytskyi/action-setup-postgres \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3966\"\u003e#3966\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003etest: move test table creation from \u003ca href\u003d\"https://github.com/BeforeEach\"\u003e\u003ccode\u003e​BeforeEach\u003c/code\u003e\u003c/a\u003e to \u003ca href\u003d\"https://github.com/BeforeAll\"\u003e\u003ccode\u003e​BeforeAll\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3967\"\u003e#3967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReturn jsonb as PGObject fixes Issue \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3926\"\u003e#3926\u003c/a\u003e \u003ca href\u003d\"https://github.com/davecramer\"\u003e\u003ccode\u003e​davecramer\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3956\"\u003e#3956\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdate docker scripts \u003ca href\u003d\"https://github.com/davecramer\"\u003e\u003ccode\u003e​davecramer\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3958\"\u003e#3958\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eimplement require_auth, this is pretty much how libpq does this. \u003ca href\u003d\"https://github.com/davecramer\"\u003e\u003ccode\u003e​davecramer\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3895\"\u003e#3895\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003edocs: add SCRAM authentication test setup section to TESTING.md \u003ca href\u003d\"https://github.com/emmaeng700\"\u003e\u003ccode\u003e​emmaeng700\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3945\"\u003e#3945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd RequireServerVersion annotation for tests \u003ca href\u003d\"https://github.com/sehrope\"\u003e\u003ccode\u003e​sehrope\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3939\"\u003e#3939\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix: ensure extended protocol messages end with Sync message \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3728\"\u003e#3728\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: enable cursor-based fetching in extended protocol when transaction started via SQL command \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3996\"\u003e#3996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: retry with SSL on IOException when sslMode\u003dALLOW \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3973\"\u003e#3973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: allow fallback to non-SSL connection when sslMode\u003dprefer and sslResponseTimeout kicks in \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3968\"\u003e#3968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: catch SecurityException from setContextClassLoader on ForkJoinPool workers \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3962\"\u003e#3962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: use compareTo for LogSequenceNumber comparison \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3961\"\u003e#3961\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: release COPY lock on IOException to prevent connection hang (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3957\"\u003e#3957\u003c/a\u003e) \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3960\"\u003e#3960\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🧰 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003estyle: replace \u003ca href\u003d\"https://github.com/exception\"\u003e\u003ccode\u003e​exception\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/throws\"\u003e\u003ccode\u003e​throws\u003c/code\u003e\u003c/a\u003e in getBoolean javadoc \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4035\"\u003e#4035\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: use \u003ccode\u003e​vlsi/github-actions-random-matrix\u003c/code\u003e npm package \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4008\"\u003e#4008\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: use tag names for pinning github actions, pin ikalnytskyi/action-setup-postgres \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4007\"\u003e#4007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: bump errorprone to 2.48.0 \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4005\"\u003e#4005\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003etest: add \u003ca href\u003d\"https://github.com/DisableLogger\"\u003e\u003ccode\u003e​DisableLogger\u003c/code\u003e\u003c/a\u003e annotation to suppress expected log warnings in tests \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3971\"\u003e#3971\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: suppress deprecations in test code to reduce build verbosity \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3972\"\u003e#3972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: replace log warning in ConnectionFactory.closeStream with Throwable.addSuppressed \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3970\"\u003e#3970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: use greedy pairwise coverage for CI matrix generation \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3965\"\u003e#3965\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: use full version tags in GitHub Actions comments \u003ca href\u003d\"https://github.com/vlsi\"\u003e\u003ccode\u003e​vlsi\u003c/code\u003e\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3963\"\u003e#3963\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⬆️ Dependencies\u003c/h2\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md\"\u003eorg.postgresql:postgresql\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[42.7.11] (2026-04-28)\u003c/h2\u003e\n\u003ch3\u003eSecurity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: Limit SCRAM PBKDF2 iterations accepted from the server.\npgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.\nSee the \u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq\"\u003eSecurity Advisory\u003c/a\u003e for more detail.\nThe following \u003ca href\u003d\"https://nvd.nist.gov/vuln/detail/CVE-2026-42198\"\u003eCVE-2026-42198\u003c/a\u003e has been issued.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat: implement require_auth connection property, aligning with libpq behavior [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3895\"\u003e#3895\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3895\"\u003epgjdbc/pgjdbc#3895\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: replace Appveyor CI with ikalnytskyi/action-setup-postgres [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3966\"\u003e#3966\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3966\"\u003epgjdbc/pgjdbc#3966\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003echore: upgrade Gradle to v9 [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3978\"\u003e#3978\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3978\"\u003epgjdbc/pgjdbc#3978\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: ensure extended protocol messages end with Sync message [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3728\"\u003e#3728\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3728\"\u003epgjdbc/pgjdbc#3728\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: enable cursor-based fetching in extended protocol when transaction started via SQL command [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3996\"\u003e#3996\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3996\"\u003epgjdbc/pgjdbc#3996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: retry with SSL on IOException when sslMode\u003dALLOW [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3973\"\u003e#3973\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3973\"\u003epgjdbc/pgjdbc#3973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: make sure the driver honours connectTimeout when retrying the connection [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3968\"\u003e#3968\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3968\"\u003epgjdbc/pgjdbc#3968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: allow fallback to non-SSL connection when sslMode\u003dprefer and sslResponseTimeout kicks in [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3968\"\u003e#3968\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3968\"\u003epgjdbc/pgjdbc#3968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: catch SecurityException from setContextClassLoader on ForkJoinPool workers [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3962\"\u003e#3962\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3962\"\u003epgjdbc/pgjdbc#3962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3961\"\u003e#3961\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3961\"\u003epgjdbc/pgjdbc#3961\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: release COPY lock on IOException to prevent connection hang [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3957\"\u003e#3957\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3957\"\u003epgjdbc/pgjdbc#3957\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: return jsonb as PGObject instead of String [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3956\"\u003e#3956\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3956\"\u003epgjdbc/pgjdbc#3956\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: align SSL key file permission check with libpq [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3952\"\u003e#3952\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3952\"\u003epgjdbc/pgjdbc#3952\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: guard connection closed flag with a reentrant lock to protect against concurrent close [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3905\"\u003e#3905\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3905\"\u003epgjdbc/pgjdbc#3905\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[42.7.10] (2026-02-11)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003echore: Migrate to Shadow 9 \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3931\"\u003ePR 3931\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003estyle: fix empty line before javadoc for checkstyle compliance [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3925\"\u003e#3925\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3925\"\u003epgjdbc/pgjdbc#3925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003estyle: fix lambda argument indentation for checkstyle compliance [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3922\"\u003e#3922\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3922\"\u003epgjdbc/pgjdbc#3922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003etest: add autosave\u003dalways|never|conservative and cleanupSavepoints\u003dtrue|false to the randomized CI jobs [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3917\"\u003e#3917\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3917\"\u003epgjdbc/pgjdbc#3917\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efix: non-standard strings failing test for version 19 [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3934\"\u003e#3934\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3934\"\u003epgjdbc/pgjdbc#3934\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: small issues in ConnectionFactoryImpl [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3929\"\u003e#3929\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3929\"\u003epgjdbc/pgjdbc#3929\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003efix: process pending responses before fastpath to avoid protocol errors \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3913\"\u003ePR # 3913\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edoc: use.md, fix typos [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3911\"\u003e#3911\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3911\"\u003epgjdbc/pgjdbc#3911\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003edoc: datasource.md, fix minor formatting issue [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3912\"\u003e#3912\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3912\"\u003epgjdbc/pgjdbc#3912\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003edoc: add the new PGP signing key to the official documentation [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3912\"\u003e#3912\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3813\"\u003epgjdbc/pgjdbc#3813\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eReverted\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRevert \u0026quot;fix: make all Calendar instances proleptic Gregorian (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3837\"\u003e#3837\u003c/a\u003e) (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3887\"\u003e#3887\u003c/a\u003e)\u0026quot; [PR \u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/3932\"\u003e#3932\u003c/a\u003e](\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/pull/3932\"\u003epgjdbc/pgjdbc#3932\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[42.7.9] (2026-01-14)\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/78e261ff2a7f16a37bdceb2204f67e484387da2f\"\u003e\u003ccode\u003e78e261f\u003c/code\u003e\u003c/a\u003e fix: Add sources and javadocs to shaded published lib generation\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/1e09fa0496377296c9e2ef3bfd2b409945fba17a\"\u003e\u003ccode\u003e1e09fa0\u003c/code\u003e\u003c/a\u003e update Changelog and website for release of 42.7.11 (\u003ca href\u003d\"https://redirect.github.com/pgjdbc/pgjdbc/issues/4042\"\u003e#4042\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/d479fa5b8c8c915a441ce1f2448f69f23dd0b66c\"\u003e\u003ccode\u003ed479fa5\u003c/code\u003e\u003c/a\u003e Fix scram fix location in changelog and update published artifact developer l...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/b04fc46af6c207bc7ce9e788fea8c43d18b73d0f\"\u003e\u003ccode\u003eb04fc46\u003c/code\u003e\u003c/a\u003e docs: Add scram max iters fix to changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/cf548225b4078db954765339720ffdf3bc94e5a6\"\u003e\u003ccode\u003ecf54822\u003c/code\u003e\u003c/a\u003e test: Disable scram test on older version without scram_iterations GUC\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/7dbcc79b2b4adf7b71458c9434d2c43cec7713b9\"\u003e\u003ccode\u003e7dbcc79\u003c/code\u003e\u003c/a\u003e test: Add SCRAM max iteration tests\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/c9d41d1332a7426fcef19ff89f2e6b1116429143\"\u003e\u003ccode\u003ec9d41d1\u003c/code\u003e\u003c/a\u003e fix: Limit SCRAM PBKDF2 iterations accepted from the server\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/a340cb2b0ae24c0d98ad9dec569200ebb704d6aa\"\u003e\u003ccode\u003ea340cb2\u003c/code\u003e\u003c/a\u003e style: replace \u003ca href\u003d\"https://github.com/exception\"\u003e\u003ccode\u003e​exception\u003c/code\u003e\u003c/a\u003e with \u003ca href\u003d\"https://github.com/throws\"\u003e\u003ccode\u003e​throws\u003c/code\u003e\u003c/a\u003e in getBoolean javadoc\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/77837f80c0c20a9f33f9e21b091f4d4552f8e753\"\u003e\u003ccode\u003e77837f8\u003c/code\u003e\u003c/a\u003e fix(deps): update dependency org.openrewrite.rewrite:org.openrewrite.rewrite....\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/commit/23af03bc839af5217ea141946ae41e648264061c\"\u003e\u003ccode\u003e23af03b\u003c/code\u003e\u003c/a\u003e chore(deps): update actions/checkout action to v6\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/pgjdbc/pgjdbc/compare/REL42.7.2...REL42.7.11\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.postgresql:postgresql\u0026package-manager\u003dmaven\u0026previous-version\u003d42.7.2\u0026new-version\u003d42.7.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/kyuubi/network/alerts).\n\n\u003c/details\u003e\n\nCloses #7432 from dependabot[bot]/dependabot/maven/org.postgresql-postgresql-42.7.11.\n\nCloses #7432\n\n544022984 [Cheng Pan] update dev/dependencyList\n1a4eef06f [dependabot[bot]] Bump org.postgresql:postgresql from 42.7.2 to 42.7.11\n\nLead-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "25ae677dbf5904bf314cc67389dbc98bafea786e", "tree": "ef6aac231bd3157aa51c9c7db8f21d6224d45067", "parents": [ "c961d1c2e89b64074bac606d114695081e2acde8" ], "author": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed May 06 11:45:22 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Wed May 06 11:45:22 2026 +0800" }, "message": "[KYUUBI #7430] Remove chat engine\n\n### Why are the changes needed?\n\nChat engine was introduced as an experimental feature, and never went into production-ready status.\n\n### How was this patch tested?\n\nReview.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #7430 from pan3793/rm-chat-engine.\n\nCloses #7430\n\nb95569155 [Cheng Pan] Remove chat engine\n\nAuthored-by: Cheng Pan \u003cchengpan@apache.org\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "c961d1c2e89b64074bac606d114695081e2acde8", "tree": "5a0be5d892447fb2e80ddf00044aab10935057b6", "parents": [ "7830d6dbbf4024bd324ae24478521c5ea9c28429" ], "author": { "name": "yuqi", "email": "yuqi@bestpay.com.cn", "time": "Mon May 04 23:10:01 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon May 04 23:10:01 2026 +0800" }, "message": "[KYUUBI #7428] Support fetchOrientation parameter in OperationRestApi.getOperationLog\n\n### Why are the changes needed?\n\n The current getOperationLog method in OperationRestApi does not support the fetchOrientation parameter, which limits the client\u0027s ability to control the fetch direction (e.g., FETCH_NEXT, FETCH_FIRST) when retrieving operation logs. This change adds an overloaded method that accepts\n fetchOrientation, while keeping the original method signature for backward compatibility.\n\n### How was this patch tested?\n\n - Existing tests should pass as the original method signature is preserved via method overloading.\n - Manual verification by calling the new API with and without fetchOrientation.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #7428 from ychris78/add-fetch-orientation-to-operation-log.\n\nCloses #7428\n\n45a6588c4 [yuqi] reformat code\ncf43fe94d [yuqi] add test\nab34e14e8 [yuqi] add `fetchOrientation` to getOperationLog\n\nAuthored-by: yuqi \u003cyuqi@bestpay.com.cn\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "7830d6dbbf4024bd324ae24478521c5ea9c28429", "tree": "6526fc970946f15a937b1b5d53f0d867bd260474", "parents": [ "73a1af180dbf7ee22b993900956c92f0d05fde97" ], "author": { "name": "wangzhigang", "email": "iamzhigangwang@gmail.com", "time": "Mon May 04 21:54:54 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Mon May 04 21:54:54 2026 +0800" }, "message": "[KYUUBI #7379][2b/4] Data Agent Engine: agent runtime, middleware stack, and OpenAI provider\n\n### Why are the changes needed?\n\nPart 2b of 4 for the Data Agent Engine ([umbrella](https://github.com/apache/kyuubi/issues/7379), [KPIP-7373](https://github.com/apache/kyuubi/discussions/7373)).\n\nThis PR adds the ReAct agent runtime that drives the LLM \u003c-\u003e tool loop, a composable middleware stack around it, and a production `OpenAiProvider`. It sits on top of the tool system and data source abstraction introduced in PR 2a, and is consumed by the REST layer in PR 3.\n\nChanges include:\n- `ReactAgent` — ReAct loop with streaming, tool-call dispatch, turn budget, malformed-tool-call recovery\n- `ConversationMemory` — message history with cumulative prompt-token tracking\n- `AgentRunContext` / `AgentInvocation` / `ApprovalMode` — per-run state plumbing\n- `ToolOutputStore` — size-gated tool-output offload, keyed by session+call-id, with `ReadToolOutputTool` / `GrepToolOutputTool` for LLM-driven retrieval\n- `AgentMiddleware` interface with `onRegister` hook for tool wiring, plus four middlewares:\n - `LoggingMiddleware` — structured request/response logging\n - `ApprovalMiddleware` — risk-level-based approval gate\n - `CompactionMiddleware` — token-threshold-driven history summarization keyed by session\n - `ToolResultOffloadMiddleware` — transparently owns the `ToolOutputStore` and registers retrieval tools\n- `OpenAiProvider` — OpenAI-compatible chat completions with streaming and tool calls\n- `ExecuteStatement.scala` — SSE encoding extended to emit `Compaction` events\n- Dialects moved under `datasource.dialect` package for organization\n- New `kyuubi.engine.data.agent.compaction.trigger.tokens` configuration entry\n- `MockLlmProvider` — deterministic mock for middleware and runtime tests\n- `mysql-connector-j` moved to `test` scope (GPL-licensed; cannot be bundled in an Apache binary release — addresses review feedback on #7417)\n\n### How was this patch tested?\n\n- **Unit tests (Java)**: `ConversationMemoryTest`, `ToolOutputStoreTest`, `ApprovalMiddlewareTest`, `CompactionMiddlewareTest`, `ToolResultOffloadMiddlewareTest`, `event/EventTest`, plus updates to `ToolRegistryThreadSafetyTest` / `ToolTest` / `RunSelectQueryToolTest` / `RunMutationQueryToolTest` / `JdbcDialectTest` / MySQL `DialectTest`\n- **Live LLM tests** (opt-in, require `DATA_AGENT_LLM_API_KEY` / `DATA_AGENT_LLM_API_URL` / `DATA_AGENT_LLM_MODEL`): `ReactAgentLiveTest`, `CompactionMiddlewareLiveTest` — exercise the full loop against a real OpenAI-compatible endpoint\n- **E2E (Scala)**: `DataAgentE2ESuite` extended with OpenAI-provider paths; new `DataAgentCompactionE2ESuite` observes compaction via JDBC\n- Existing unit + MySQL Testcontainers tests from PR 2a remain green\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nPartially assisted by Claude Code (Claude Opus 4.7) for test generation, code review, and PR formatting. Core design and implementation are human-authored.\n\nCloses #7417 from wangzhigang1999/pr2b/data-agent-runtime.\n\nCloses #7379\n\n1aac6aaa9 [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Split ReactAgent into LlmStreamClient + composite MiddlewareDispatcher\n9fe962509 [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Instruct LLM to SELECT after UPDATE in approval live test\n211e86770 [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Unify AgentMiddleware hook return types under Decision\u003cT\u003e\nb9b420813 [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Move ToolContext to first parameter in AgentTool.execute\n108e9cd24 [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Replace null-as-noop with explicit sentinel actions in AgentMiddleware\nd1777fcea [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Capitalize SQLite and MySQL in dialect class names\n87c1f44f8 [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Adopt Trino-style config keys, rename OpenAiProvider to ChatCompletionProvider\n39fb9c52f [wangzhigang] [KYUUBI #7379][2b/4][FOLLOWUP] Tighten data-agent dependencies: drop SQLite/PostgreSQL bundle, pin kotlin/okhttp/okio\n52235617d [wangzhigang] [KYUUBI #7379][2b/4] Move mysql-connector-j to test scope\nce4eeccf5 [wangzhigang] [KYUUBI #7379][2b/4] Data Agent Engine: agent runtime, middleware stack, OpenAI provider, and live E2E tests\n\nAuthored-by: wangzhigang \u003ciamzhigangwang@gmail.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "73a1af180dbf7ee22b993900956c92f0d05fde97", "tree": "a8ca61b22832f5bd4d5241ee9908654a99ffc7ad", "parents": [ "c6b01db5069099f64a26117f0ed4aa2137ccf505" ], "author": { "name": "Hoon Oh", "email": "hoonoh@geico.com", "time": "Tue Apr 28 17:28:00 2026 +0800" }, "committer": { "name": "Cheng Pan", "email": "chengpan@apache.org", "time": "Tue Apr 28 17:28:00 2026 +0800" }, "message": "[KYUUBI #7407] STGroup free to avoid OOM Kill\n\n### Why are the changes needed?\n\nWhen LDAP Authentication is used ST Token is created and saved in the cache, but it is never freed up.\nThis is causing continuous increase in heap usage, eventually causing out-of-memory for kyuubi server pods.\n\nThis changes is added to clear ST Tokens. Also ST Group is added to avoid any race condition during clean up.\n\n### How was this patch tested?\n\nThis patch was tested in our customer environment. We observed there\u0027s no more continuous heap increase after the fix.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nCursor auto-complete feature was used.\n\nCloses #7408 from oh0873/hoonoh/STTokenCleanups.\n\nCloses #7407\n\n72740e0e0 [Hoon Oh] Update kyuubi-common/src/main/scala/org/apache/kyuubi/service/authentication/ldap/Query.scala\n18ee9bb66 [Hoon Oh] Added () to createFilter and render\ndd0f9103d [Hoon Oh] Explicit group definition\n321c4306d [Hoon Oh] Update kyuubi-common/src/main/scala/org/apache/kyuubi/service/authentication/ldap/Query.scala\n28cadbc3d [Hoon Oh] STGroup free to avoid OOM Kill\n\nLead-authored-by: Hoon Oh \u003choonoh@geico.com\u003e\nCo-authored-by: Hoon Oh \u003c92890928+oh0873@users.noreply.github.com\u003e\nSigned-off-by: Cheng Pan \u003cchengpan@apache.org\u003e\n" }, { "commit": "c6b01db5069099f64a26117f0ed4aa2137ccf505", "tree": "192ba4076238229af2a5d69dcd7585f95d34cc6b", "parents": [ "a99d6e03a37c5f0202fb01ca30838841fccfcb3e" ], "author": { "name": "Hiroki Egawa", "email": "hiegawa@lycorp.co.jp", "time": "Tue Apr 28 10:16:44 2026 +0900" }, "committer": { "name": "Akira Ajisaka", "email": "aajisaka@apache.org", "time": "Tue Apr 28 10:16:44 2026 +0900" }, "message": "[KYUUBI #7415] Add a configuration to include additional Spark keys as path validation targets\n\n### Why are the changes needed?\n\nTo add Spark configuration keys for path validation without rebuilding.\nClose: https://github.com/apache/kyuubi/issues/7415\n\n### How was this patch tested?\n\nUnit tests.\n\n```shell\n$ ./build/mvn clean install -Dtest\u003dnone -DwildcardSuites\u003dorg.apache.kyuubi.engine.KyuubiApplicationManagerSuite\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #7416 from LamiumAmplexicaule/add-spark-keys-as-check-target.\n\nCloses #7415\n\n2f8450c18 [Hiroki Egawa] Rename config name to `kyuubi.server.spark.file.config.list`\n61fc167de [Hiroki Egawa] Rename config name to `kyuubi.session.spark.file.config.list`\n418fd2263 [Hiroki Egawa] Remove redundant cases and add missing coverage\ne7726ffb7 [Hiroki Egawa] Add a configuration to include additional Spark keys as path validation targets\n\nAuthored-by: Hiroki Egawa \u003chiegawa@lycorp.co.jp\u003e\nSigned-off-by: Akira Ajisaka \u003caajisaka@apache.org\u003e\n" } ], "next": "a99d6e03a37c5f0202fb01ca30838841fccfcb3e" }