)]}'
{
  "log": [
    {
      "commit": "32046606774da481182dce2956f336dc8e79a579",
      "tree": "a9cbd22b2ce99473c22c00631d30d738b9bbcc8e",
      "parents": [
        "5b876e746cee4d15c8fae884ce4ab5d2b547ec0c"
      ],
      "author": {
        "name": "dajiaohuang",
        "email": "mikewushuwen@outlook.com",
        "time": "Thu Oct 29 20:34:29 2026 +0800"
      },
      "committer": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Thu Oct 29 20:34:29 2026 +0800"
      },
      "message": "ORC-2225: [C++] Use narrowed FLOAT value for statistics\n\n### What changes were proposed in this pull request?\n\nFor FLOAT columns, use the binary32 value represented by the serialized data when updating stripe statistics and Bloom filters. Keep DOUBLE behavior unchanged. Add a predicate-pushdown regression that searches for the stored FLOAT value after writing a value that rounds during binary32 conversion.\n\n### Why are the changes needed?\n\nORC-2225 reports that C++ FLOAT statistics can reflect the pre-narrowed double instead of the value serialized as FLOAT. Using the stored value consistently prevents statistics and Bloom filters from describing a different value than the encoded data.\n\n### How was this patch tested?\n\n- Built the C++ `orc-test` target with the task-local Visual Studio 2026 CMake/Ninja/MSVC configuration.\n- `orc-test.exe --gtest_filter\u003d\"*testFloatPredicateUsesStoredValue*\"` — 1/1 passed.\n- `orc-test.exe --gtest_filter\u003d\"TestPredicatePushdown.*\"` — 5/5 passed.\n- CTest `-R \"^orc-test$\" --output-on-failure` completed successfully.\n- `git diff --check` passed.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: OpenAI Codex gpt-6-luna\n\nCloses #2726 from dajiaohuang/w7/orc-2225-float-statistics.\n\nAuthored-by: dajiaohuang \u003cmikewushuwen@outlook.com\u003e\nSigned-off-by: ffacs \u003cffacs520@gmail.com\u003e\n"
    },
    {
      "commit": "5b876e746cee4d15c8fae884ce4ab5d2b547ec0c",
      "tree": "f88c5dafa24ff22d2f99fcb4e1f4735249d00273",
      "parents": [
        "7f63e00c3f00609d42f57c2da2eb94a14f9fdcce"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 15:18:51 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Oct 26 15:18:51 2026 +0800"
      },
      "message": "ORC-2233: Upgrade `lz4-java` to 1.11.4\n\nBumps [at.yawk.lz4:lz4-java](https://github.com/yawkat/lz4-java) from 1.11.2 to 1.11.4.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/yawkat/lz4-java/releases\"\u003eat.yawk.lz4:lz4-java\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elz4-java v1.11.4\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity release for \u003ca href\u003d\"https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv\"\u003eCVE-2026-106450\u003c/a\u003e, \u003ca href\u003d\"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr\"\u003eCVE-2026-106449\u003c/a\u003e and \u003ca href\u003d\"https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g\"\u003eCVE-2026-106451\u003c/a\u003e.\u003c/strong\u003e Also includes general fixes for bugs found by AI.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate astral-sh/setup-uv action to v10.2.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/97\"\u003eyawkat/lz4-java#97\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency com.carrotsearch.randomizedtesting:randomizedtesting-runner to v2.9.2 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/98\"\u003eyawkat/lz4-java#98\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate cloudflare/wrangler-action digest to 953926a by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/99\"\u003eyawkat/lz4-java#99\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix NPE in LZ4FrameInputStream on skippable-only streams by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/125\"\u003eyawkat/lz4-java#125\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRelease source critical array before throwing OOM in LZ4JNI by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/124\"\u003eyawkat/lz4-java#124\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix stale OutOfMemoryError reference in XXHashJNI by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/127\"\u003eyawkat/lz4-java#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReject truncated block header in LZ4BlockInputStream by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/128\"\u003eyawkat/lz4-java#128\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDon\u0027t restore the Maven cache in the release workflow by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/132\"\u003eyawkat/lz4-java#132\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRead skippable frame size as unsigned in LZ4FrameInputStream by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/131\"\u003eyawkat/lz4-java#131\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOnly run test workflow on push to main by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/136\"\u003eyawkat/lz4-java#136\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument CPU cost of high HC compression levels by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/141\"\u003eyawkat/lz4-java#141\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix int overflow in streaming XXHash update buffering check by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/138\"\u003eyawkat/lz4-java#138\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: declare requires-python \u0026gt;\u003d 3.12 in justfile scripts by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/130\"\u003eyawkat/lz4-java#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake docs manual-dispatch deploy branch explicit by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/137\"\u003eyawkat/lz4-java#137\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSwitch Maven wrapper to script-only and use strict checksums in CI by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/144\"\u003eyawkat/lz4-java#144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eVerify SHA-256 of lz4 CLI downloaded in Windows release job by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/134\"\u003eyawkat/lz4-java#134\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: validate version input and tag names before interpolating them by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/142\"\u003eyawkat/lz4-java#142\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTest safe decompressors with destination offsets and buffer kinds by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/146\"\u003eyawkat/lz4-java#146\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument that StreamingXXHash32.asChecksum() returns only 28 bits by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/140\"\u003eyawkat/lz4-java#140\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDeclare explicit GITHUB_TOKEN permissions in workflows by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/135\"\u003eyawkat/lz4-java#135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOnly publish to Central from v* tags by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/139\"\u003eyawkat/lz4-java#139\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTest the darwin/aarch64 native library before publishing by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/143\"\u003eyawkat/lz4-java#143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix negative LZ4BlockInputStream.available() after an empty block by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/129\"\u003eyawkat/lz4-java#129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDelete .clinerules by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/148\"\u003eyawkat/lz4-java#148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRework README, add contributing guide, Scorecard and coverage by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/147\"\u003eyawkat/lz4-java#147\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix test compilation on main: remove duplicate testAvailableAfterEmptyBlock by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/149\"\u003eyawkat/lz4-java#149\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/yawkat/lz4-java/compare/v1.11.3...v1.11.4\"\u003ehttps://github.com/yawkat/lz4-java/compare/v1.11.3...v1.11.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003elz4-java v1.11.3\u003c/h2\u003e\n\u003cp\u003eNot a security release. This is the second attempt at this release due to a javadoc issue.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate junit-framework monorepo to v6.1.3 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/80\"\u003eyawkat/lz4-java#80\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate workflows to Java 25 by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/82\"\u003eyawkat/lz4-java#82\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-javadoc-plugin to v3.12.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/68\"\u003eyawkat/lz4-java#68\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate astral-sh/setup-uv action to v10 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/84\"\u003eyawkat/lz4-java#84\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-compiler-plugin to v3.16.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/89\"\u003eyawkat/lz4-java#89\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.mvel:mvel2 to v2.5.4.Final by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/88\"\u003eyawkat/lz4-java#88\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate astral-sh/setup-uv action to v10.1.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/85\"\u003eyawkat/lz4-java#85\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate bnd.maven.plugin.version to v7.4.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/86\"\u003eyawkat/lz4-java#86\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.codehaus.mojo:build-helper-maven-plugin to v3.6.2 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/92\"\u003eyawkat/lz4-java#92\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake default decompression limit configurable by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/93\"\u003eyawkat/lz4-java#93\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRestore Javadoc output directory by \u003ca href\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/95\"\u003eyawkat/lz4-java#95\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0\"\u003e\u003ccode\u003e4af910b\u003c/code\u003e\u003c/a\u003e Remove duplicate testAvailableAfterEmptyBlock (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/149\"\u003e#149\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3\"\u003e\u003ccode\u003e7a48b7f\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8\"\u003e\u003ccode\u003ec8ebf97\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283\"\u003e\u003ccode\u003e2acc0ec\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/e0178d2337105543715146431151244d2b436da7\"\u003e\u003ccode\u003ee0178d2\u003c/code\u003e\u003c/a\u003e Rework README, add contributing guide, Scorecard and coverage (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/147\"\u003e#147\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/37ee3cc6d93ba4a767c78becdc8398f4e4f07126\"\u003e\u003ccode\u003e37ee3cc\u003c/code\u003e\u003c/a\u003e Delete .clinerules (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/148\"\u003e#148\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/788980d4c16ca0a769c33c93619e01147ad3905c\"\u003e\u003ccode\u003e788980d\u003c/code\u003e\u003c/a\u003e Fix negative LZ4BlockInputStream.available() after an empty block (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/129\"\u003e#129\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/5442f0ee3aa2db9627ca6e076b38cc6c827aa934\"\u003e\u003ccode\u003e5442f0e\u003c/code\u003e\u003c/a\u003e Test the darwin/aarch64 native library before publishing (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/143\"\u003e#143\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/68d4bfc66c559f77e694caed5d340166e4de4d2f\"\u003e\u003ccode\u003e68d4bfc\u003c/code\u003e\u003c/a\u003e Only publish to Central from v* tags (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/139\"\u003e#139\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/4c685a99c741dba697c069664befd0af0db5c732\"\u003e\u003ccode\u003e4c685a9\u003c/code\u003e\u003c/a\u003e Declare explicit GITHUB_TOKEN permissions in workflows (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/135\"\u003e#135\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/yawkat/lz4-java/compare/v1.11.2...v1.11.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dat.yawk.lz4:lz4-java\u0026package-manager\u003dmaven\u0026previous-version\u003d1.11.2\u0026new-version\u003d1.11.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/orc/network/alerts).\n\n\u003c/details\u003e\n\nCloses #2720 from dependabot[bot]/dependabot/maven/java/at.yawk.lz4-lz4-java-1.11.4.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "7f63e00c3f00609d42f57c2da2eb94a14f9fdcce",
      "tree": "9733efce3ee958cc1d1b800ef812287b53cc8fa0",
      "parents": [
        "3db937fa825041db5bcfc75425c02562fd0f9a01"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 15:16:56 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Oct 26 15:16:56 2026 +0800"
      },
      "message": "ORC-2232: Upgrade `build-helper-maven-plugin` to 3.6.2\n\nBumps [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) from 3.6.1 to 3.6.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/releases\"\u003eorg.codehaus.mojo:build-helper-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.6.2\u003c/h2\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReplace raw \u003ccode\u003eNPEx\u003c/code\u003e with customized exception message (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/239\"\u003e#239\u003c/a\u003e) \u003ca href\u003d\"https://github.com/pzygielo\"\u003e\u003ccode\u003e​pzygielo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/248\"\u003e#248\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/248\"\u003e#248\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/247\"\u003e#247\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/244\"\u003e#244\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 96 to 97 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/246\"\u003e#246\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/245\"\u003e#245\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/241\"\u003e#241\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 95 to 96 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/240\"\u003e#240\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 94 to 95 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/235\"\u003e#235\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 93 to 94 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/233\"\u003e#233\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 92 to 93 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/232\"\u003e#232\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 91 to 92 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/build-helper-maven-plugin/pull/231\"\u003e#231\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/813bc7d2f03f2c9975de1f079cf7a7334211e0b6\"\u003e\u003ccode\u003e813bc7d\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release 3.6.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/07d91091b06db894178bcb6e71bc55f857546f46\"\u003e\u003ccode\u003e07d9109\u003c/code\u003e\u003c/a\u003e Remove redundant maven-resolver-api and ignore Resolver/SLF4J 2.x in Dependabot\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/9abd552f324e429beb586407139eb4d43127344a\"\u003e\u003ccode\u003e9abd552\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/3c15526bf151e28d6ce651197b36958164da4d4a\"\u003e\u003ccode\u003e3c15526\u003c/code\u003e\u003c/a\u003e Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/3b1f104096756ce33e8fc3e4c3062b1ccd8cf227\"\u003e\u003ccode\u003e3b1f104\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.mojo:mojo-parent from 96 to 97\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/1749855c90317f651eed427e45cb27c52cf8a542\"\u003e\u003ccode\u003e1749855\u003c/code\u003e\u003c/a\u003e Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/52300415d70e84a20924c06c26d9375b152e5409\"\u003e\u003ccode\u003e5230041\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/c0e937567a4604534e32cf3cc4c3abb43bfa243c\"\u003e\u003ccode\u003ec0e9375\u003c/code\u003e\u003c/a\u003e Delete .github/release-drafter.yml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/84a839e4cb9b84b3afbbeef7f6c950ba5b478b31\"\u003e\u003ccode\u003e84a839e\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.mojo:mojo-parent from 95 to 96\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/commit/a85c668b83334b423844fc448709b1d6e53cb32c\"\u003e\u003ccode\u003ea85c668\u003c/code\u003e\u003c/a\u003e Replace raw \u003ccode\u003eNPEx\u003c/code\u003e with customized exception message\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.1...3.6.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.codehaus.mojo:build-helper-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.6.1\u0026new-version\u003d3.6.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nYou can trigger a rebase of this PR by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has been open for over 30 days.\n\nCloses #2713 from dependabot[bot]/dependabot/maven/java/org.codehaus.mojo-build-helper-maven-plugin-3.6.2.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "3db937fa825041db5bcfc75425c02562fd0f9a01",
      "tree": "769bae3d91e744461b48ce0c46f3338a6a619b89",
      "parents": [
        "c2c43049461f8f75b3e15d28d3ec4c504aa846d0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 15:11:54 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Oct 26 15:11:54 2026 +0800"
      },
      "message": "ORC-2231: Upgrade `spotbugs-maven-plugin` to 4.10.4.1\n\nBumps [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.10.3.0 to 4.10.4.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/releases\"\u003ecom.github.spotbugs:spotbugs-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003espotbugs-maven-plugin-4.10.4.1\u003c/h2\u003e\n\u003ch2\u003eBREAKING\u003c/h2\u003e\n\u003cp\u003eIn 2014, maven reporting added various settings that should have resulted in removal here but had gone unseen.  These are now applied and therefore the state changed to immutable which will cause plugin to fail if users do not adjust configuration as noted here.\u003c/p\u003e\n\u003cp\u003eUsers who previously configured \u003ccode\u003eoutputEncoding\u003c/code\u003e directly on the SpotBugs Maven Plugin must configure \u003ccode\u003eproject.reporting.outputEncoding\u003c/code\u003e instead and remove it to avoid errors.\nUsers passing \u003ccode\u003efork\u003c/code\u003e option should remove it to avoid warnings as support was gone in last release and it does nothing.\nUsers who previously configured \u003ccode\u003eoutputDirectory\u003c/code\u003e directly on the SpotBugs Maven Plugin must configure \u003ccode\u003eproject.reporting.outputDirectory\u003c/code\u003e instead and remove it to avoid errors.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMaven 4 rc 6 support, readme cleanup, use latest spotbugs in build, head tag, formatting by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1512\"\u003espotbugs/spotbugs-maven-plugin#1512\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixes 1511, removed shaded \u0027outputEncoding\u0027 that maven reporting added in 2014 by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1513\"\u003espotbugs/spotbugs-maven-plugin#1513\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove deprecated \u0027fork\u0027 option and update faq by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1514\"\u003espotbugs/spotbugs-maven-plugin#1514\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor cleanups by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1515\"\u003espotbugs/spotbugs-maven-plugin#1515\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse super class outputDirectory removing all duplication by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1516\"\u003espotbugs/spotbugs-maven-plugin#1516\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake ownership explicit on xdocs report writer by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1517\"\u003espotbugs/spotbugs-maven-plugin#1517\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCleanup some of the groovy code by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1518\"\u003espotbugs/spotbugs-maven-plugin#1518\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003evarious other library updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.4.0...spotbugs-maven-plugin-4.10.4.1\"\u003ehttps://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.4.0...spotbugs-maven-plugin-4.10.4.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003espotbugs-maven-plugin-4.10.4.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixes \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1474\"\u003e#1474\u003c/a\u003e by \u003ca href\u003d\"https://github.com/gigabitzauber\"\u003e\u003ccode\u003e​gigabitzauber\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1487\"\u003espotbugs/spotbugs-maven-plugin#1487\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate build by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1494\"\u003espotbugs/spotbugs-maven-plugin#1494\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCleanup charset handling and remove never used sourceEncoding in spot… by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1495\"\u003espotbugs/spotbugs-maven-plugin#1495\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove javaExecutable usage to prefer current process by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1496\"\u003espotbugs/spotbugs-maven-plugin#1496\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate deprecated artifact handling by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1497\"\u003espotbugs/spotbugs-maven-plugin#1497\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRequire maven 3.8.9 or better by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1499\"\u003espotbugs/spotbugs-maven-plugin#1499\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd missing javadocs by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1500\"\u003espotbugs/spotbugs-maven-plugin#1500\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOtherwise build updates and library updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/gigabitzauber\"\u003e\u003ccode\u003e​gigabitzauber\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1487\"\u003espotbugs/spotbugs-maven-plugin#1487\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.3.0...spotbugs-maven-plugin-4.10.4.0\"\u003ehttps://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.3.0...spotbugs-maven-plugin-4.10.4.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/59f4efceacba97db51f930bb435c300f52fb67a8\"\u003e\u003ccode\u003e59f4efc\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release spotbugs-maven-plugin-4.10.4.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/1081359804b1daa19b1bf1665495d4e06ec3a27e\"\u003e\u003ccode\u003e1081359\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1519\"\u003e#1519\u003c/a\u003e from spotbugs/renovate/byte-buddy.version\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/23caeff2a7537afcec037c82a6c0a93e94993cf6\"\u003e\u003ccode\u003e23caeff\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1520\"\u003e#1520\u003c/a\u003e from spotbugs/renovate/slf4j-monorepo\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/8a5d7f0d336b60dde62ee206ab0763d4bc506800\"\u003e\u003ccode\u003e8a5d7f0\u003c/code\u003e\u003c/a\u003e Update dependency org.slf4j:slf4j-bom to v2.0.19\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/8be188f139acdeca6b905be14bac557297d46c63\"\u003e\u003ccode\u003e8be188f\u003c/code\u003e\u003c/a\u003e Update byte-buddy.version to v1.18.13\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/742e10cd3457ef32eed0d3cf6764013fc6aeb017\"\u003e\u003ccode\u003e742e10c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1518\"\u003e#1518\u003c/a\u003e from hazendaz/master\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/d7f6a5681c1feb715e465d7cbdc2226b7f7dc47f\"\u003e\u003ccode\u003ed7f6a56\u003c/code\u003e\u003c/a\u003e Cleanup groovy in the trait\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/eda58b6a41688644cbb768771b0a98c93e01a673\"\u003e\u003ccode\u003eeda58b6\u003c/code\u003e\u003c/a\u003e Cleanup groovy within report generator\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/a518d7b3039dc3c7276c5e6c166bafe16ad6f900\"\u003e\u003ccode\u003ea518d7b\u003c/code\u003e\u003c/a\u003e Cleanup xdocs reporter groovy each usage\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/4c94029a7d350af2c7ac3790a674fb0bd37f7e8a\"\u003e\u003ccode\u003e4c94029\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1517\"\u003e#1517\u003c/a\u003e from hazendaz/master\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.3.0...spotbugs-maven-plugin-4.10.4.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eMost Recent Ignore Conditions Applied to This Pull Request\u003c/summary\u003e\n\n| Dependency Name | Ignore Conditions |\n| --- | --- |\n| com.github.spotbugs:spotbugs-maven-plugin | [\u003c 4.8, \u003e 4.7.3.4] |\n\u003c/details\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.spotbugs:spotbugs-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d4.10.3.0\u0026new-version\u003d4.10.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nYou can trigger a rebase of this PR by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has been open for over 30 days.\n\nCloses #2712 from dependabot[bot]/dependabot/maven/java/com.github.spotbugs-spotbugs-maven-plugin-4.10.4.1.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "c2c43049461f8f75b3e15d28d3ec4c504aa846d0",
      "tree": "a6741abbbe324319635b2c6add65bf003cd7def9",
      "parents": [
        "1ca6decb782bf8e85b0b46fb11548803050da2f6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 15:09:22 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Oct 26 15:09:22 2026 +0800"
      },
      "message": "ORC-2230: Bump `parquet` to 1.18.1\n\nBumps `parquet.version` from 1.17.1 to 1.18.1.\nUpdates `org.apache.parquet:parquet-hadoop` from 1.17.1 to 1.18.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-java/releases\"\u003eorg.apache.parquet:parquet-hadoop\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet 1.18.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnsure that toByteArray returns a copy of a buffer (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3729\"\u003eapache/parquet-java#3729\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix data corruption for array-backed buffers (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3717\"\u003eapache/parquet-java#3717\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd parameter to enable reading KMS URL from key (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3745\"\u003eapache/parquet-java#3745\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump Jackson and Jackson-databind from 2.22.1 to 2.22.2.\u003c/li\u003e\n\u003cli\u003eBump zstd-jni from 1.5.7-11 to 1.5.7-15.\u003c/li\u003e\n\u003cli\u003eBump fastutil from 8.5.18 to 8.5.19.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet 1.18.1 RC1\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1-rc1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1-rc1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet 1.18.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMINOR: Fix error message in SimpleGroup.add() for Binary by \u003ca href\u003d\"https://github.com/takezoe\"\u003e\u003ccode\u003e​takezoe\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3385\"\u003eapache/parquet-java#3385\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] remove comment from pom.xml by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3382\"\u003eapache/parquet-java#3382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: \u003ccode\u003eci-before_install.sh\u003c/code\u003e should show wget errors and retry by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3381\"\u003eapache/parquet-java#3381\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: Upgrade spotless plugin by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3380\"\u003eapache/parquet-java#3380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] Move on from java8 for three core modules by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3379\"\u003eapache/parquet-java#3379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: \u003ccode\u003ejapicmp\u003c/code\u003e checks are failing after Java 11 release by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3388\"\u003eapache/parquet-java#3388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: Bump version to 1.18.0-SNAPSHOT by \u003ca href\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3389\"\u003eapache/parquet-java#3389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3372\"\u003eGH-3372\u003c/a\u003e: Enhance ColumnSizeCommand to sort by size by \u003ca href\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3371\"\u003eapache/parquet-java#3371\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3399\"\u003eGH-3399\u003c/a\u003e: Hint IDE the source code generated by thrift by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3400\"\u003eapache/parquet-java#3400\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3387\"\u003eGH-3387\u003c/a\u003e: bump aircompressor to mitigate CVE-2025-67721 by \u003ca href\u003d\"https://github.com/olegbonar\"\u003e\u003ccode\u003e​olegbonar\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3403\"\u003eapache/parquet-java#3403\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3383\"\u003eGH-3383\u003c/a\u003e: Modernize mockito by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3384\"\u003eapache/parquet-java#3384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3404\"\u003eGH-3404\u003c/a\u003e: fix CI TestByteBitPacking512VectorLE.unpackValuesUsingVector randomly oom by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3405\"\u003eapache/parquet-java#3405\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3401\"\u003eGH-3401\u003c/a\u003e: Remove redundant MAP_KEY_VALUE annotation at middle level of logical type map by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3402\"\u003eapache/parquet-java#3402\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3406\"\u003eGH-3406\u003c/a\u003e: fix Float16 statistics handling for NaN and zero values by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3407\"\u003eapache/parquet-java#3407\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3215\"\u003eGH-3215\u003c/a\u003e: Sort the list of org.apache.parquet.format.Encoding created … by \u003ca href\u003d\"https://github.com/mbrannstrom\"\u003e\u003ccode\u003e​mbrannstrom\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3413\"\u003eapache/parquet-java#3413\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump dependabot limit by \u003ca href\u003d\"https://github.com/Fokko\"\u003e\u003ccode\u003e​Fokko\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3416\"\u003eapache/parquet-java#3416\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.21.0 to 5.22.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3436\"\u003eapache/parquet-java#3436\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache:apache from 33 to 37 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3431\"\u003eapache/parquet-java#3431\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.33.2 to 4.34.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3441\"\u003eapache/parquet-java#3441\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.luben:zstd-jni from 1.5.7-3 to 1.5.7-7 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3442\"\u003eapache/parquet-java#3442\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-shade-plugin from 3.6.0 to 3.6.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3430\"\u003eapache/parquet-java#3430\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.xerial.snappy:snappy-java from 1.1.10.7 to 1.1.10.8 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3426\"\u003eapache/parquet-java#3426\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.6.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3440\"\u003eapache/parquet-java#3440\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.parquet:parquet-pig from 1.15.0 to 1.15.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3420\"\u003eapache/parquet-java#3420\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-logging:commons-logging from 1.3.5 to 1.3.6 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3418\"\u003eapache/parquet-java#3418\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.re2j:re2j from 1.7 to 1.8 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3433\"\u003eapache/parquet-java#3433\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3429\"\u003eapache/parquet-java#3429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3411\"\u003eGH-3411\u003c/a\u003e Expose row group index via Parquet reader by \u003ca href\u003d\"https://github.com/uros7251brick\"\u003e\u003ccode\u003e​uros7251brick\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3412\"\u003eapache/parquet-java#3412\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.22.0 to 5.23.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3445\"\u003eapache/parquet-java#3445\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump net.openhft:zero-allocation-hashing from 0.27ea0 to 0.27ea1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3419\"\u003eapache/parquet-java#3419\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.tukaani:xz from 1.10 to 1.12 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3417\"\u003eapache/parquet-java#3417\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump it.unimi.dsi:fastutil from 8.5.15 to 8.5.18 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3422\"\u003eapache/parquet-java#3422\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-text from 1.13.1 to 1.15.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3438\"\u003eapache/parquet-java#3438\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3449\"\u003eGH-3449\u003c/a\u003e: Fix BinaryStats int overflow by \u003ca href\u003d\"https://github.com/Jiayi-Wang-db\"\u003e\u003ccode\u003e​Jiayi-Wang-db\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3448\"\u003eapache/parquet-java#3448\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-java/blob/master/CHANGES.md\"\u003eorg.apache.parquet:parquet-hadoop\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eParquet\u003c/h1\u003e\n\u003cp\u003eFrom 1.14.2 onwards, the Parquet project has migrated from Jira to GitHub, and the changelogs are now \u003ca href\u003d\"https://github.com/apache/parquet-java/releases\"\u003epublished under Releases\u003c/a\u003e.\u003c/p\u003e\n\u003ch3\u003eVersion 1.14.1\u003c/h3\u003e\n\u003cp\u003eRelease Notes - Parquet - Version 1.14.1\u003c/p\u003e\n\u003ch4\u003eBug\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2468\"\u003ePARQUET-2468\u003c/a\u003e - ParquetMetadata.toPrettyJSON throws exception on file read when LOG.isDebugEnabled()\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2498\"\u003ePARQUET-2498\u003c/a\u003e - Hadoop vector IO API doesn\u0027t handle empty list of ranges\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eVersion 1.14.0\u003c/h3\u003e\n\u003cp\u003eRelease Notes - Parquet - Version 1.14.0\u003c/p\u003e\n\u003ch4\u003eBug\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2260\"\u003ePARQUET-2260\u003c/a\u003e - Bloom filter bytes size shouldn\u0027t be larger than maxBytes size in the configuration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2266\"\u003ePARQUET-2266\u003c/a\u003e - Fix support for files without ColumnIndexes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2276\"\u003ePARQUET-2276\u003c/a\u003e - ParquetReader reads do not work with Hadoop version 2.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2300\"\u003ePARQUET-2300\u003c/a\u003e - Update jackson-core 2.13.4 to a version without CVE PRISMA-2023-0067\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2325\"\u003ePARQUET-2325\u003c/a\u003e - Fix parquet-cli\u0027s dictionary subcommand to work with FIXED_LEN_BYTE_ARRAY\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2329\"\u003ePARQUET-2329\u003c/a\u003e - Fix wrong help messages of parquet-cli subcommands\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2330\"\u003ePARQUET-2330\u003c/a\u003e - Fix convert-csv to show the correct position of the invalid record\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2332\"\u003ePARQUET-2332\u003c/a\u003e - Fix unexpectedly disabled tests to be executed\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2336\"\u003ePARQUET-2336\u003c/a\u003e - Add caching key to CodecFactory\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2342\"\u003ePARQUET-2342\u003c/a\u003e - Parquet writer produced a corrupted file due to page value count overflow\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2343\"\u003ePARQUET-2343\u003c/a\u003e - Fixes NPE when rewriting file with multiple rowgroups\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2348\"\u003ePARQUET-2348\u003c/a\u003e - Recompression/Re-encrypt should rewrite bloomfilter\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/7c22cdba6792fa29c5bda74bf1f866a08d7572a9\"\u003e\u003ccode\u003e7c22cdb\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release apache-parquet-1.18.1-rc1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/4c04bf78c01e62ebc26e355e4995790acc89a2e3\"\u003e\u003ccode\u003e4c04bf7\u003c/code\u003e\u003c/a\u003e Prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/4ae935328b030c9aa116bb6c0fd166ef5c66cd2f\"\u003e\u003ccode\u003e4ae9353\u003c/code\u003e\u003c/a\u003e Bump jackson.version from 2.22.1 to 2.22.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3739\"\u003e#3739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/a3501b61622be52c9620c0ed93480417f27b5600\"\u003e\u003ccode\u003ea3501b6\u003c/code\u003e\u003c/a\u003e \u003ccode\u003eBytesInput.copy(BytesInput)\u003c/code\u003e should return a copy (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3729\"\u003e#3729\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/3fd0ae7684e5768723158fad296db1894a633e55\"\u003e\u003ccode\u003e3fd0ae7\u003c/code\u003e\u003c/a\u003e Add parameter to enable reading KMS URL from key material (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3745\"\u003e#3745\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/afe34d8b04d82b6dace63901074d4d5f8e6b54e3\"\u003e\u003ccode\u003eafe34d8\u003c/code\u003e\u003c/a\u003e Bump com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3740\"\u003e#3740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/1916eff07f1315003a59d55e24b97919e741f329\"\u003e\u003ccode\u003e1916eff\u003c/code\u003e\u003c/a\u003e Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3744\"\u003e#3744\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/b1b7ffcad5e72d8dd80905290a83d021e56332c5\"\u003e\u003ccode\u003eb1b7ffc\u003c/code\u003e\u003c/a\u003e Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3725\"\u003e#3725\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/686bb10c93b9b4c3b9e106715f32f29ad2d47504\"\u003e\u003ccode\u003e686bb10\u003c/code\u003e\u003c/a\u003e Bump it.unimi.dsi:fastutil from 8.5.18 to 8.5.19 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3684\"\u003e#3684\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/663e9074c424262873cc8d35ead16da2c581522c\"\u003e\u003ccode\u003e663e907\u003c/code\u003e\u003c/a\u003e Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3704\"\u003e#3704\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.1...apache-parquet-1.18.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `org.apache.parquet:parquet-avro` from 1.17.1 to 1.18.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-java/releases\"\u003eorg.apache.parquet:parquet-avro\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet 1.18.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnsure that toByteArray returns a copy of a buffer (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3729\"\u003eapache/parquet-java#3729\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix data corruption for array-backed buffers (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3717\"\u003eapache/parquet-java#3717\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd parameter to enable reading KMS URL from key (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3745\"\u003eapache/parquet-java#3745\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump Jackson and Jackson-databind from 2.22.1 to 2.22.2.\u003c/li\u003e\n\u003cli\u003eBump zstd-jni from 1.5.7-11 to 1.5.7-15.\u003c/li\u003e\n\u003cli\u003eBump fastutil from 8.5.18 to 8.5.19.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet 1.18.1 RC1\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1-rc1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.18.0...apache-parquet-1.18.1-rc1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet 1.18.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMINOR: Fix error message in SimpleGroup.add() for Binary by \u003ca href\u003d\"https://github.com/takezoe\"\u003e\u003ccode\u003e​takezoe\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3385\"\u003eapache/parquet-java#3385\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] remove comment from pom.xml by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3382\"\u003eapache/parquet-java#3382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: \u003ccode\u003eci-before_install.sh\u003c/code\u003e should show wget errors and retry by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3381\"\u003eapache/parquet-java#3381\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMinor: Upgrade spotless plugin by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3380\"\u003eapache/parquet-java#3380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[minor] Move on from java8 for three core modules by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3379\"\u003eapache/parquet-java#3379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: \u003ccode\u003ejapicmp\u003c/code\u003e checks are failing after Java 11 release by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3388\"\u003eapache/parquet-java#3388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMINOR: Bump version to 1.18.0-SNAPSHOT by \u003ca href\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3389\"\u003eapache/parquet-java#3389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3372\"\u003eGH-3372\u003c/a\u003e: Enhance ColumnSizeCommand to sort by size by \u003ca href\u003d\"https://github.com/wgtmac\"\u003e\u003ccode\u003e​wgtmac\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3371\"\u003eapache/parquet-java#3371\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3399\"\u003eGH-3399\u003c/a\u003e: Hint IDE the source code generated by thrift by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3400\"\u003eapache/parquet-java#3400\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3387\"\u003eGH-3387\u003c/a\u003e: bump aircompressor to mitigate CVE-2025-67721 by \u003ca href\u003d\"https://github.com/olegbonar\"\u003e\u003ccode\u003e​olegbonar\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3403\"\u003eapache/parquet-java#3403\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3383\"\u003eGH-3383\u003c/a\u003e: Modernize mockito by \u003ca href\u003d\"https://github.com/dossett\"\u003e\u003ccode\u003e​dossett\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3384\"\u003eapache/parquet-java#3384\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3404\"\u003eGH-3404\u003c/a\u003e: fix CI TestByteBitPacking512VectorLE.unpackValuesUsingVector randomly oom by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3405\"\u003eapache/parquet-java#3405\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3401\"\u003eGH-3401\u003c/a\u003e: Remove redundant MAP_KEY_VALUE annotation at middle level of logical type map by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3402\"\u003eapache/parquet-java#3402\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3406\"\u003eGH-3406\u003c/a\u003e: fix Float16 statistics handling for NaN and zero values by \u003ca href\u003d\"https://github.com/HuaHuaY\"\u003e\u003ccode\u003e​HuaHuaY\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3407\"\u003eapache/parquet-java#3407\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3215\"\u003eGH-3215\u003c/a\u003e: Sort the list of org.apache.parquet.format.Encoding created … by \u003ca href\u003d\"https://github.com/mbrannstrom\"\u003e\u003ccode\u003e​mbrannstrom\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3413\"\u003eapache/parquet-java#3413\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump dependabot limit by \u003ca href\u003d\"https://github.com/Fokko\"\u003e\u003ccode\u003e​Fokko\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3416\"\u003eapache/parquet-java#3416\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.21.0 to 5.22.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3436\"\u003eapache/parquet-java#3436\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache:apache from 33 to 37 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3431\"\u003eapache/parquet-java#3431\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump protobuf.version from 4.33.2 to 4.34.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3441\"\u003eapache/parquet-java#3441\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.github.luben:zstd-jni from 1.5.7-3 to 1.5.7-7 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3442\"\u003eapache/parquet-java#3442\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-shade-plugin from 3.6.0 to 3.6.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3430\"\u003eapache/parquet-java#3430\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.xerial.snappy:snappy-java from 1.1.10.7 to 1.1.10.8 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3426\"\u003eapache/parquet-java#3426\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.6.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3440\"\u003eapache/parquet-java#3440\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.parquet:parquet-pig from 1.15.0 to 1.15.2 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3420\"\u003eapache/parquet-java#3420\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-logging:commons-logging from 1.3.5 to 1.3.6 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3418\"\u003eapache/parquet-java#3418\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump com.google.re2j:re2j from 1.7 to 1.8 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3433\"\u003eapache/parquet-java#3433\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3429\"\u003eapache/parquet-java#3429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3411\"\u003eGH-3411\u003c/a\u003e Expose row group index via Parquet reader by \u003ca href\u003d\"https://github.com/uros7251brick\"\u003e\u003ccode\u003e​uros7251brick\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3412\"\u003eapache/parquet-java#3412\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.mockito:mockito-core from 5.22.0 to 5.23.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3445\"\u003eapache/parquet-java#3445\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump net.openhft:zero-allocation-hashing from 0.27ea0 to 0.27ea1 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3419\"\u003eapache/parquet-java#3419\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.tukaani:xz from 1.10 to 1.12 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3417\"\u003eapache/parquet-java#3417\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump it.unimi.dsi:fastutil from 8.5.15 to 8.5.18 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3422\"\u003eapache/parquet-java#3422\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-text from 1.13.1 to 1.15.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3438\"\u003eapache/parquet-java#3438\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3449\"\u003eGH-3449\u003c/a\u003e: Fix BinaryStats int overflow by \u003ca href\u003d\"https://github.com/Jiayi-Wang-db\"\u003e\u003ccode\u003e​Jiayi-Wang-db\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3448\"\u003eapache/parquet-java#3448\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-java/blob/master/CHANGES.md\"\u003eorg.apache.parquet:parquet-avro\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eParquet\u003c/h1\u003e\n\u003cp\u003eFrom 1.14.2 onwards, the Parquet project has migrated from Jira to GitHub, and the changelogs are now \u003ca href\u003d\"https://github.com/apache/parquet-java/releases\"\u003epublished under Releases\u003c/a\u003e.\u003c/p\u003e\n\u003ch3\u003eVersion 1.14.1\u003c/h3\u003e\n\u003cp\u003eRelease Notes - Parquet - Version 1.14.1\u003c/p\u003e\n\u003ch4\u003eBug\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2468\"\u003ePARQUET-2468\u003c/a\u003e - ParquetMetadata.toPrettyJSON throws exception on file read when LOG.isDebugEnabled()\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2498\"\u003ePARQUET-2498\u003c/a\u003e - Hadoop vector IO API doesn\u0027t handle empty list of ranges\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eVersion 1.14.0\u003c/h3\u003e\n\u003cp\u003eRelease Notes - Parquet - Version 1.14.0\u003c/p\u003e\n\u003ch4\u003eBug\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2260\"\u003ePARQUET-2260\u003c/a\u003e - Bloom filter bytes size shouldn\u0027t be larger than maxBytes size in the configuration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2266\"\u003ePARQUET-2266\u003c/a\u003e - Fix support for files without ColumnIndexes\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2276\"\u003ePARQUET-2276\u003c/a\u003e - ParquetReader reads do not work with Hadoop version 2.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2300\"\u003ePARQUET-2300\u003c/a\u003e - Update jackson-core 2.13.4 to a version without CVE PRISMA-2023-0067\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2325\"\u003ePARQUET-2325\u003c/a\u003e - Fix parquet-cli\u0027s dictionary subcommand to work with FIXED_LEN_BYTE_ARRAY\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2329\"\u003ePARQUET-2329\u003c/a\u003e - Fix wrong help messages of parquet-cli subcommands\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2330\"\u003ePARQUET-2330\u003c/a\u003e - Fix convert-csv to show the correct position of the invalid record\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2332\"\u003ePARQUET-2332\u003c/a\u003e - Fix unexpectedly disabled tests to be executed\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2336\"\u003ePARQUET-2336\u003c/a\u003e - Add caching key to CodecFactory\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2342\"\u003ePARQUET-2342\u003c/a\u003e - Parquet writer produced a corrupted file due to page value count overflow\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2343\"\u003ePARQUET-2343\u003c/a\u003e - Fixes NPE when rewriting file with multiple rowgroups\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://issues.apache.org/jira/browse/PARQUET-2348\"\u003ePARQUET-2348\u003c/a\u003e - Recompression/Re-encrypt should rewrite bloomfilter\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/7c22cdba6792fa29c5bda74bf1f866a08d7572a9\"\u003e\u003ccode\u003e7c22cdb\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release apache-parquet-1.18.1-rc1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/4c04bf78c01e62ebc26e355e4995790acc89a2e3\"\u003e\u003ccode\u003e4c04bf7\u003c/code\u003e\u003c/a\u003e Prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/4ae935328b030c9aa116bb6c0fd166ef5c66cd2f\"\u003e\u003ccode\u003e4ae9353\u003c/code\u003e\u003c/a\u003e Bump jackson.version from 2.22.1 to 2.22.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3739\"\u003e#3739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/a3501b61622be52c9620c0ed93480417f27b5600\"\u003e\u003ccode\u003ea3501b6\u003c/code\u003e\u003c/a\u003e \u003ccode\u003eBytesInput.copy(BytesInput)\u003c/code\u003e should return a copy (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3729\"\u003e#3729\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/3fd0ae7684e5768723158fad296db1894a633e55\"\u003e\u003ccode\u003e3fd0ae7\u003c/code\u003e\u003c/a\u003e Add parameter to enable reading KMS URL from key material (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3745\"\u003e#3745\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/afe34d8b04d82b6dace63901074d4d5f8e6b54e3\"\u003e\u003ccode\u003eafe34d8\u003c/code\u003e\u003c/a\u003e Bump com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3740\"\u003e#3740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/1916eff07f1315003a59d55e24b97919e741f329\"\u003e\u003ccode\u003e1916eff\u003c/code\u003e\u003c/a\u003e Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3744\"\u003e#3744\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/b1b7ffcad5e72d8dd80905290a83d021e56332c5\"\u003e\u003ccode\u003eb1b7ffc\u003c/code\u003e\u003c/a\u003e Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3725\"\u003e#3725\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/686bb10c93b9b4c3b9e106715f32f29ad2d47504\"\u003e\u003ccode\u003e686bb10\u003c/code\u003e\u003c/a\u003e Bump it.unimi.dsi:fastutil from 8.5.18 to 8.5.19 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3684\"\u003e#3684\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/663e9074c424262873cc8d35ead16da2c581522c\"\u003e\u003ccode\u003e663e907\u003c/code\u003e\u003c/a\u003e Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/issues/3704\"\u003e#3704\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.1...apache-parquet-1.18.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nYou can trigger a rebase of this PR by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has been open for over 30 days.\n\nCloses #2711 from dependabot[bot]/dependabot/maven/java/parquet.version-1.18.1.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "1ca6decb782bf8e85b0b46fb11548803050da2f6",
      "tree": "0decc8d2f2824ffba83c86c526e95336340835d3",
      "parents": [
        "2069271e06c92197c66def9d4a0214753ac9a3b8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Oct 26 15:07:06 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Oct 26 15:07:06 2026 +0800"
      },
      "message": "ORC-2229: Upgrade `jackson` to 2.22.2\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.2 to 2.22.2.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/062d76d67a3619238e00d4d62f9bdb51cfe6cd52\"\u003e\u003ccode\u003e062d76d\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.22.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/dcf18f79fa8a9b935d880b3906291d8ed8cb1d0d\"\u003e\u003ccode\u003edcf18f7\u003c/code\u003e\u003c/a\u003e Prep for 2.22.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/9688c7b1dfc9072fdec7c9770653072d0a728fd1\"\u003e\u003ccode\u003e9688c7b\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.21\u0027 into 2.22\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/7796a7ddb240ce41c1b6c6a3a435b29948a6a727\"\u003e\u003ccode\u003e7796a7d\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.20\u0027 into 2.21\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/d3cd7fc1794f6d1a9f0a4dee41d8d46a310741d7\"\u003e\u003ccode\u003ed3cd7fc\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.19\u0027 into 2.20\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/7a28068902087b3c407d2dcabd875d7593127d97\"\u003e\u003ccode\u003e7a28068\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.18\u0027 into 2.19\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/51eb4657b141f598bb285763ac42492bd23a1da3\"\u003e\u003ccode\u003e51eb465\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/34ff5e8c68b0712086794b8287d0ad643a0a1993\"\u003e\u003ccode\u003e34ff5e8\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/0b44a458b999c5ac5568e2a4b1190a7d1080038e\"\u003e\u003ccode\u003e0b44a45\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.18.10\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/691ec93ce7c1fcc582a2a44348e82e91ca424098\"\u003e\u003ccode\u003e691ec93\u003c/code\u003e\u003c/a\u003e Prep for 2.18.10 release\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.2...jackson-bom-2.22.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson:jackson-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d2.21.2\u0026new-version\u003d2.22.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2710 from dependabot[bot]/dependabot/maven/java/com.fasterxml.jackson-jackson-bom-2.22.2.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "2069271e06c92197c66def9d4a0214753ac9a3b8",
      "tree": "afc44632a2947fda9ebafc6ad0bd36f6ad6e3614",
      "parents": [
        "4dbfe28864d73a20c331ec59cc93249aed37dfef"
      ],
      "author": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Thu Oct 08 22:47:16 2026 +0800"
      },
      "committer": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Thu Oct 08 22:47:16 2026 +0800"
      },
      "message": "ORC-2222: [C++] Support Java fixed-offset timezone IDs\n\n### What changes were proposed in this pull request?\n\n  Add support for Java fixed-offset timezone IDs (GMT±HH:MM and GMT±HH:MM:SS) in the C++ timezone resolver, using cached fixed-offset timezones without requiring TZDB files.\n\n  ### Why are the changes needed?\n\n  The Java writer can record IDs such as GMT-00:00 or GMT+05:30 in the stripe’s writerTimezone. The C++ reader treats these IDs as timezone database filenames and fails when reading\n  timestamp columns because the corresponding files do not exist.\n\n  This change allows the C++ reader to resolve these offsets and read the timestamps correctly.\n\n  Fixes ORC-2222 and #2715.\n\n  ### How was this patch tested?\n\n  Added tests covering:\n\n  • Positive and negative offsets, signed zero, minute and second precision, and invalid formats.\n  • Epoch calculation, time conversion, caching, and operation without TZDB files.\n  • Reading Java-written ORC files with four fixed-offset timezones, including pre-1970 timestamps and nanosecond precision.\n\n  Rebuilt C++ and ran make -C build test-out: all 763 core tests and 87 tool tests passed. Also verified that the original file attached to #2715 reads successfully.\n\n  ### Was this patch authored or co-authored using generative AI tooling?\n\n  Generated-by: OpenAI Codex (GPT-6)\n\nCloses #2716 from ffacs/fix-java-fixed-offset-timezone.\n\nAuthored-by: ffacs \u003cffacs520@gmail.com\u003e\nSigned-off-by: ffacs \u003cffacs520@gmail.com\u003e\n"
    },
    {
      "commit": "4dbfe28864d73a20c331ec59cc93249aed37dfef",
      "tree": "baae7c58a4d610e161feb3c1bf5ae33f45edd22a",
      "parents": [
        "2bf1b65ffbc5353c88b73489c8a046eba0172869"
      ],
      "author": {
        "name": "changbao zhan",
        "email": "zhan.changbao@sanechips.com.cn",
        "time": "Mon Sep 21 16:54:29 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Mon Sep 21 16:54:29 2026 +0800"
      },
      "message": "ORC-2216: [C++] Add RVV bit-unpacking for RLEv2\n\n# Add  RVV acceleration for RLEv2 bit unpacking\n\nThe scalar RLEv2 decoder is a  bottleneck when we\u0027re reading wide integer columns. Since RVV hardware is becoming much more common, this patch adds a vectorized path to unpack bits in parallel.\n\n## Changes\n- Add `c++/src/BpackingRvv.{hh,cc}`: Covers bit widths 3..32, 40, 48 and 56 using gather-based and strided-load vector paths; falls back to the scalar implementation for widths 1, 2, 64 and for bit-level misalignment / buffer boundaries.\n- `c++/src/Dispatch.hh`: add `DispatchLevel::RVV` and the corresponding `isSupported` check.\n- `c++/src/RleDecoderV2.cc`: register the RVV implementation in the dispatch table when `ORC_HAVE_RUNTIME_RVV` is defined.\n- `c++/src/CMakeLists.txt` and `c++/test/CMakeLists.txt`: compile the new source under RVV builds and reuse `TestRleVectorDecoder.cc` for vector decoder test coverage.\n\n## Test\n\n1. Build with `-DBUILD_ENABLE_RVV\u003dON` on a RISC-V machine(SG2044) with Gcc support RVV(I used gcc 14.2.1).\n2. use ORC_USER_SIMD_LEVEL\u003dRVV ./orc-test and ORC_USER_SIMD_LEVEL\u003dNONE ./orc-test，all unittest pass.\n3. I write a small standalone benchmark(bench_rvv.cc) to compare scalar and RVV decoding speeds. Switch paths via `ORC_USER_SIMD_LEVEL\u003dNONE|RVV`. but i dont left `bench_rvv.cc` at the repo.\n\n ## performance\n| bits | NONE_Mvals/s | RVV_Mvals/s | speedup |\n|------|-------------|-------------|---------|\n| 1    | 80.8        | 78.5        | 0.97    |\n| 2    | 106.2       | 102.4       | 0.96    |\n| 3    | 114.1       | 160.8       | 1.41    |\n| 4    | 217.9       | 235.4       | 1.08    |\n| 5    | 96.2        | 240.1       | 2.50    |\n| 6    | 79.9        | 245.3       | 3.07    |\n| 7    | 75.4        | 246.7       | 3.27    |\n| 8    | 237.3       | 276.0       | 1.16    |\n| 9    | 70.8        | 175.0       | 2.47    |\n| 10   | 69.5        | 124.3       | 1.79    |\n| 12   | 60.7        | 110.7       | 1.82    |\n| 14   | 52.8        | 102.1       | 1.93    |\n| 16   | 184.6       | 238.1       | 1.29    |\n| 17   | 55.4        | 173.9       | 3.14    |\n| 20   | 48.2        | 173.9       | 3.61    |\n| 24   | 156.3       | 176.9       | 1.13    |\n| 26   | 41.3        | 135.0       | 3.27    |\n| 28   | 35.2        | 135.6       | 3.85    |\n| 30   | 32.3        | 135.9       | 4.21    |\n| 32   | 155.2       | 162.0       | 1.04    |\n| 40   | 139.7       | 146.6       | 1.05    |\n| 48   | 126.8       | 134.7       | 1.06    |\n| 56   | 108.3       | 100.1       | 0.92    |\n| 64   | 111.0       | 111.3       | 1.00    |\n## Screenshot\n## unittest\n\u003cimg width\u003d\"1340\" height\u003d\"495\" alt\u003d\"功能测试\" src\u003d\"https://github.com/user-attachments/assets/384ec71d-9150-4885-9657-7a5402c03096\" /\u003e\n\n## performance\n\u003cimg width\u003d\"708\" height\u003d\"1260\" alt\u003d\"性能测试\" src\u003d\"https://github.com/user-attachments/assets/d4c9956d-357d-4d14-82ac-3313120568fe\" /\u003e\n\n## bench_rvv.cc\n\u003cimg width\u003d\"1136\" height\u003d\"1861\" alt\u003d\"bench_rvv cc\" src\u003d\"https://github.com/user-attachments/assets/0affb9c6-6762-474b-9222-5a31b5b30ef6\" /\u003e\n\nCloses #2706 from zhanchangbao-sanechips/rvvopt.\n\nAuthored-by: changbao zhan \u003czhan.changbao@sanechips.com.cn\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "2bf1b65ffbc5353c88b73489c8a046eba0172869",
      "tree": "4b8228e3e430bfd51d9240d0c87afb0338d22480",
      "parents": [
        "e7a58170652df8c8965ee860b719091bd209b239"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Sep 21 16:38:32 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Sep 21 16:38:32 2026 +0800"
      },
      "message": "ORC-2221: Upgrade `lz4-java` to 1.11.2\n\nBumps [at.yawk.lz4:lz4-java](https://github.com/yawkat/lz4-java) from 1.11.1 to 1.11.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/yawkat/lz4-java/releases\"\u003eat.yawk.lz4:lz4-java\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elz4-java v1.11.2\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity release for \u003ca href\u003d\"https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g\"\u003eGHSA-6cx8-rjf8-pr8g\u003c/a\u003e and \u003ca href\u003d\"https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464\"\u003eGHSA-4v53-57pg-c464\u003c/a\u003e.\u003c/strong\u003e\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate bnd.maven.plugin.version to v7.3.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/59\"\u003eyawkat/lz4-java#59\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency me.qoomon:maven-git-versioning-extension to v9.12.1 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/62\"\u003eyawkat/lz4-java#62\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency com.carrotsearch.randomizedtesting:randomizedtesting-runner to v2.9.1 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/60\"\u003eyawkat/lz4-java#60\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency maven to v3.9.16 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/57\"\u003eyawkat/lz4-java#57\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency com.code-intelligence:jazzer-junit to v0.30.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/61\"\u003eyawkat/lz4-java#61\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin dependencies by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/56\"\u003eyawkat/lz4-java#56\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.codehaus.mojo:build-helper-maven-plugin to v3.6.1 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/64\"\u003eyawkat/lz4-java#64\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency maven-wrapper to v3.3.4 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/63\"\u003eyawkat/lz4-java#63\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-source-plugin to v3.4.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/69\"\u003eyawkat/lz4-java#69\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate actions/checkout action to v7 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/74\"\u003eyawkat/lz4-java#74\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate junit-framework monorepo by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/72\"\u003eyawkat/lz4-java#72\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-antrun-plugin to v3.2.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/65\"\u003eyawkat/lz4-java#65\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.sonatype.central:central-publishing-maven-plugin to v0.11.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/71\"\u003eyawkat/lz4-java#71\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-compiler-plugin to v3.15.0 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/66\"\u003eyawkat/lz4-java#66\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-jar-plugin to v3.5.1 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/67\"\u003eyawkat/lz4-java#67\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-surefire-plugin to v3.5.6 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/70\"\u003eyawkat/lz4-java#70\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency org.apache.maven.plugins:maven-gpg-plugin to v3 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/77\"\u003eyawkat/lz4-java#77\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate GitHub Artifact Actions (major) by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/78\"\u003eyawkat/lz4-java#78\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate junit-framework monorepo to v6 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/79\"\u003eyawkat/lz4-java#79\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate cloudflare/wrangler-action action to v4 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/76\"\u003eyawkat/lz4-java#76\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate astral-sh/setup-uv action to v9 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/75\"\u003eyawkat/lz4-java#75\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate 8BitJonny/gh-get-current-pr action to v4 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/73\"\u003eyawkat/lz4-java#73\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] made their first contribution in \u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/pull/59\"\u003eyawkat/lz4-java#59\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/yawkat/lz4-java/compare/v1.11.1...v1.11.2\"\u003ehttps://github.com/yawkat/lz4-java/compare/v1.11.1...v1.11.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/0569f2e80433ac67f89616364a8f584ec3b20c45\"\u003e\u003ccode\u003e0569f2e\u003c/code\u003e\u003c/a\u003e Update 8BitJonny/gh-get-current-pr action to v4 (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/73\"\u003e#73\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/591ce42d003c63116eea082dd6754081e7f4ac97\"\u003e\u003ccode\u003e591ce42\u003c/code\u003e\u003c/a\u003e Update astral-sh/setup-uv action to v9 (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/75\"\u003e#75\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/38e96f35ae89f3ac799fb6dcfbbfccb961bc8a16\"\u003e\u003ccode\u003e38e96f3\u003c/code\u003e\u003c/a\u003e Update cloudflare/wrangler-action action to v4 (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/76\"\u003e#76\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/7fd361089e1449a067ba5694717f7fc8439f280e\"\u003e\u003ccode\u003e7fd3610\u003c/code\u003e\u003c/a\u003e Update junit-framework monorepo to v6 (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/79\"\u003e#79\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/1a9d94470f7701223999eea42c1486b0fe4e4a3c\"\u003e\u003ccode\u003e1a9d944\u003c/code\u003e\u003c/a\u003e Update GitHub Artifact Actions (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/78\"\u003e#78\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/0a8a91df5f386caff742489590b5099202cb2c2c\"\u003e\u003ccode\u003e0a8a91d\u003c/code\u003e\u003c/a\u003e Update dependency org.apache.maven.plugins:maven-gpg-plugin to v3 (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/77\"\u003e#77\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/a2381f3301c75fafcdf28a696aa64615da1907ea\"\u003e\u003ccode\u003ea2381f3\u003c/code\u003e\u003c/a\u003e Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.5.6 (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/70\"\u003e#70\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/8bb81007ab983089fce01f472d370da7ca7313ee\"\u003e\u003ccode\u003e8bb8100\u003c/code\u003e\u003c/a\u003e Update dependency org.apache.maven.plugins:maven-jar-plugin to v3.5.1 (\u003ca href\u003d\"https://redirect.github.com/yawkat/lz4-java/issues/67\"\u003e#67\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/8e4f5cc017e40e2e38388d0084ba7b7794c43b46\"\u003e\u003ccode\u003e8e4f5cc\u003c/code\u003e\u003c/a\u003e Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.15.0 (...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/yawkat/lz4-java/commit/86752f66f3fb29d007f093b87c8fe248b1f2fd11\"\u003e\u003ccode\u003e86752f6\u003c/code\u003e\u003c/a\u003e Update dependency org.sonatype.central:central-publishing-maven-plugin to v0....\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/yawkat/lz4-java/compare/v1.11.1...v1.11.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dat.yawk.lz4:lz4-java\u0026package-manager\u003dmaven\u0026previous-version\u003d1.11.1\u0026new-version\u003d1.11.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nYou can trigger a rebase of this PR by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has been open for over 30 days.\n\nCloses #2705 from dependabot[bot]/dependabot/maven/java/at.yawk.lz4-lz4-java-1.11.2.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "e7a58170652df8c8965ee860b719091bd209b239",
      "tree": "96d006a7379efb50d332e279bea2146fa9ac0a5f",
      "parents": [
        "30def85fc2d36d527ca11d741924d4fdaf212fa8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Sep 21 16:35:44 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Sep 21 16:35:44 2026 +0800"
      },
      "message": "ORC-2220: Upgrade `zstd-jni` to 1.5.7-12\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-9 to 1.5.7-12.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/b1ab612ca2777d6937f418933b5899132517dab3\"\u003e\u003ccode\u003eb1ab612\u003c/code\u003e\u003c/a\u003e Stricter checks on dict training data\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/505ac3183164cbc3c66285625e58e93808a7fb08\"\u003e\u003ccode\u003e505ac31\u003c/code\u003e\u003c/a\u003e Fix wrong lookup of the OOM exception class\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/4a56953aee666d6fd32aa047b860d22c7b354aff\"\u003e\u003ccode\u003e4a56953\u003c/code\u003e\u003c/a\u003e Use LLVM linker for  the Android build\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/d0d2da57373bec44f2f8f7c9e4b376ccab8bd821\"\u003e\u003ccode\u003ed0d2da5\u003c/code\u003e\u003c/a\u003e v1.5.7-11\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/59638399a15d771ccbe119598474a047562d9daf\"\u003e\u003ccode\u003e5963839\u003c/code\u003e\u003c/a\u003e Disable RELRO on AARs - it breaks 16KiB alignment\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/2c263b563ae9033b9ff5f3858e3ac915ad1dd815\"\u003e\u003ccode\u003e2c263b5\u003c/code\u003e\u003c/a\u003e Second attempt to enable RELRO\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/7f1ffbed8778d505026fa4fe83cd9710ff10f9aa\"\u003e\u003ccode\u003e7f1ffbe\u003c/code\u003e\u003c/a\u003e v1.5.7-10\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/063bade840ed192a42fc184d5c808bf438e53c19\"\u003e\u003ccode\u003e063bade\u003c/code\u003e\u003c/a\u003e Android: compile with RELRO\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/luben/zstd-jni/compare/v1.5.7-9...v1.5.7-12\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.luben:zstd-jni\u0026package-manager\u003dmaven\u0026previous-version\u003d1.5.7-9\u0026new-version\u003d1.5.7-12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nYou can trigger a rebase of this PR by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has been open for over 30 days.\n\nCloses #2704 from dependabot[bot]/dependabot/maven/java/com.github.luben-zstd-jni-1.5.7-12.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "30def85fc2d36d527ca11d741924d4fdaf212fa8",
      "tree": "db51632f5fe9616231ee5d9f9860731571612772",
      "parents": [
        "4ac46601740cac139137345d631e3bb47074d7c6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Sep 21 16:32:41 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Sep 21 16:32:41 2026 +0800"
      },
      "message": "ORC-2219: Upgrade `maven-jar-plugin` to 3.5.1\n\nBumps [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin) from 3.5.0 to 3.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/releases\"\u003eorg.apache.maven.plugins:maven-jar-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.5.1\u003c/h2\u003e\n\u003ch2\u003e📝 Documentation updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/550\"\u003e#550\u003c/a\u003e) \u003ca href\u003d\"https://github.com/potiuk\"\u003e\u003ccode\u003e​potiuk\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/550\"\u003e#550\u003c/a\u003e) \u003ca href\u003d\"https://github.com/potiuk\"\u003e\u003ccode\u003e​potiuk\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse plugin version properties (3.x) (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/535\"\u003e#535\u003c/a\u003e) \u003ca href\u003d\"https://github.com/Bukama\"\u003e\u003ccode\u003e​Bukama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-plugins from 48 to 49 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/547\"\u003e#547\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/538\"\u003e#538\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.15 to 3.9.16 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/536\"\u003e#536\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-plugins from 47 to 48 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/534\"\u003e#534\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-io:commons-io from 2.21.0 to 2.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/529\"\u003e#529\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/528\"\u003e#528\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.12 to 3.9.14 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/526\"\u003e#526\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/523\"\u003e#523\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-plugins from 46 to 47 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/519\"\u003e#519\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-archiver from 4.10.4 to 4.11.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/516\"\u003e#516\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.4.0 to 3.5.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/517\"\u003e#517\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-plugins from 45 to 46 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/514\"\u003e#514\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven:maven-archiver from 3.6.5 to 3.6.6 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/511\"\u003e#511\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.11 to 3.9.12 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/pull/509\"\u003e#509\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/b0cd63d0ad544aa552f06e4492faf984bf2c85c1\"\u003e\u003ccode\u003eb0cd63d\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release maven-jar-plugin-3.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/5318a4feaf529d6fa22c4622fff2d54fefe7f7dd\"\u003e\u003ccode\u003e5318a4f\u003c/code\u003e\u003c/a\u003e Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/8e0b9bb307fc29b8d267f18eca9d47be0a7f16e0\"\u003e\u003ccode\u003e8e0b9bb\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.plugins:maven-plugins from 48 to 49 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/issues/547\"\u003e#547\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/d5a438b6add9a9115f5a2c9b27db67e0d962bb74\"\u003e\u003ccode\u003ed5a438b\u003c/code\u003e\u003c/a\u003e Fix javadoc\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/774fac9215d92bfac67ece082872b00475580b21\"\u003e\u003ccode\u003e774fac9\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/b71f40368edc878b3dcaa9840d950bd7d297d4c4\"\u003e\u003ccode\u003eb71f403\u003c/code\u003e\u003c/a\u003e Bump mavenVersion from 3.9.15 to 3.9.16 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/issues/536\"\u003e#536\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/9f2a001a00fcbb0408219a11f62b48c4dfde78d3\"\u003e\u003ccode\u003e9f2a001\u003c/code\u003e\u003c/a\u003e Use plugin version properties (3.x) (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/issues/535\"\u003e#535\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/68a978f952ba510f7378fd287c5172dc560079e3\"\u003e\u003ccode\u003e68a978f\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.plugins:maven-plugins from 47 to 48 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/issues/534\"\u003e#534\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/e1058217f657691a3e50b0c7e0620fd13c8e83c3\"\u003e\u003ccode\u003ee105821\u003c/code\u003e\u003c/a\u003e Bump commons-io:commons-io from 2.21.0 to 2.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/issues/529\"\u003e#529\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/commit/953dc1abbb527b8128657f2aeadfdca0557d974d\"\u003e\u003ccode\u003e953dc1a\u003c/code\u003e\u003c/a\u003e Bump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-jar-plugin/issues/528\"\u003e#528\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/maven-jar-plugin/compare/maven-jar-plugin-3.5.0...maven-jar-plugin-3.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.apache.maven.plugins:maven-jar-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.5.0\u0026new-version\u003d3.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nYou can trigger a rebase of this PR by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has been open for over 30 days.\n\nCloses #2703 from dependabot[bot]/dependabot/maven/java/org.apache.maven.plugins-maven-jar-plugin-3.5.1.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "4ac46601740cac139137345d631e3bb47074d7c6",
      "tree": "27d3b9d6101bac88fea21b9cb961d5e69ed8af5d",
      "parents": [
        "20de9dd2195be1298b694b81cf538965fb3130d5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Sep 21 16:29:53 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Sep 21 16:29:53 2026 +0800"
      },
      "message": "ORC-2218: Upgrade `bcpkix-jdk18on` to 1.85\n\nBumps [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) from 1.84 to 1.85.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html\"\u003eorg.bouncycastle:bcpkix-jdk18on\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e2.2.1 VersionRelease: 1.85, 1.85.1Date:      2026, July 12th\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/bcgit/bc-java/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.bouncycastle:bcpkix-jdk18on\u0026package-manager\u003dmaven\u0026previous-version\u003d1.84\u0026new-version\u003d1.85)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nYou can trigger a rebase of this PR by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\n\u003e **Note**\n\u003e Automatic rebases have been disabled on this pull request as it has been open for over 30 days.\n\nCloses #2701 from dependabot[bot]/dependabot/maven/java/org.bouncycastle-bcpkix-jdk18on-1.85.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "20de9dd2195be1298b694b81cf538965fb3130d5",
      "tree": "ba066491f318996cfc886082810a6a70aef48fa9",
      "parents": [
        "6d0d539b879ec25edf55219c438da54ae8bf2751"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Sep 21 16:16:20 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Sep 21 16:16:20 2026 +0800"
      },
      "message": "ORC-2217: Upgrade `spotbugs-maven-plugin` to 4.10.3.0\n\nBumps [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.10.2.0 to 4.10.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/releases\"\u003ecom.github.spotbugs:spotbugs-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eSpotbugs Maven Plugin 4.10.3.0\u003c/h2\u003e\n\u003ch2\u003eSummary\u003c/h2\u003e\n\u003cp\u003eThis release delivers improvements to reliability, maintainability, and reproducibility. The SpotBugs execution path has been modernized by replacing the Ant-based launcher with \u003ccode\u003eProcessBuilder\u003c/code\u003e, temporary auxiliary classpath handling has been improved, and toolchain detection has been made more robust. Build tooling has also been cleaned up with Maven modernization efforts, improved reproducible artifact generation, and updated documentation. Additional fixes include improved artifact handling, test coverage improvements, and dependency updates.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[fix] Skip non-JAR artifacts in buildBugTypeUrlMap by \u003ca href\u003d\"https://github.com/uweguenther\"\u003e\u003ccode\u003e​uweguenther\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1445\"\u003espotbugs/spotbugs-maven-plugin#1445\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003emodify renovate config to not use bytebuddy -jdk5 postifx versions by \u003ca href\u003d\"https://github.com/JuditKnoll\"\u003e\u003ccode\u003e​JuditKnoll\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1451\"\u003espotbugs/spotbugs-maven-plugin#1451\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCopilot/analyze test coverage by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1454\"\u003espotbugs/spotbugs-maven-plugin#1454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse StandardCharsets.UTF_8 in groovy verify in IT tests by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1456\"\u003espotbugs/spotbugs-maven-plugin#1456\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[license] Use spdx license header for apache 2.0 (no change to license) by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1457\"\u003espotbugs/spotbugs-maven-plugin#1457\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCleanup the build pom by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1458\"\u003espotbugs/spotbugs-maven-plugin#1458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[pom] Modernize how download / copy of spotbugs source works by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1459\"\u003espotbugs/spotbugs-maven-plugin#1459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd reproducibility checks section to README by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1460\"\u003espotbugs/spotbugs-maven-plugin#1460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvoid \u0027def\u0027 usage by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1462\"\u003espotbugs/spotbugs-maven-plugin#1462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[pom] Replace antrun to fix groovy docs with find-and-replace plugin … by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1463\"\u003espotbugs/spotbugs-maven-plugin#1463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrect 2 integration tests by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1467\"\u003espotbugs/spotbugs-maven-plugin#1467\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake tool chain logic more robust by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1469\"\u003espotbugs/spotbugs-maven-plugin#1469\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[pom] Use jar plugin to zip groovy docs so reproducibility works by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1470\"\u003espotbugs/spotbugs-maven-plugin#1470\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake \u0027spotbugsAuxClasspath\u0027 a temp file and minor coding cleanup by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1471\"\u003espotbugs/spotbugs-maven-plugin#1471\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReplace \u0027ant\u0027 based SpotBugs execution with ProcessBuilder by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1472\"\u003espotbugs/spotbugs-maven-plugin#1472\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependency com.github.spotbugs:spotbugs to v4.10.3 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1473\"\u003espotbugs/spotbugs-maven-plugin#1473\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOther build/dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/uweguenther\"\u003e\u003ccode\u003e​uweguenther\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1445\"\u003espotbugs/spotbugs-maven-plugin#1445\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.2.0...spotbugs-maven-plugin-4.10.3.0\"\u003ehttps://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.2.0...spotbugs-maven-plugin-4.10.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/f0e6f45e7f622206d1e9ba11df8093970a415ac8\"\u003e\u003ccode\u003ef0e6f45\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release spotbugs-maven-plugin-4.10.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/86af8d57652da0e92720bcb4b654baf837fd2dd9\"\u003e\u003ccode\u003e86af8d5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1473\"\u003e#1473\u003c/a\u003e from spotbugs/renovate/spotbugs.version\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/2fc12322a23ccbd62c7a11c7b60027b0f7b137e6\"\u003e\u003ccode\u003e2fc1232\u003c/code\u003e\u003c/a\u003e Update dependency com.github.spotbugs:spotbugs to v4.10.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/89383701a5a58dbf73de232156607955a9fe4485\"\u003e\u003ccode\u003e8938370\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1472\"\u003e#1472\u003c/a\u003e from hazendaz/antwork\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/68ee04d365934a35b23a7ce9849056843e0ee563\"\u003e\u003ccode\u003e68ee04d\u003c/code\u003e\u003c/a\u003e Replace \u0027ant\u0027 usage with process builder\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/4fcdf58ec74c3a78e2ab14186aad0d0ab289f517\"\u003e\u003ccode\u003e4fcdf58\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1471\"\u003e#1471\u003c/a\u003e from hazendaz/master\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/c97f85e59cd17cc03046f2d8d307bfcb58145931\"\u003e\u003ccode\u003ec97f85e\u003c/code\u003e\u003c/a\u003e [ci] Minor cleanup after toolchain adjustments\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/f7dde3a6c4ff3f4673bf5e0d672572b0d9bea014\"\u003e\u003ccode\u003ef7dde3a\u003c/code\u003e\u003c/a\u003e [nio] Change \u0027spotbugsAuxClasspath\u0027 file to a temp file and remove larger try...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/ce2addb51656e3d279a1ebea70cea64877bd94b4\"\u003e\u003ccode\u003ece2addb\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1470\"\u003e#1470\u003c/a\u003e from hazendaz/restructure\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/bc53d3748a62a77644d788e97033f5cb711dc3d1\"\u003e\u003ccode\u003ebc53d37\u003c/code\u003e\u003c/a\u003e [ci] readme update to reproducible builesd info\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.10.2.0...spotbugs-maven-plugin-4.10.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eMost Recent Ignore Conditions Applied to This Pull Request\u003c/summary\u003e\n\n| Dependency Name | Ignore Conditions |\n| --- | --- |\n| com.github.spotbugs:spotbugs-maven-plugin | [\u003c 4.8, \u003e 4.7.3.4] |\n\u003c/details\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.spotbugs:spotbugs-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d4.10.2.0\u0026new-version\u003d4.10.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2700 from dependabot[bot]/dependabot/maven/java/com.github.spotbugs-spotbugs-maven-plugin-4.10.3.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "6d0d539b879ec25edf55219c438da54ae8bf2751",
      "tree": "e3cac4383ed6f491aa3a31b28ba63094587b6217",
      "parents": [
        "7f1dd1821bac79ccd017ca73d082bcaba1055b86"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Sep 02 17:06:10 2026 +0800"
      },
      "committer": {
        "name": "shouzhi",
        "email": "shouzhi.zh@alibaba-inc.com",
        "time": "Wed Sep 02 17:06:10 2026 +0800"
      },
      "message": "ORC-624: [C++] Avoid unaligned trailer loads in LZO decompressor\n\n### What changes were proposed in this pull request?\n\nThis PR replaces two potentially unaligned 16-bit trailer loads with an alignment-safe little-endian reader.\n\nIt also adds a long-distance match test covering the previously untested `0x10` LZO command path. This is a focused replacement for the LZO portion of #496, which was closed without merging.\n\n### Why are the changes needed?\n\nThe LZO input pointer advances byte by byte and is not guaranteed to be 2-byte aligned. Dereferencing it as `uint16_t*` or `int16_t*` is undefined behavior and is reported by UBSan.\n\n### How was this patch tested?\n\n```bash\ncmake --build build --target orc-test -j8\ncd build/c++/test\n./orc-test --gtest_filter\u003d\u0027TestDecompression.testLzoLong:TestDecompression.testLzoLongDistanceMatch:TestDecompression.testLzoOverflow:TestDecompression.testLzoTruncatedStopCommand\u0027\n```\n\nAll four tests passed. The existing long test covers the `0x20` command path, and the new test covers the `0x10` path.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: OpenAI Codex (GPT-5)\n\nCloses #2709 from wgtmac/ORC-624.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: shouzhi \u003cshouzhi.zh@alibaba-inc.com\u003e\n"
    },
    {
      "commit": "7f1dd1821bac79ccd017ca73d082bcaba1055b86",
      "tree": "b8f6384bd5041af7e80e18f54e4b62d40a1d347c",
      "parents": [
        "af4cbf36b051c176f0d13ae5a7ac436ada8aeccf"
      ],
      "author": {
        "name": "Ben Hannel",
        "email": "ben.hannel@snowflake.com",
        "time": "Thu Aug 13 17:27:41 2026 +0800"
      },
      "committer": {
        "name": "shouzhi",
        "email": "shouzhi.zh@alibaba-inc.com",
        "time": "Thu Aug 13 17:27:41 2026 +0800"
      },
      "message": "ORC-2215: [C++] Fix use-after-free bug in timezone cache\n\n`getTimezoneByFilename` overwrites existing entries, potentially causing causing callers which already took a pointer to that entry to end up with a dangling pointer. I think the best fix is to only insert for new keys, since if the key already exists, the value is correct - this is a cache for a pure function. I think the issue may have been introduced in https://github.com/apache/orc/commit/481aadf4bbcaf2ebc36e862dafa6a628b94283d2 (ORC-2011).\n\nI wrote a new unit test for the issue, `TimestampAliasCacheEviction.readerSurvivesAliasCacheEviction`. Without the fix, this test segfaults due to a dangling pointer. ASAN gives good diagnostics:\n\n```\n$ cmake /tmp/orc-tz-race \\\n      -DBUILD_JAVA\u003dOFF -DBUILD_TOOLS\u003dOFF -DBUILD_CPP_TESTS\u003dON \\\n      -DCMAKE_BUILD_TYPE\u003dRelWithDebInfo \\\n      -DCMAKE_CXX_FLAGS\u003d\"-fsanitize\u003daddress\" \\\n      -DCMAKE_EXE_LINKER_FLAGS\u003d\"-fsanitize\u003daddress\"\n$ make -j$(nproc) orc-test\n$ ASAN_OPTIONS\u003ddetect_leaks\u003d0 /tmp/orc-tz-race-build-asan/c++/test/orc-test --gtest_filter\u003d\u0027TimestampAliasCacheEviction*\u0027\n...\n[ RUN      ] TimestampAliasCacheEviction.readerSurvivesAliasCacheEviction\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\u003d\u003d917813\u003d\u003dERROR: AddressSanitizer: heap-use-after-free on address 0xffff94413b30 at pc 0x000000e65bf4 bp 0xfffff4e1ce60 sp 0xfffff4e1ce50\nREAD of size 8 at 0xffff94413b30 thread T0\n    #0 0xe65bf0 in orc::TimestampColumnReader::next(orc::ColumnVectorBatch\u0026, unsigned long, char*) /tmp/orc-tz-race/c++/src/ColumnReader.cc:336\n    #1 0xe65208 in void orc::StructColumnReader::nextInternal\u003cfalse\u003e(orc::ColumnVectorBatch\u0026, unsigned long, char*) /tmp/orc-tz-race/c++/src/ColumnReader.cc:868\n    #2 0xe65208 in orc::StructColumnReader::next(orc::ColumnVectorBatch\u0026, unsigned long, char*) /tmp/orc-tz-race/c++/src/ColumnReader.cc:849\n    #3 0xc9a700 in orc::RowReaderImpl::next(orc::ColumnVectorBatch\u0026) /tmp/orc-tz-race/c++/src/Reader.cc:1417\n    #4 0xc9a700 in orc::RowReaderImpl::next(orc::ColumnVectorBatch\u0026) /tmp/orc-tz-race/c++/src/Reader.cc:1392\n    #5 0xd28f0c in orc::TimestampAliasCacheEviction_readerSurvivesAliasCacheEviction_Test::TestBody() /tmp/orc-tz-race/c++/test/TestWriter.cc:2708\n    #6 0x14bdb20 in void testing::internal::HandleSehExceptionsInMethodIfSupported\u003ctesting::Test, void\u003e(testing::Test*, void (testing::Test::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2664\n    #7 0x14bdb20 in void testing::internal::HandleExceptionsInMethodIfSupported\u003ctesting::Test, void\u003e(testing::Test*, void (testing::Test::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2700\n    #8 0x14864b0 in testing::Test::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2739\n    #9 0x1486ff0 in testing::Test::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2730\n    #10 0x1486ff0 in testing::TestInfo::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2885\n    #11 0x1489cc0 in testing::TestSuite::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:3063\n    #12 0x14a2cc0 in testing::internal::UnitTestImpl::RunAllTests() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:6054\n    #13 0x1487464 in bool testing::internal::HandleSehExceptionsInMethodIfSupported\u003ctesting::internal::UnitTestImpl, bool\u003e(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2664\n    #14 0x1487464 in bool testing::internal::HandleExceptionsInMethodIfSupported\u003ctesting::internal::UnitTestImpl, bool\u003e(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2700\n    #15 0x1487464 in testing::UnitTest::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:5594\n    #16 0x44ee74 in RUN_ALL_TESTS() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/include/gtest/gtest.h:2334\n    #17 0x44ee74 in main /tmp/orc-tz-race/c++/test/TestDriver.cc:30\n    #18 0xffff9882453c in __libc_start_call_main (/lib64/libc.so.6+0x2753c)\n    #19 0xffff98824614 in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27614)\n    #20 0x49562c in _start (/tmp/orc-tz-race-build-asan/c++/test/orc-test+0x49562c)\n\n0xffff94413b30 is located 16 bytes inside of 72-byte region [0xffff94413b20,0xffff94413b68)\nfreed by thread T0 here:\n    #0 0xffff98d50ecc in operator delete(void*, unsigned long) (/lib64/libasan.so.6+0xafecc)\n    #1 0xf95444 in __gnu_cxx::new_allocator\u003cstd::_Sp_counted_ptr_inplace\u003corc::LazyTimezone, std::allocator\u003corc::LazyTimezone\u003e, (__gnu_cxx::_Lock_policy)2\u003e \u003e::deallocate(std::_Sp_counted_ptr_inplace\u003corc::LazyTimezone, std::allocator\u003corc::LazyTimezone\u003e, (__gnu_cxx::_Lock_policy)2\u003e*, unsigned long) /usr/include/c++/11/ext/new_allocator.h:145\n    #2 0xf95444 in std::allocator_traits\u003cstd::allocator\u003cstd::_Sp_counted_ptr_inplace\u003corc::LazyTimezone, std::allocator\u003corc::LazyTimezone\u003e, (__gnu_cxx::_Lock_policy)2\u003e \u003e \u003e::deallocate(std::allocator\u003cstd::_Sp_counted_ptr_inplace\u003corc::LazyTimezone, std::allocator\u003corc::LazyTimezone\u003e, (__gnu_cxx::_Lock_policy)2\u003e \u003e\u0026, std::_Sp_counted_ptr_inplace\u003corc::LazyTimezone, std::allocator\u003corc::LazyTimezone\u003e, (__gnu_cxx::_Lock_policy)2\u003e*, unsigned long) /usr/include/c++/11/bits/alloc_traits.h:496\n    #3 0xf95444 in std::__allocated_ptr\u003cstd::allocator\u003cstd::_Sp_counted_ptr_inplace\u003corc::LazyTimezone, std::allocator\u003corc::LazyTimezone\u003e, (__gnu_cxx::_Lock_policy)2\u003e \u003e \u003e::~__allocated_ptr() /usr/include/c++/11/bits/allocated_ptr.h:74\n    #4 0xf95444 in std::_Sp_counted_ptr_inplace\u003corc::LazyTimezone, std::allocator\u003corc::LazyTimezone\u003e, (__gnu_cxx::_Lock_policy)2\u003e::_M_destroy() /usr/include/c++/11/bits/shared_ptr_base.h:538\n    #5 0xf9325c in std::_Sp_counted_base\u003c(__gnu_cxx::_Lock_policy)2\u003e::_M_release() /usr/include/c++/11/bits/shared_ptr_base.h:184\n    #6 0xf9325c in std::_Sp_counted_base\u003c(__gnu_cxx::_Lock_policy)2\u003e::_M_release() /usr/include/c++/11/bits/shared_ptr_base.h:161\n    #7 0xf9325c in std::__shared_count\u003c(__gnu_cxx::_Lock_policy)2\u003e::~__shared_count() /usr/include/c++/11/bits/shared_ptr_base.h:705\n    #8 0xf9325c in std::__shared_ptr\u003corc::Timezone, (__gnu_cxx::_Lock_policy)2\u003e::~__shared_ptr() /usr/include/c++/11/bits/shared_ptr_base.h:1154\n    #9 0xf9325c in std::enable_if\u003cstd::__sp_compatible_with\u003corc::LazyTimezone*, orc::Timezone*\u003e::value, std::__shared_ptr\u003corc::Timezone, (__gnu_cxx::_Lock_policy)2\u003e\u0026\u003e::type std::__shared_ptr\u003corc::Timezone, (__gnu_cxx::_Lock_policy)2\u003e::operator\u003d\u003corc::LazyTimezone\u003e(std::__shared_ptr\u003corc::LazyTimezone, (__gnu_cxx::_Lock_policy)2\u003e\u0026\u0026) /usr/include/c++/11/bits/shared_ptr_base.h:1258\n    #10 0xf9325c in std::enable_if\u003cstd::is_assignable\u003cstd::__shared_ptr\u003corc::Timezone, (__gnu_cxx::_Lock_policy)2\u003e\u0026, std::shared_ptr\u003corc::LazyTimezone\u003e \u003e::value, std::shared_ptr\u003corc::Timezone\u003e\u0026\u003e::type std::shared_ptr\u003corc::Timezone\u003e::operator\u003d\u003corc::LazyTimezone\u003e(std::shared_ptr\u003corc::LazyTimezone\u003e\u0026\u0026) /usr/include/c++/11/bits/shared_ptr.h:393\n    #11 0xf9325c in orc::getTimezoneByFilename(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026) /tmp/orc-tz-race/c++/src/Timezone.cc:776\n    #12 0xf94144 in orc::getTimezoneByName(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026) /tmp/orc-tz-race/c++/src/Timezone.cc:809\n    #13 0xd28e5c in orc::TimestampAliasCacheEviction_readerSurvivesAliasCacheEviction_Test::TestBody() /tmp/orc-tz-race/c++/test/TestWriter.cc:2705\n    #14 0x14bdb20 in void testing::internal::HandleSehExceptionsInMethodIfSupported\u003ctesting::Test, void\u003e(testing::Test*, void (testing::Test::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2664\n    #15 0x14bdb20 in void testing::internal::HandleExceptionsInMethodIfSupported\u003ctesting::Test, void\u003e(testing::Test*, void (testing::Test::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2700\n    #16 0x14864b0 in testing::Test::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2739\n    #17 0x1486ff0 in testing::Test::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2730\n    #18 0x1486ff0 in testing::TestInfo::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2885\n    #19 0x1489cc0 in testing::TestSuite::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:3063\n    #20 0x14a2cc0 in testing::internal::UnitTestImpl::RunAllTests() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:6054\n    #21 0x1487464 in bool testing::internal::HandleSehExceptionsInMethodIfSupported\u003ctesting::internal::UnitTestImpl, bool\u003e(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2664\n    #22 0x1487464 in bool testing::internal::HandleExceptionsInMethodIfSupported\u003ctesting::internal::UnitTestImpl, bool\u003e(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:2700\n    #23 0x1487464 in testing::UnitTest::Run() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/src/gtest.cc:5594\n    #24 0x44ee74 in RUN_ALL_TESTS() /tmp/orc-tz-race-build-asan/_deps/gtest-src/googletest/include/gtest/gtest.h:2334\n    #25 0x44ee74 in main /tmp/orc-tz-race/c++/test/TestDriver.cc:30\n    #26 0xffff9882453c in __libc_start_call_main (/lib64/libc.so.6+0x2753c)\n    #27 0xffff98824614 in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27614)\n    #28 0x49562c in _start (/tmp/orc-tz-race-build-asan/c++/test/orc-test+0x49562c)\n```\n\nI cannot file a tracking ticket because the [ORC Jira instance](https://issues.apache.org/jira/projects/ORC/issues) does not allow public signup.\n\nGenerated-by: Claude Sonnet 4.6, but a human (me) reviewed everything throughly before putting up this pR.\n\nCloses #2702 from sfc-gh-bhannel/bhannel-timezone-cache-race.\n\nAuthored-by: Ben Hannel \u003cben.hannel@snowflake.com\u003e\nSigned-off-by: shouzhi \u003cshouzhi.zh@alibaba-inc.com\u003e\n"
    },
    {
      "commit": "af4cbf36b051c176f0d13ae5a7ac436ada8aeccf",
      "tree": "aa876951d9c61e24679a1bdf226a2120b8f2cc6f",
      "parents": [
        "3738b82366ba64cacae450e7e0e1702c66148afe"
      ],
      "author": {
        "name": "Roman Arce Brán",
        "email": "arce.roman.b@gmail.com",
        "time": "Wed Jul 29 16:51:24 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jul 29 16:51:24 2026 +0800"
      },
      "message": "ORC-2214: [C++] Harden RLE integer decoders against buffer cursor overshoot\n\n### What changes were proposed in this pull request?\n\nThis is a small defense-in-depth hardening of the C++ RLE integer decoders so that a **malformed / truncated RLE stream can no longer walk the read cursor past the end of the internal stream buffer**.\n\nTwo minimal changes:\n\n1. **`RleDecoderV2::bufLength()` (`c++/src/RLEv2.hh`)** now returns `0` when the cursor has overshot the buffer (`bufferStart_ \u003e bufferEnd_`) instead of the raw pointer difference. The difference is returned as an unsigned `uint64_t`; once `bufferStart_ \u003e bufferEnd_` it underflows to a value near 2^64, which defeats the `std::min` clamps in the `UnpackDefault` bit-unpacking fast loops (`unrolledUnpack16/32/40/56/64` in `BpackingDefault.cc`) and lets them read `valuesRemaining * width` bytes off the end of the heap buffer.\n\n2. **`RleDecoderV2::readByte()` (`c++/src/RleDecoderV2.cc`) and `RleDecoderV1::readByte()` (`c++/src/RLEv1.cc`)** now gate their buffer refill on `bufferStart_ \u003e\u003d bufferEnd_` instead of `bufferStart_ \u003d\u003d bufferEnd_`. A cursor that has already overshot fails the strict-equality test and dereferences `*bufferStart_` out of bounds; `\u003e\u003d` makes an overshot cursor refill (and cleanly hit `ParseError` at EOF) instead.\n\nBoth changes are behavior-neutral on valid data — for a well-formed stream `bufferStart_` never exceeds `bufferEnd_`, so `bufLength()` returns the same value and the refill guard fires at exactly the same point. They only bound the pathological overshoot path.\n\n### Why are the changes needed?\n\nReading a crafted/corrupt ORC file can currently drive the RLE integer decoders to read one or more bytes past the end of a heap stream buffer (AddressSanitizer: `heap-buffer-overflow READ of size 1`) via the public reader API (`orc::createReader` / `RowReader::next`). The effect is out-of-bounds **reads** / a crash of the reading process (no write / no code-execution demonstrated).\n\nThe underlying cause is that the decode cursor `bufferStart_` is allowed to advance past the `bufferEnd_` sentinel when a run length / bit width taken from the file implies consuming more bytes than the current stream buffer holds; neither `bufLength()` nor the `readByte()` refill guard bounds the cursor once it has overshot.\n\nThis was reported privately to `securityorc.apache.org`. Per the project\u0027s published security model (https://orc.apache.org/security/), a crash while reading an untrusted/malformed file is out of scope as a vulnerability, and Arnout Engelen (ASF Security) kindly invited us to submit the fix through the normal contribution channel as a hardening improvement — hence this PR.\n\n### How was this patch tested?\n\n* Full existing C++ unit suite: **752/752 passed** (`orc-test`, `RelWithDebInfo`), including the 123 RLE / integer / byte-RLE / writer round-trip tests — no regressions.\n* Reproduced the original overreads against the **real file-based reader** (`readLocalFile` + `createReader` + `RowReader::next`) built with AddressSanitizer, on `main`:\n  * **Before:** 31/31 malformed-file test cases produced `heap-buffer-overflow` in `RleDecoderV2::readByte`, `RleDecoderV1::readByte`, `UnpackDefault::unrolledUnpack32` and `unrolledUnpack64`.\n  * **After:** 0/31 crash; every input now surfaces a handled exception (`ParseError` / decompression EOF) or decodes cleanly. No ASAN report.\n\nRepresentative before/after (`unrolledUnpack32` case):\n```\nbefore: AddressSanitizer: heap-buffer-overflow READ of size 1\n        #0 orc::UnpackDefault::unrolledUnpack32  BpackingDefault.cc:149\nafter:  HANDLED-EXCEPTION: Buffer error in ZlibDecompressionStream::NextDecompress\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Anthropic Claude Opus 4.8)\n\n---\n\nContributed by **Roman Arce Brán — Cyfra Tech Solutions** (`arce.roman.bgmail.com`).\n\nNote on issue tracking: I don\u0027t have an Apache JIRA account to file the `ORC-xxxx` ticket that the PR template asks for, so this PR intentionally omits the `ORC-xxxx` prefix. Happy to add the reference (and reword the commit) once a JIRA is created/assigned — just let me know the number.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCloses #2691 from Roman-Da-Ripper/harden-rle-decoder-bounds.\n\nAuthored-by: Roman Arce Brán \u003carce.roman.b@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "3738b82366ba64cacae450e7e0e1702c66148afe",
      "tree": "25723cbef3398e601e16d8ce607e06d33cc79200",
      "parents": [
        "da33ff031472561788d7bc70a6395927ef07cd01"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jul 22 10:12:14 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jul 22 10:12:14 2026 +0800"
      },
      "message": "ORC-2213: [C++] Add option to read timestamps with writer timezone\n\n### What changes were proposed in this pull request?\n\nAdd a RowReaderOptions flag that lets timestamp readers use the writer timezone recorded in each stripe footer instead of the configured reader timezone. This preserves the stored timestamp value for callers that need to avoid ORC timestamp timezone conversion.\n\n### Why are the changes needed?\n\nIn old days, ORC only supports orc::TIMESTAMP type. The semantics of orc::TIMESTAMP is equivalent to TIMESTAMP_NTZ but with a complex writer and reader timezone adjustment.  So it is difficult to support both TIMESTAMP_NTZ and TIMESTAMP_LTZ types using a single orc::TIMESTAMP. In later versions, orc::TIMESTAMP_INSTANT has been added to support TIMESTAMP_LTZ type. However, users may not know the difference under the hood and still use legacy systems to write both TIMESTAMP_LTZ and TIMESTAMP_NTZ semantics to the old orc::TIMESTAMP type. When users use orc::TIMESTAMP as TIMESTAMP_LTZ values, we should set reader timezone to the writer timezone to avoid value conversion. However, users may not know the writer timezone in advance and ORC files may have different writer timezone (considering files are produced by teams in different time zones.) We need an approach to enforce reader to use writer timezone via explicit configuration.\n\n### How was this patch tested?\n\nAdded a new test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Codex GPT-5.6 Sol\n\nCloses #2699 from wgtmac/ORC-2213.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "da33ff031472561788d7bc70a6395927ef07cd01",
      "tree": "01abc19b54a236a990b960093cbf97c9cd4cbb8d",
      "parents": [
        "a6f12fd5590963ee3d9f78b4e2785e595999a1d0"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 21 08:58:56 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 21 08:58:56 2026 -0700"
      },
      "message": "ORC-2210: Upgrade Spark to 4.2.0 and align Jackson, Avro, and Netty dependencies\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade Spark to 4.2.0 in `java/bench` module and align the Spark-related transitive dependencies.\n\n- `spark.version`: 4.2.0-preview2 -\u003e 4.2.0\n- `spark.jackson.version`: 2.21.4 -\u003e 2.21.2 (**Note that this is a downgrade to match**)\n- `avro.version`: 1.12.0 -\u003e 1.12.1\n- `netty-all`: 4.2.10.Final -\u003e 4.2.13.Final\n\n### Why are the changes needed?\n\nApache Spark 4.2.0 is the official GA release which supersedes 4.2.0-preview2.\n- https://repo1.maven.org/maven2/org/apache/spark/spark-sql_2.13/4.2.0/\n\nThe Jackson, Avro, and Netty versions are aligned with Spark 4.2.0\u0027s dependencies.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2693\n\nCloses #2696 from dongjoon-hyun/ORC-2210.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "a6f12fd5590963ee3d9f78b4e2785e595999a1d0",
      "tree": "a5a2b450097eb1166266ae78840e590dd5aed3fd",
      "parents": [
        "bed0c371acaf312380d9d62bda49a9ff65bb7a94"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 13:03:44 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 13:03:44 2026 -0700"
      },
      "message": "ORC-2212: Fix AvroReader to handle java.time.Instant timestamps\n\n### What changes were proposed in this pull request?\n\nThis PR aims to fix `AvroReader.TimestampConverter` to handle `java.time.Instant` values produced by Avro 1.12.1.\n\n- The converter now accepts both `java.time.Instant` (Avro 1.12.1+) and `Long` (older behavior), extracting epoch milliseconds via `Instant.toEpochMilli()` while preserving the existing `nanos \u003d 0` behavior.\n\n### Why are the changes needed?\n\nStarting from Avro 1.12.1, decoding the `timestamp-millis` logical type returns a `java.time.Instant` instead of a raw `Long`. The existing converter cast the value directly to `Long`, causing a `ClassCastException` and breaking `java-bench-scan-test`:\n\n```\njava.lang.ClassCastException: class java.time.Instant cannot be cast to class java.lang.Long\n    at org.apache.orc.bench.core.convert.avro.AvroReader$TimestampConverter.convert(AvroReader.java:192)\n    at org.apache.orc.bench.core.convert.parquet.ParquetReader.nextBatch(ParquetReader.java:58)\n    at org.apache.orc.bench.core.convert.ScanVariants.run(ScanVariants.java:92)\n    at org.apache.orc.bench.core.Driver.main(Driver.java:64)\n```\n\nSince `timestamp-millis` has millisecond precision, an `Instant`\u0027s sub-millisecond nanoseconds are always zero, so keeping `nanos \u003d 0` preserves the previous observable behavior.\n\n### How was this patch tested?\n\nPass the CIs, including the previously failing `java-bench-scan-test`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2698 from dongjoon-hyun/ORC-2212.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "bed0c371acaf312380d9d62bda49a9ff65bb7a94",
      "tree": "22bc3e7bad4c8f195f4a057169e307ee9a90800d",
      "parents": [
        "0b18b320bfdd5769fa1ed4618ff697c5f97a1e8b"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 11:06:31 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 11:06:31 2026 -0700"
      },
      "message": "ORC-2211: Use `javadoc.io` links in Maven Javadoc configuration\n\n### What changes were proposed in this pull request?\n\nThis PR aims to use `javadoc.io` links in the Maven Javadoc plugin configuration instead of the removed `orc.apache.org/api` links, and to remove the obsolete `\u003cofflineLinks\u003e` block.\n\n### Why are the changes needed?\n\nSince the website stopped hosting Javadoc under `orc.apache.org/api` (ORC-2207), the `Javadoc generation` CI job fails on all PRs.\n\n- https://github.com/apache/orc/actions/runs/29601757265/job/87955299789\n\n```\n[ERROR] error: Error fetching URL: https://orc.apache.org/api/orc-core/ (java.io.FileNotFoundException: https://orc.apache.org/api/orc-core/package-list)\n```\n\n### How was this patch tested?\n\nManually ran the same commands as the `Javadoc generation` CI job and verified `BUILD SUCCESS`.\n\n```\ncd java\n./mvnw install -DskipTests\n./mvnw javadoc:javadoc\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2697 from dongjoon-hyun/ORC-2211.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "0b18b320bfdd5769fa1ed4618ff697c5f97a1e8b",
      "tree": "0832bb05cfbb06cbfe9901780d391a29ad5fa89f",
      "parents": [
        "661a40e8371fb94216c3e1e95e08d419582e018e"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 09:44:43 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 09:44:43 2026 -0700"
      },
      "message": "ORC-2209: Upgrade `site` Docker image to Ubuntu 26.04\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade the base image of `site/Dockerfile` from `ubuntu:24.04` to `ubuntu:26.04`.\n\n### Why are the changes needed?\n\nUbuntu 26.04 LTS is the latest LTS release. This allows the ORC site builder image to use the newer toolchain and receive the latest security updates.\n\n### How was this patch tested?\n\nBuild the site Docker image manually.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2695 from dongjoon-hyun/ORC-2209.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "661a40e8371fb94216c3e1e95e08d419582e018e",
      "tree": "f6eec73799a6cf3bcaafc69869da38570535a2f7",
      "parents": [
        "98af9fc2b3ec1b2c4a11a6ecfacdd02ffb7627e6"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 08:42:45 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 08:42:45 2026 -0700"
      },
      "message": "ORC-2208: Update Python documentation with PyArrow 25.0.0, Pandas 3.0.3, and Dask 2026.7.1\n\n### What changes were proposed in this pull request?\n\nThis PR aims to update Python documentation with PyArrow 25.0.0, Pandas 3.0.3, and Dask 2026.7.1.\n\nIn addition, the expected outputs of the PyArrow and Pandas examples are updated because\nPandas 3.x displays missing string values as `NaN` instead of `None`.\n\n### Why are the changes needed?\n\nTo provide an up-to-date Python documentation.\n\n### How was this patch tested?\n\nManually tested with `Python 3.14.6`.\n\n```\n$ pip3 install pyarrow\u003d\u003d25.0.0\n$ pip3 install pandas\u003d\u003d3.0.3\n$ pip3 install \"dask[dataframe]\u003d\u003d2026.7.1\"\n```\n\nAll examples in `pyarrow.md`, `pandas.md`, and `dask.md` were executed and the outputs were verified.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2694 from dongjoon-hyun/ORC-2208.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "98af9fc2b3ec1b2c4a11a6ecfacdd02ffb7627e6",
      "tree": "9375cce19e586b494bc19b3e6ed76ab24784500a",
      "parents": [
        "7694e1ce559a8727ef065517dcb9a650536c5992"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:55:38 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:55:38 2026 -0700"
      },
      "message": "Add news for 2.3.1\n"
    },
    {
      "commit": "7694e1ce559a8727ef065517dcb9a650536c5992",
      "tree": "5ad478c011ca8b7b050988080da3e1465b25afdf",
      "parents": [
        "f7b93abbdc4a557ff2bcdb17764a2cb48ff6721c"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:16:27 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:16:27 2026 -0700"
      },
      "message": "Forward `/api` to `javadoc.io`\n"
    },
    {
      "commit": "f7b93abbdc4a557ff2bcdb17764a2cb48ff6721c",
      "tree": "f64efdd2c41927b97edeacf4e63d9ca3df902ab0",
      "parents": [
        "5f34b04a42180398a0fca53fcf95a5c956fb7e9c"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:10:58 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:10:58 2026 -0700"
      },
      "message": "ORC-2207: Use `javadoc.io` links in `site` docs\n\n### What changes were proposed in this pull request?\n\nThis PR replaces the relative javadoc links under `site/` with absolute `javadoc.io` URLs, e.g.\n\n- Before: `/api/orc-core/index.html?org/apache/orc/OrcFile.html`\n- After: `https://javadoc.io/doc/org.apache.orc/orc-core/latest/org/apache/orc/OrcFile.html`\n\nAll 22 links in `site/_docs/core-java.md`, `site/_docs/mapred.md`, and `site/_docs/mapreduce.md` are converted.\n\n### Why are the changes needed?\n\nThe relative `/api/` links depend on javadoc being published alongside the website. Linking to `javadoc.io` points at the published artifact javadoc directly.\n\n### How was this patch tested?\n\nManual verification; documentation-only change. `grep -rn \"/api/\" site/` returns no matches.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2692 from dongjoon-hyun/ORC-2207.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "5f34b04a42180398a0fca53fcf95a5c956fb7e9c",
      "tree": "973f61ae05dce49dbeff1cfeb00be56aa2b67a6c",
      "parents": [
        "d1f9ffde46120bad06541f7fd980d5646d1f6cf9"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Jul 12 22:08:15 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 12 22:08:15 2026 -0700"
      },
      "message": "ORC-2205: Upgrade `spotless-maven-plugin` to 3.8.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.7.0 to 3.8.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.8.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for custom string format for license header copyright year via \u003ccode\u003eyearStringFormat()\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2965\"\u003e#2965\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;expandWildcardImports\u0026gt;\u003c/code\u003e no longer triggers a full transitive dependency resolution on every build. Dependency resolution is now deferred until the step actually runs, so projects that do not use \u003ccode\u003e\u0026lt;expandWildcardImports\u0026gt;\u003c/code\u003e (or that use version ranges) are no longer penalized. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2983\"\u003e#2983\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003espotless-lib and spotless-lib-extra releases\u003c/h1\u003e\n\u003cp\u003eIf you are a Spotless user (as opposed to developer), then you are probably looking for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis document is intended for Spotless developers.\u003c/p\u003e\n\u003cp\u003eWe adhere to the \u003ca href\u003d\"https://keepachangelog.com/en/1.0.0/\"\u003ekeepachangelog\u003c/a\u003e format (starting after version \u003ccode\u003e1.27.0\u003c/code\u003e).\u003c/p\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[4.8.0] - 2026-06-29\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for custom string format for license header copyright year via \u003ccode\u003eyearStringFormat()\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2965\"\u003e#2965\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.7.0] - 2026-06-16\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflexmark\u003c/code\u003e step now supports arbitrary formatter options via a \u003ccode\u003eformatterOptions\u003c/code\u003e map. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eFenceStep.preserveWithin\u003c/code\u003e now forwards lints from nested steps while still suppressing lints inside preserved blocks. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSupport \u003ccode\u003ektfmt\u003c/code\u003e 0.63 and use its new builder API for formatting options to better avoid future breaking changes.\u003c/li\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where copyright year is surrounded by whitespace. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003egreclipse\u003c/code\u003e version to latest \u003ccode\u003e4.35\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.39\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2924\"\u003e#2924\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.2] - 2026-05-27\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eP2Provisioner\u003c/code\u003e now passes cache directory overrides directly to Solstice. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eforbidWildcardImports\u003c/code\u003e and \u003ccode\u003eforbidModuleImports\u003c/code\u003e now detect imports that have leading whitespace (indentation/tabs). (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2939\"\u003e#2939\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eversionCatalog\u003c/code\u003e step no longer splits long inline tables across multiple lines — Gradle\u0027s TOML 1.0 parser cannot read multi-line inline tables. The \u003ccode\u003emaxLineLength\u003c/code\u003e option has been removed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2948\"\u003e#2948\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eEclipseJdtFormtterStep\u003c/code\u003e now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFormatter\u003c/code\u003e no longer recomputes line-ending normalization (\u003ccode\u003eLineEnding.toUnix\u003c/code\u003e) a second time for every formatter step that changes content, removing redundant O(n) work from the core formatting loop. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2934\"\u003e#2934\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eexpandWildcardImports support pom type dependency. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2839\"\u003e#2839\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.1] - 2026-05-15\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eLicenseHeaderStep\u003c/code\u003e in \u003ccode\u003eSET_FROM_GIT\u003c/code\u003e year mode no longer invokes \u003ccode\u003egit log\u003c/code\u003e through \u003ccode\u003ebash -c\u003c/code\u003e / \u003ccode\u003ecmd /c\u003c/code\u003e, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.0] - 2026-05-14\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003escalafmt()\u003c/code\u003e now reads the version from the \u003ccode\u003eversion\u003c/code\u003e field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2922\"\u003e#2922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eversionCatalog\u003c/code\u003e step for formatting and sorting Gradle version catalog (\u003ccode\u003e.toml\u003c/code\u003e) files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2916\"\u003e#2916\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ejavaparserVersion\u003c/code\u003e option to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/03d43ba2cdc81050e07b62646c08b22e39505368\"\u003e\u003ccode\u003e03d43ba\u003c/code\u003e\u003c/a\u003e Published maven/3.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/8b80c1388017f9b390fd9681007ba58a8c5d77f7\"\u003e\u003ccode\u003e8b80c13\u003c/code\u003e\u003c/a\u003e Published gradle/8.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/8ee6cf904ae77a4baec287132c69a63d4b5f4052\"\u003e\u003ccode\u003e8ee6cf9\u003c/code\u003e\u003c/a\u003e Published lib/4.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/6c02c0bf3fa0914206b28b2e9abec5e2061273e4\"\u003e\u003ccode\u003e6c02c0b\u003c/code\u003e\u003c/a\u003e Add missing changelog entry.\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/264f4cc904ad85149a90822c0835c17a615cee8e\"\u003e\u003ccode\u003e264f4cc\u003c/code\u003e\u003c/a\u003e Add regression test for forbidWildcardImports inside toggleOffOn (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2982\"\u003e#2982\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/6abb06449354899642d716dfb3daf67a888bac9b\"\u003e\u003ccode\u003e6abb064\u003c/code\u003e\u003c/a\u003e fix \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2983\"\u003e#2983\u003c/a\u003e, expandWildcardImports triggers a full transitive reso… (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2984\"\u003e#2984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/f4536d41caebdda8201cdb126832ea96a75e5afe\"\u003e\u003ccode\u003ef4536d4\u003c/code\u003e\u003c/a\u003e Update plugin spotbugs to v6.5.8 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2987\"\u003e#2987\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/873454acbc24dd66a0d334f29b30d5dcb645cd0a\"\u003e\u003ccode\u003e873454a\u003c/code\u003e\u003c/a\u003e Update plugin spotbugs to v6.5.8\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/000b8a8f9f0398f60aeafee4d2fbd90a6a61b7f1\"\u003e\u003ccode\u003e000b8a8\u003c/code\u003e\u003c/a\u003e Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2985\"\u003e#2985\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/84ebcab6a588c0ae7ddb8d883f5f60947e488e0a\"\u003e\u003ccode\u003e84ebcab\u003c/code\u003e\u003c/a\u003e Update dependency org.junit.jupiter:junit-jupiter to v6.1.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.7.0...maven/3.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.7.0\u0026new-version\u003d3.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2688 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.8.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "d1f9ffde46120bad06541f7fd980d5646d1f6cf9",
      "tree": "b19d99355281f930bb744478ea4fd9995728fa2e",
      "parents": [
        "fb922ea1cd9eeb1e2266329fd4b98d4afd65d671"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 16:03:58 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 16:03:58 2026 -0700"
      },
      "message": "ORC-2206: Add `publish_image.yml` GitHub Action job to publish docker images\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add a new GitHub Actions workflow, `publish_image.yml`, to publish the docker test images under the `docker` directory to Docker Hub as `apache/orc-dev:\u003cos\u003e`.\n\n- The workflow is triggered manually via `workflow_dispatch` with a JSON list input of OSes to publish. By default, all seven OSes are published: `amazonlinux23`, `debian13`, `oraclelinux10`, `oraclelinux9`, `ubi10`, `ubuntu24`, `ubuntu26`.\n- Multi-architecture images (`linux/amd64`, `linux/arm64`) are built via QEMU and Docker Buildx with GitHub Actions cache.\n- The workflow checks out the `main` branch and runs only on the `apache/orc` repository.\n\n### Why are the changes needed?\n\nApache ORC community provides pre-built docker images at https://hub.docker.com/r/apache/orc-dev/tags and uses them during testing. This workflow allows us to publish the images via GitHub Actions instead of building and pushing them manually.\n\n### How was this patch tested?\n\nManual review because this is a `workflow_dispatch`-triggered workflow which runs only on the `apache/orc` repository.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2689 from dongjoon-hyun/ORC-2206.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "fb922ea1cd9eeb1e2266329fd4b98d4afd65d671",
      "tree": "a9b64c5512f8f64969cb062e12b992bf33591786",
      "parents": [
        "211ffab213512120744654073da129065c0311e8"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 14:24:34 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 14:24:34 2026 -0700"
      },
      "message": "ORC-2204: Use `amazonlinux:2023` instead of a dated snapshot tag\n\n### What changes were proposed in this pull request?\n\nThis PR aims to use the rolling `amazonlinux:2023` tag instead of a dated snapshot tag in the `amazonlinux23` docker image.\n\n### Why are the changes needed?\n\nThis is consistent with the other docker images which use rolling tags, e.g., `oraclelinux:9`, `ubuntu:24.04`, and `ubi10`.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2687 from dongjoon-hyun/ORC-2204.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "211ffab213512120744654073da129065c0311e8",
      "tree": "22c0aa53b87672a7d2880b4d07fd76ee89836af7",
      "parents": [
        "df1c54b5b93bfc98ced4a878c589ddc0bbd91147"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 13:23:51 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 13:23:51 2026 -0700"
      },
      "message": "ORC-2203: Remove unused variables in docker/run-all.sh\n\n### What changes were proposed in this pull request?\n\nThis PR aims to remove unused variable assignments (`URL`, `CLONE`, `MAKEDIR`, `VOLUME`) from `docker/run-all.sh`.\n\n### Why are the changes needed?\n\nThese variables are leftovers from before the per-OS build logic was extracted into `docker/run-one.sh`, which defines and uses its own `CLONE`/`MAKEDIR`/`VOLUME`. In `run-all.sh`, they are never referenced; the build loop invokes `./run-one.sh $1 $2 $build` with the positional arguments directly. `URL` is also removed because it was only referenced by the unused `CLONE`. The `GITHUB_USER\u003d$1` and `BRANCH\u003d$2` assignments are kept as documentation of the expected arguments.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2686 from dongjoon-hyun/ORC-2203.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "df1c54b5b93bfc98ced4a878c589ddc0bbd91147",
      "tree": "14e65daa07f702c0e3ccfbb6ff5ad2f45358d215",
      "parents": [
        "7ae93748078d7c5d481c17d53548d6bf1c00153d"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 11:15:25 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 11:15:25 2026 -0700"
      },
      "message": "ORC-2202: Use `debian:13` instead of `13.1` in `docker/debian13/Dockerfile`\n\n### What changes were proposed in this pull request?\n\nThis PR aims to use `debian:13` instead of `debian:13.1` in `docker/debian13/Dockerfile`.\n\n### Why are the changes needed?\n\nDebian 13 has moved past the `13.1` point release, so the pinned tag no longer tracks the latest point releases. Using the `debian:13` tag keeps the image up to date automatically and is consistent with the other OS Dockerfiles (`ubuntu:24.04`, `oraclelinux:9`, `oraclelinux:10`), as well as the previous Debian Dockerfiles which used floating codename tags (`debian:bullseye`, `debian:bookworm`).\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2685 from dongjoon-hyun/ORC-2202.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "7ae93748078d7c5d481c17d53548d6bf1c00153d",
      "tree": "a3b3b66e610ea05e60fb62fed3c64c6282e38ce0",
      "parents": [
        "1c441dc9a68f94071c8ecac622b9eefd99d81153"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 09 23:40:04 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 09 23:40:04 2026 -0700"
      },
      "message": "ORC-2201: Update `docker/README.md` to match the current docker test environment\n\n### What changes were proposed in this pull request?\n\nThis PR aims to update `docker/README.md` to match the current contents of the `docker/` directory.\n\n1. Update the supported OS list to match `docker/os-list.txt`: remove `Fedora 37` (removed in ORC-1915) and add `UBI 10` (added in ORC-2121).\n2. Replace the stale statement that the scripts test both JDK 17 and 21 across OSes. Each OS image now uses a single JDK version: JDK 17 (`oraclelinux9`, `amazonlinux23`), JDK 21 (`debian13`, `ubuntu24`, `oraclelinux10`), and JDK 25 (`ubuntu26`, `ubi10`).\n3. Fix the base image build example to match the actual tagging used by `reinit.sh` (`apache/orc-dev:$os`), and note that `debian13`/`ubuntu24`/`ubuntu26` accept a `--build-arg jdk\u003dN` to change the JDK version.\n\n### Why are the changes needed?\n\nThe README is out of sync with the actual docker test environment and misleads contributors who run the docker-based tests.\n\n### How was this patch tested?\n\nManually verified against `docker/os-list.txt`, `docker/reinit.sh`, and each `docker/*/Dockerfile`. Also checked with `markdownlint docker/README.md` (no warnings).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2684 from dongjoon-hyun/ORC-2201.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1c441dc9a68f94071c8ecac622b9eefd99d81153",
      "tree": "5d2c454eab9406c095a75c493ff7f1c473b8f205",
      "parents": [
        "30f8e242a4fcbebb306b1469cb2128be0915b990"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 23:26:24 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 23:26:24 2026 -0700"
      },
      "message": "ORC-2200: Validate stripe offset/index/data/footer lengths in the Java reader\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate stripe `offset`/`indexLength`/`dataLength`/`footerLength` in the Java reader before reading a stripe, like the C++ reader (`RowReaderImpl::startNextStripe`). `RecordReaderImpl` now throws `FileFormatException` if any value is negative, `footerLength` exceeds `Integer.MAX_VALUE`, or the sum overflows or exceeds the file length.\n\n### Why are the changes needed?\n\nA crafted `StripeInformation` could cause a `NegativeArraySizeException`, a huge allocation, or a read at a bogus offset. This matches the existing C++ reader validation.\n\n### How was this patch tested?\n\nPass the CIs with the newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2683 from dongjoon-hyun/ORC-2200.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "30f8e242a4fcbebb306b1469cb2128be0915b990",
      "tree": "ae7d05d7725044eff949a2309daafd9bfb77b8b0",
      "parents": [
        "f769ad79ad58da1227500164f8848f13ae663b15"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 22:36:46 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 22:36:46 2026 -0700"
      },
      "message": "Add news for 1.9.9\n"
    },
    {
      "commit": "f769ad79ad58da1227500164f8848f13ae663b15",
      "tree": "45f74be5bfb9f597e4d3745d4fed8b60d3a79825",
      "parents": [
        "5f2855dcf81a3dc2aec73b58571d5c58d0cec305"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 21:19:42 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 21:19:42 2026 -0700"
      },
      "message": "ORC-2199: Validate union tag against the number of children in `UnionTreeReader`\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate the union tag against the number of children in `UnionTreeReader`.\n\nBoth the `nextVector` and `skipRows` paths now check that each tag read from the `DATA` stream is within `[0, fields.length)` and throw `FileFormatException` with a clear message, consistent with the C++ reader\u0027s `getCheckedUnionTag`.\n\n### Why are the changes needed?\n\nThe Java `UnionTreeReader` used the raw tag byte from the `DATA` stream without validation. For a corrupt or malicious file with a tag greater than or equal to the number of union children (or a negative sign-extended byte), `skipRows` fails with `ArrayIndexOutOfBoundsException` and `nextVector` propagates the invalid tag downstream. The C++ reader already rejects this via `getCheckedUnionTag` (`ParseError`), so this closes a C++/Java parity gap.\n\n### How was this patch tested?\n\nPass the CIs with a newly added `TestTreeReaderFactory`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2682 from dongjoon-hyun/ORC-2199.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "5f2855dcf81a3dc2aec73b58571d5c58d0cec305",
      "tree": "e89a79ae8ff660fd39855780fcb30e942a0cbd81",
      "parents": [
        "f158e147b46013a3b0b12f5899a3280559a5aa47"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 19:30:36 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 19:30:36 2026 -0700"
      },
      "message": "ORC-2198: Validate stream offset+length against stripe data boundary in StripePlanner\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate each stream\u0027s `offset + length` against the stripe data boundary in the Java `StripePlanner`, throwing `FileFormatException` when a stream overflows or exceeds the stripe\u0027s index+data region.\n\n### Why are the changes needed?\n\nThis closes a C++/Java reader parity gap. The C++ reader already rejects such streams in `StripeStreamsImpl::getStream` by computing `dataEnd \u003d stripeOffset + indexLength + dataLength`, while the Java `StripePlanner.handleStream` accumulated `currentOffset +\u003d stream.getLength()` with no bound check. Since `stream.getLength()` is an untrusted protobuf `uint64`, a crafted stripe footer could drive reads outside the stripe region.\n\n### How was this patch tested?\n\nPass the CIs with the newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2681 from dongjoon-hyun/ORC-2198.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f158e147b46013a3b0b12f5899a3280559a5aa47",
      "tree": "8affd0f02be7af5b89e50881a64eac1c8e481c50",
      "parents": [
        "11f07f665eaf64e9c85c60870813096e4fb7effc"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 17:22:29 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 17:22:29 2026 -0700"
      },
      "message": "ORC-2197: Reject negative decoded dictionary entry length in Java string dictionary reader\n\n### What changes were proposed in this pull request?\n\nThis PR aims to reject a negative decoded dictionary entry length in the Java string dictionary reader by throwing a `FileFormatException` in `StringDictionaryTreeReader.readDictionaryLengthStream`.\n\n### Why are the changes needed?\n\nA corrupt file can encode a negative entry length in the LENGTH stream, making `dictionaryOffsets` non-monotonic and causing `setRef` to receive a negative length. The C++ reader already rejects this case (`DictionaryLoader.cc`), so this restores C++/Java reader parity.\n\n### How was this patch tested?\n\nPass the CIs with a newly added test case, `TestStringDictionaryTreeReader#testNegativeDictionaryEntryLength`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2680 from dongjoon-hyun/ORC-2197.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "11f07f665eaf64e9c85c60870813096e4fb7effc",
      "tree": "c8d2629d5630c5dd914df22fa113bf51038d3bcf",
      "parents": [
        "6770bce9fcfcbcfe3f541f980c7e880faa077ddd"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 16:14:06 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 16:14:06 2026 -0700"
      },
      "message": "ORC-2196: [C++] Validate type tree when creating reader from serialized file tail\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate the ORC type tree in `createReader` when the footer comes from a serialized file tail (`ReaderOptions.setSerializedFileTail`), by calling the existing `checkProtoTypes` in the same way as the file-read path.\n\n### Why are the changes needed?\n\nThe serialized-file-tail branch of `createReader` builds `contents-\u003efooter` directly from the parsed `proto::FileTail` without validation. A malformed footer with an out-of-range or back-referencing subtype flows into `convertType`, causing an out-of-bounds read or unbounded recursion (stack overflow) in release builds.\n\nThe file-read path already validates via `checkProtoTypes`, and the Java reader validates both tail paths (`OrcTail` and `ReaderImpl`). This closes the remaining C++ parity gap.\n\n### How was this patch tested?\n\nPass the CIs with a newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2679 from dongjoon-hyun/ORC-2196.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "6770bce9fcfcbcfe3f541f980c7e880faa077ddd",
      "tree": "a0b5ed75b7c488b7f5c0373e099535fb78f98caf",
      "parents": [
        "d92d9434d30d508b36abddcc8ec60824e6c4f54f"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 21:07:50 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 21:07:50 2026 -0700"
      },
      "message": "ORC-2195: Upgrade `lz4-java` to 1.11.1\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `at.yawk.lz4:lz4-java` to 1.11.1.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes from the following release.\n\n- https://github.com/yawkat/lz4-java/releases/tag/v1.11.1 (2026-07-06)\n  - [Native XXHash implementations can crash the JVM when passed invalid byte array ranges](https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r)\n\n### Does this PR introduce _any_ user-facing change?\n\nNo.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2676 from dongjoon-hyun/ORC-2195.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "d92d9434d30d508b36abddcc8ec60824e6c4f54f",
      "tree": "ce365243c2d86ec67ae2459cf7da4e3489ced02c",
      "parents": [
        "6015de56d279fce23cb6539a003afbe1752f7909"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 16:55:55 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 16:55:55 2026 -0700"
      },
      "message": "ORC-2191: Reject overflowing PostScript tail lengths in ReaderImpl\n\n### What changes were proposed in this pull request?\n\nThis PR validates the PostScript tail lengths in `ReaderImpl.extractFileTail` before they are cast\nfrom `long` to `int`, throwing `FileFormatException` when `footerLength`, `metadataLength`,\n`stripeStatisticsLength`, or their sum is negative or exceeds the file length / `Integer.MAX_VALUE`.\nIt is the Java counterpart of the C++ overflow checks in ORC-2167.\n\n### Why are the changes needed?\n\nThese fields are protobuf `uint64` read as Java `long`. A malformed value near `UINT64_MAX` or above\n2GB would truncate/overflow on the `int` cast into a bogus offset or allocation size instead of a\nclear error. Per the ORC threat model this is a fail-fast robustness fix, not a CVE.\n\n### How was this patch tested?\n\nAdded `TestReaderImpl.testMalformedTailLengthOverflow`, which crafts files with tail lengths of\n`2^31`, `2^32`, and `UINT64_MAX` and asserts `OrcFile.createReader` throws `FileFormatException`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2672 from dongjoon-hyun/ORC-2191.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "6015de56d279fce23cb6539a003afbe1752f7909",
      "tree": "9916b62c2fece04cef512038703045ae264b6ddc",
      "parents": [
        "3cfa07321927eedc48c86bf3b8aadf45721fcbb6"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 15:52:17 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 15:52:17 2026 -0700"
      },
      "message": "ORC-2190: [C++] Reject compressed chunk length exceeding block size in C++ reader\n\n### What changes were proposed in this pull request?\n\nThis PR makes the ORC C++ reader reject a compressed chunk whose length exceeds the configured\ncompression block size, matching the Java reader.\n\nhttps://github.com/apache/orc/blob/5d3cf1318b58416719e89169ae9d56f758311f7e/java/core/src/java/org/apache/orc/impl/InStream.java#L504-L507\n\n### Why are the changes needed?\n\nThe Java reader already performs this check in `InStream.CompressedStream.readHeader`, but the C++\nreader was missing it. This is a defense-in-depth hardening (not a CVE): the chunk length is already\nbounded to ~8MB by the 3-byte header, but the spec-mandated first check was absent on the C++ side.\nWell-formed files are unaffected.\n\n### How was this patch tested?\n\nPass the CIs with the newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2671 from dongjoon-hyun/ORC-2190.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "3cfa07321927eedc48c86bf3b8aadf45721fcbb6",
      "tree": "d56a083c15621b2236ca53df25336e602e857191",
      "parents": [
        "3b3f227d478f92e98906e4669466e3ef1ffef6c2"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 14:47:14 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 14:47:14 2026 -0700"
      },
      "message": "ORC-2194: Remove `Debian 12` support\n\n### What changes were proposed in this pull request?\n\nThis PR aims to remove `Debian 12` support from Apache ORC 3.0.0.\n\n### Why are the changes needed?\n\n`Debian 12` reaches its end-of-life on 2026-07-11.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2675 from dongjoon-hyun/ORC-2194.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "3b3f227d478f92e98906e4669466e3ef1ffef6c2",
      "tree": "f35e22a9c50a211e63d535654e9f24098612d52a",
      "parents": [
        "1ce1786b49c8af0ae21e2db4ef0e6526c5824f2a"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:40:04 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:40:04 2026 -0700"
      },
      "message": "ORC-2192: [C++] Reject invalid string length in StringDirectColumnReader\n\n### What changes were proposed in this pull request?\n\nThis PR adds validation to `StringDirectColumnReader::computeSize` in the C++ reader so a negative or overflowing string length throws `ParseError` before any blob is allocated. Both callers (`next` and `skip`) are covered, and since `buildReader` routes all direct-encoded string-family types to this reader, the single guard protects `BINARY`/`CHAR`/`STRING`/`VARCHAR`/`GEOMETRY`/`GEOGRAPHY`.\n\n### Why are the changes needed?\n\nThe LENGTH stream is decoded as unsigned RLE, so a malformed file can encode a varint `\u003e\u003d 2^63` that becomes a negative `int64_t`. Cast to `size_t`, this triggers a huge `blob.resize()` and an out-of-bounds pointer walk. This restores parity with the Java reader, which already guards this path in `BytesColumnVectorUtil.commonReadByteArrays`.\n\nhttps://github.com/apache/orc/blob/1ce1786b49c8af0ae21e2db4ef0e6526c5824f2a/java/core/src/java/org/apache/orc/impl/TreeReaderFactory.java#L2087-L2098\n\n### How was this patch tested?\n\nAdded `TestColumnReader.testStringDirectNegativeLength`, which feeds a crafted LENGTH stream decoding to `INT64_MIN` and asserts `ParseError` is thrown.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2673 from dongjoon-hyun/ORC-2192.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1ce1786b49c8af0ae21e2db4ef0e6526c5824f2a",
      "tree": "236f2d7f7c0f9afd6d6ddaaab056fbf4a0057671",
      "parents": [
        "5d3cf1318b58416719e89169ae9d56f758311f7e"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:36:30 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:36:30 2026 -0700"
      },
      "message": "ORC-2193: Parse encrypted FileStatistics via createCodedInputStream\n\n### What changes were proposed in this pull request?\n\nThis PR makes the encrypted `FileStatistics` parsing path in the Java reader consistent with all other protobuf parse paths by wrapping it with `InStream.createCodedInputStream(...)`.\n\n### Why are the changes needed?\n\nEvery other protobuf parse path in the reader (footer, metadata, stripe footer, row index, bloom filter, columnar stripe stats) goes through `createCodedInputStream`, which applies `setSizeLimit(1 GB)`. This was the only exception, so this aligns it for consistency. It is not a security fix: the input is an already-bounded in-memory sub-message from the footer.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2674 from dongjoon-hyun/ORC-2193.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "5d3cf1318b58416719e89169ae9d56f758311f7e",
      "tree": "6aad7155172bc8de906ee9e6741ebff564b7e91a",
      "parents": [
        "28199d72fbf54a10d485728a29e7f53dedd3d6da"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:16:12 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:16:12 2026 -0700"
      },
      "message": "ORC-2188: Reject invalid compression block size in PostScript\n\n### What changes were proposed in this pull request?\n\nThis PR aims to reject invalid PostScript `compressionBlockSize` values at file open in both C++ and Java readers. If the field is present and the value is `0` or `\u003e\u003d 2^23 (8MB)`, the readers now throw `ParseError` (C++) / `FileFormatException` (Java) with the message `Invalid compression block size: N`. A missing field keeps the existing 256KB default.\n\n- **C++**: check added in `getCompressionBlockSize` (`Reader.cc`), which covers all open paths.\n- **Java**: new `ReaderImpl.checkCompressionBlockSize` helper, called from `extractPostScript`, the `OrcTail` constructor branch, and the deprecated `extractFileTail(ByteBuffer)`.\n\n### Why are the changes needed?\n\nBoth writers already enforce `compressionBlockSize \u003c 2^23` because the compressed chunk header stores the length in 23 bits, but the readers used the value without validation. Applying the same bound at read time fails fast without affecting any legitimate file.\n\n### How was this patch tested?\n\nPass the CIs with newly added test cases.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2650\n\nCloses #2662 from dongjoon-hyun/ORC-2188.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "28199d72fbf54a10d485728a29e7f53dedd3d6da",
      "tree": "6989544d00df88da42b2fbd4ee6187c8f93c7f24",
      "parents": [
        "9b89ad3e168c3b18d9de93abc69af0563f84ea79"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:11:22 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:11:22 2026 -0700"
      },
      "message": "ORC-2189: Add `URL_HASH` to all third-party dependencies in `ThirdpartyToolchain.cmake`\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add `URL_HASH` (SHA256) to all third-party dependencies declared via `fetchcontent_declare` in `cmake_modules/ThirdpartyToolchain.cmake`.\n\n### Why are the changes needed?\n\nTo verify the integrity of the downloaded archives and fail the build explicitly on any checksum mismatch.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2663 from dongjoon-hyun/ORC-2189.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "9b89ad3e168c3b18d9de93abc69af0563f84ea79",
      "tree": "9eaadb2fc479b78c4322cba9a8995bbb50ea599c",
      "parents": [
        "7cc86ec686b4edcdb3c4d641ae362f101d4c8015"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 02:06:09 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 02:06:09 2026 -0700"
      },
      "message": "ORC-2187: Set protobuf message size limit in C++ reader\n\n### What changes were proposed in this pull request?\n\nThis PR caps the size of protobuf messages parsed from ORC file contents in the C++ reader, matching the Java reader.\n\n### Why are the changes needed?\n\nThe Java reader already caps protobuf message size at 1 GB, but the C++ reader parsed with no limit.\n\nhttps://github.com/apache/orc/blob/7cc86ec686b4edcdb3c4d641ae362f101d4c8015/java/core/src/java/org/apache/orc/impl/InStream.java#L45\n\nhttps://github.com/apache/orc/blob/7cc86ec686b4edcdb3c4d641ae362f101d4c8015/java/core/src/java/org/apache/orc/impl/InStream.java#L922\n\n`SetTotalBytesLimit` has the same mechanism with `InStream.setSizeLimit`.\n\n### How was this patch tested?\n\nPass the existing C++ tests (`orc-test`).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2661 from dongjoon-hyun/ORC-2187.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "7cc86ec686b4edcdb3c4d641ae362f101d4c8015",
      "tree": "39ea103671e5e227f73c4f12288260c900e22f51",
      "parents": [
        "2007cf5f5ab9111374d8a8fc1d4b08dc4740e9fc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Jul 04 23:10:42 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 23:10:42 2026 -0700"
      },
      "message": "ORC-2186: Upgrade `spotbugs-maven-plugin` to 4.10.2.0\n\nBumps [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.9.8.3 to 4.10.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/releases\"\u003ecom.github.spotbugs:spotbugs-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eSpotbugs Maven Plugin 4.10.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport spotbugs 4.10.2\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate ci.yaml by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1429\"\u003espotbugs/spotbugs-maven-plugin#1429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate spotbugs.version to v4.10.2 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1425\"\u003espotbugs/spotbugs-maven-plugin#1425\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.5...spotbugs-maven-plugin-4.10.2.0\"\u003ehttps://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.5...spotbugs-maven-plugin-4.10.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eSpotbugs Maven Plugin 4.9.8.5\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1426\"\u003espotbugs/spotbugs-maven-plugin#1426\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[fix] Toolchain used wrong flag name \u0027executable\u0027 instead of \u0027jvm\u0027 by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1428\"\u003espotbugs/spotbugs-maven-plugin#1428\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.4...spotbugs-maven-plugin-4.9.8.5\"\u003ehttps://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.4...spotbugs-maven-plugin-4.9.8.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eSpotbugs Maven Plugin 4.9.8.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebuild support for maven 4 with maven 4 plugins\u003c/li\u003e\n\u003cli\u003espotbugs extensions jars now moved to target/spotbugs instead of root\u003c/li\u003e\n\u003cli\u003enew spotbugs-aggregate mojo for multi module\u003c/li\u003e\n\u003cli\u003esupport maven toolchains\u003c/li\u003e\n\u003cli\u003eblock gui when environment is headless\u003c/li\u003e\n\u003cli\u003eall spotbug extensions as regular dependencies\u003c/li\u003e\n\u003cli\u003elearn to map spotbug extensions to their source project documentation\u003c/li\u003e\n\u003cli\u003ein auxiliary class path exclude java.* packages\u003c/li\u003e\n\u003cli\u003eimprove code coverage\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003enote: This release was done on older spotbugs (not the new 4.10.1) on purpose to keep these changes separate from that of spotbugs.  The spotbugs 4.10.1 support release will be available in a day or two and users can otherwise override the core module as there are no changes to be done internally.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/2d39b75b4c08fb520f936517783efd904bffc063\"\u003e\u003ccode\u003e2d39b75\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release spotbugs-maven-plugin-4.10.2.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/6c300e6fe4f69409b142a8bc8b4100ec3dc06384\"\u003e\u003ccode\u003e6c300e6\u003c/code\u003e\u003c/a\u003e [pom] Bump internal spotbugs to 4.9.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/250d68518dd97260380925c3cd30dcf53a0b38c0\"\u003e\u003ccode\u003e250d685\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1425\"\u003e#1425\u003c/a\u003e from spotbugs/renovate/spotbugs.version\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/12f6fb3c1539e294fa916644f614cd9a8edcc4d8\"\u003e\u003ccode\u003e12f6fb3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1429\"\u003e#1429\u003c/a\u003e from spotbugs/hazendaz-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/aaf0a09933fd09c495187a412f9163a10955debe\"\u003e\u003ccode\u003eaaf0a09\u003c/code\u003e\u003c/a\u003e Update ci.yaml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/8b5dff48959c4a350b6f17ab74d2f5479cc3fece\"\u003e\u003ccode\u003e8b5dff4\u003c/code\u003e\u003c/a\u003e Merge branch \u0027master\u0027 into renovate/spotbugs.version\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/c83698dea617fa5f0cd81186ab717ae33c764c73\"\u003e\u003ccode\u003ec83698d\u003c/code\u003e\u003c/a\u003e Update pom.xml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/b8788fd3c210b91040393d9cc14a96d41aba7df0\"\u003e\u003ccode\u003eb8788fd\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/f758cb536ea3b7f72e1bf71156073799e0b347eb\"\u003e\u003ccode\u003ef758cb5\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release spotbugs-maven-plugin-4.9.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/cec6af52b92791869e9320cf9a30d10468f3fab7\"\u003e\u003ccode\u003ecec6af5\u003c/code\u003e\u003c/a\u003e Update pom.xml\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.3...spotbugs-maven-plugin-4.10.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eMost Recent Ignore Conditions Applied to This Pull Request\u003c/summary\u003e\n\n| Dependency Name | Ignore Conditions |\n| --- | --- |\n| com.github.spotbugs:spotbugs-maven-plugin | [\u003c 4.8, \u003e 4.7.3.4] |\n\u003c/details\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.spotbugs:spotbugs-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d4.9.8.3\u0026new-version\u003d4.10.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2649 from dependabot[bot]/dependabot/maven/java/com.github.spotbugs-spotbugs-maven-plugin-4.10.2.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "2007cf5f5ab9111374d8a8fc1d4b08dc4740e9fc",
      "tree": "092d2967bd27045be9b6283f9abd8e043c3cc670",
      "parents": [
        "60ff3cfe591e22ca37f9b3ad8584b465f7064853"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Jul 04 23:08:38 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 23:08:38 2026 -0700"
      },
      "message": "ORC-2185: Upgrade `spotless-maven-plugin` to 3.7.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.6.0 to 3.7.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.7.0\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;toggleOffOn\u0026gt;\u003c/code\u003e no longer disables lint-only steps such as \u003ccode\u003e\u0026lt;forbidWildcardImports\u0026gt;\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where copyright year is surrounded by whitespace. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;flexmark\u0026gt;\u003c/code\u003e step now supports arbitrary formatter options via \u003ccode\u003e\u0026lt;formatterOptions\u0026gt;\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003espotless-lib and spotless-lib-extra releases\u003c/h1\u003e\n\u003cp\u003eIf you are a Spotless user (as opposed to developer), then you are probably looking for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis document is intended for Spotless developers.\u003c/p\u003e\n\u003cp\u003eWe adhere to the \u003ca href\u003d\"https://keepachangelog.com/en/1.0.0/\"\u003ekeepachangelog\u003c/a\u003e format (starting after version \u003ccode\u003e1.27.0\u003c/code\u003e).\u003c/p\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[4.7.0] - 2026-06-16\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflexmark\u003c/code\u003e step now supports arbitrary formatter options via a \u003ccode\u003eformatterOptions\u003c/code\u003e map. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eFenceStep.preserveWithin\u003c/code\u003e now forwards lints from nested steps while still suppressing lints inside preserved blocks. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSupport \u003ccode\u003ektfmt\u003c/code\u003e 0.63 and use its new builder API for formatting options to better avoid future breaking changes.\u003c/li\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where copyright year is surrounded by whitespace. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003egreclipse\u003c/code\u003e version to latest \u003ccode\u003e4.35\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.39\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2924\"\u003e#2924\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.2] - 2026-05-27\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eP2Provisioner\u003c/code\u003e now passes cache directory overrides directly to Solstice. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eforbidWildcardImports\u003c/code\u003e and \u003ccode\u003eforbidModuleImports\u003c/code\u003e now detect imports that have leading whitespace (indentation/tabs). (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2939\"\u003e#2939\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eversionCatalog\u003c/code\u003e step no longer splits long inline tables across multiple lines — Gradle\u0027s TOML 1.0 parser cannot read multi-line inline tables. The \u003ccode\u003emaxLineLength\u003c/code\u003e option has been removed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2948\"\u003e#2948\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eEclipseJdtFormtterStep\u003c/code\u003e now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFormatter\u003c/code\u003e no longer recomputes line-ending normalization (\u003ccode\u003eLineEnding.toUnix\u003c/code\u003e) a second time for every formatter step that changes content, removing redundant O(n) work from the core formatting loop. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2934\"\u003e#2934\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eexpandWildcardImports support pom type dependency. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2839\"\u003e#2839\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.1] - 2026-05-15\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eLicenseHeaderStep\u003c/code\u003e in \u003ccode\u003eSET_FROM_GIT\u003c/code\u003e year mode no longer invokes \u003ccode\u003egit log\u003c/code\u003e through \u003ccode\u003ebash -c\u003c/code\u003e / \u003ccode\u003ecmd /c\u003c/code\u003e, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.0] - 2026-05-14\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003escalafmt()\u003c/code\u003e now reads the version from the \u003ccode\u003eversion\u003c/code\u003e field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2922\"\u003e#2922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eversionCatalog\u003c/code\u003e step for formatting and sorting Gradle version catalog (\u003ccode\u003e.toml\u003c/code\u003e) files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2916\"\u003e#2916\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ejavaparserVersion\u003c/code\u003e option to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve case of JDBI named bind params that collide with SQL keywords (e.g. \u003ccode\u003e:limit\u003c/code\u003e, \u003ccode\u003e:offset\u003c/code\u003e) in the DBeaver SQL formatter. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2899\"\u003e#2899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix non-idempotent formatting when \u003ccode\u003eimportOrder()\u003c/code\u003e is combined with \u003ccode\u003egreclipse()\u003c/code\u003e: a single catch-all group no longer strips blank lines that \u003ccode\u003egreclipse()\u003c/code\u003e independently inserted between import groups. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2914\"\u003e#2914\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eexpandWildcardImports\u003c/code\u003e failing on JDK XML types such as \u003ccode\u003eorg.xml.sax.InputSource\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2921\"\u003e#2921\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/ef7703ae87f70bbf63d77c5275e6c687785706bc\"\u003e\u003ccode\u003eef7703a\u003c/code\u003e\u003c/a\u003e Published maven/3.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/91113e0fc7ec05f9a5f6a627869671290b4fa659\"\u003e\u003ccode\u003e91113e0\u003c/code\u003e\u003c/a\u003e Published gradle/8.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/611b48ea943e9e8faf8d98db206dcf7f15cf8ef3\"\u003e\u003ccode\u003e611b48e\u003c/code\u003e\u003c/a\u003e Published lib/4.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/5f3a85fd15241450ba9b33e43507ee995176032b\"\u003e\u003ccode\u003e5f3a85f\u003c/code\u003e\u003c/a\u003e ci(deploy): use \u003ccode\u003ebase64 -w0\u003c/code\u003e so the auth header has no embedded newline\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/f84f02512b83d2ebe2aede8e0c70837b3592e98f\"\u003e\u003ccode\u003ef84f025\u003c/code\u003e\u003c/a\u003e ci(deploy): force HTTP/1.1 on \u003ccode\u003egit fetch origin main\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/780f0f60b62a9d7a11e28dbf3fe63b5e9e50e623\"\u003e\u003ccode\u003e780f0f6\u003c/code\u003e\u003c/a\u003e fix(spotless/gradle-plugin): Fix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenari...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b0328c849d5ba7dd50feb33b7d4ae7478a5e5436\"\u003e\u003ccode\u003eb0328c8\u003c/code\u003e\u003c/a\u003e Update plugin rewrite to v7.34.0 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2972\"\u003e#2972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/9a502ce0cbe0932de33e8543f9bc2a6ec714bc26\"\u003e\u003ccode\u003e9a502ce\u003c/code\u003e\u003c/a\u003e Update plugin com.gradle.develocity to v4.4.2 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2971\"\u003e#2971\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b4d9ec0b41f4b9fedf6874a8a4becac286403ec4\"\u003e\u003ccode\u003eb4d9ec0\u003c/code\u003e\u003c/a\u003e Revert the changes to \u003ccode\u003eassertUnchanged()\u003c/code\u003e and use \u003ccode\u003eassertTransform()\u003c/code\u003e when ne...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/787819d8f8640c011d245dafee492fc5bffb0405\"\u003e\u003ccode\u003e787819d\u003c/code\u003e\u003c/a\u003e Remove unneeded debug comments\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.6.0...maven/3.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.6.0\u0026new-version\u003d3.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2653 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.7.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "60ff3cfe591e22ca37f9b3ad8584b465f7064853",
      "tree": "a7e2c2ab13adc327ed6ebfbd9cfa7856004a3bfb",
      "parents": [
        "91345fa1c76f1168455cadb67f4ff18662f554da"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 20:27:31 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 20:27:31 2026 -0700"
      },
      "message": "Revert \"ORC-2179: Add RISC-V Docker image and GitHub Actions support\"\n\nThis reverts commit 98aab65bf6d838bfdee8250ad469861a30a99ff1.\n"
    },
    {
      "commit": "91345fa1c76f1168455cadb67f4ff18662f554da",
      "tree": "b605155065d4ea5b38ced5cbd6027d3491cd443e",
      "parents": [
        "a8fff40fe01cb145c353e30f37e767cb10cb434c"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 09:52:10 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 09:52:10 2026 -0700"
      },
      "message": "ORC-2181: Add `ubuntu-26.04(-arm)?` to GitHub Actions `build` job\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add `ubuntu-26.04` and `ubuntu-26.04-arm` to the GitHub Action `build` job with Java 25.\n\n### Why are the changes needed?\n\nTo improve the test coverage by running the build and test on the latest Ubuntu 26.04 (both x86_64 and arm64) with the latest Java version.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2654 from dongjoon-hyun/ORC-2181.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "a8fff40fe01cb145c353e30f37e767cb10cb434c",
      "tree": "428a1861dd683992a1d07ead14e17a25b7ac2b4e",
      "parents": [
        "98aab65bf6d838bfdee8250ad469861a30a99ff1"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 08:39:49 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 08:39:49 2026 -0700"
      },
      "message": "ORC-2182: Pin docker setup actions to approved commit hashes to recover CIs\n\n### What changes were proposed in this pull request?\n\nThis PR pins two `docker/*` GitHub Actions in `.github/workflows/build_and_test.yml` to commit hashes approved by the ASF (`apache/infrastructure-actions/approved_patterns.yml`):\n\n| Action | Before | After |\n| --- | --- | --- |\n| `docker/setup-qemu-action` | `v3` | `c7c53464625b32c7a7e944ae62b3e17d2b600130` (v3.7.0) |\n| `docker/setup-buildx-action` | `v3` | `d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5` (v4.1.0) |\n\nNote that the approved patterns list has no `v3.x` hash for `docker/setup-buildx-action`, so it is bumped from `v3` to the latest approved `v4.1.0`.\n\n### Why are the changes needed?\n\nThe ASF infrastructure policy requires third-party GitHub Actions to be pinned to approved commit hashes instead of mutable version tags, to prevent supply-chain attacks from tag reassignment.\n\nCurrently, the CI is broken like the following.\n- https://github.com/apache/orc/actions/runs/28527900078\n\n\u003cimg width\u003d\"612\" height\u003d\"213\" alt\u003d\"Screenshot 2026-07-01 at 08 35 48\" src\u003d\"https://github.com/user-attachments/assets/50e31ed2-b282-461e-be50-ee84db79360b\" /\u003e\n\n### How was this patch tested?\n\nPass the GitHub Actions.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2655 from dongjoon-hyun/ORC-2182.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "98aab65bf6d838bfdee8250ad469861a30a99ff1",
      "tree": "eebd926ab7676f977c8145dad509753e17a6f86c",
      "parents": [
        "56e88baf3b666c9b2378d7b62577401e9ded9224"
      ],
      "author": {
        "name": "changbao zhan",
        "email": "zhan.changbao@sanechips.com.cn",
        "time": "Sun Jun 28 16:39:03 2026 +0800"
      },
      "committer": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Sun Jun 28 16:39:03 2026 +0800"
      },
      "message": "ORC-2179: Add RISC-V Docker image and GitHub Actions support\n\n### What this PR does\n\nAdds a RISC-V (riscv64) Docker image for Ubuntu 24.04 and wires it into GitHub Actions so we can continuously build ORC on RISC-V.\n\n### Changes\n\n- `docker/riscv64-ubuntu24/Dockerfile`: new image based on the existing Ubuntu 24.04 Dockerfile. Supports both `cc\u003dgcc` (default) and `cc\u003dclang` build args.\n- `docker/os-list.txt`: registered the new image.\n- `.github/workflows/build_and_test.yml`: added a `riscv64` job running under QEMU on `ubuntu-latest`.\n\n### Notes\n\n- The job currently only builds ORC. RVV-specific tests will be added in follow-up PRs after the RVV decoder implementation is in.\n- I followed the same pattern as the existing `aarch64` / `ubuntu24` Docker images to keep things consistent.\n- Local verification was done with `docker buildx` on a host with QEMU user-static registered.\n\n### ScreenShot\n\u003cimg width\u003d\"970\" height\u003d\"340\" alt\u003d\"1\" src\u003d\"https://github.com/user-attachments/assets/4cee0ece-a594-4fbe-8cf7-4b6e2b8f7219\" /\u003e\n\u003cimg width\u003d\"875\" height\u003d\"255\" alt\u003d\"2\" src\u003d\"https://github.com/user-attachments/assets/6ece8345-a613-4bfe-8cd2-1ee9e92a32c7\" /\u003e\n\nCloses #2644 from zhanchangbao-sanechips/ORC-2179-riscv-docker.\n\nAuthored-by: changbao zhan \u003czhan.changbao@sanechips.com.cn\u003e\nSigned-off-by: ffacs \u003cffacs520@gmail.com\u003e\n"
    },
    {
      "commit": "56e88baf3b666c9b2378d7b62577401e9ded9224",
      "tree": "3df8be6de051ac0a7b7d66de76e2c6c137737482",
      "parents": [
        "6d125348a6aca67919de4e12c2a3b8c07a3cdefb"
      ],
      "author": {
        "name": "changbao zhan",
        "email": "zhan.changbao@sanechips.com.cn",
        "time": "Sun Jun 28 16:36:32 2026 +0800"
      },
      "committer": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Sun Jun 28 16:36:32 2026 +0800"
      },
      "message": "ORC-2178: [C++] Add basic RISC-V build system and CPU detection support\n\n### What changes were proposed in this pull request?\n\nadd the minimum to get RISC-V support in the build system and CPU detection. This is needed before can start add RVV-optimization.\n\n### changes:\n\n- Added `BUILD_ENABLE_RVV` CMake option (off by default)\n- Added rv64gcv toolchain detection in `ConfigSimdLevel.cmake`\n- `ORC_USER_SIMD_LEVEL` now accepts RVV or NONE\n\nIf RVV isn\u0027t available, it just falls back to scalar code.\n\n### Why are the changes needed?\n\nORC doesn\u0027t know anything about RISC-V. This is just the groundwork so follow-up patches can actually use RVV. (https://issues.apache.org/jira/browse/ORC-1971)\n\n### How was this patch tested?\n\n- Tested on a Sophgo SG2044 board with GCC 14.2.0\n- Built with `-DBUILD_ENABLE_RVV\u003dON`, config passed\n- Setting `ORC_USER_SIMD_LEVEL\u003dNONE` properly masks out RVV\n\nCloses #2639 from zhanchangbao-sanechips/rvvopt.\n\nAuthored-by: changbao zhan \u003czhan.changbao@sanechips.com.cn\u003e\nSigned-off-by: ffacs \u003cffacs520@gmail.com\u003e\n"
    },
    {
      "commit": "6d125348a6aca67919de4e12c2a3b8c07a3cdefb",
      "tree": "1c798fc39b1c4374de010bcedebd0163474fc581",
      "parents": [
        "325efd35f1ec69812e8e7ab078b2558a3bdb02f2"
      ],
      "author": {
        "name": "sychen",
        "email": "sychen@ctrip.com",
        "time": "Tue Jun 16 10:00:49 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jun 16 10:00:49 2026 -0700"
      },
      "message": "ORC-2177: Fix array conversion with empty first batch\n\n### What changes were proposed in this pull request?\nAdd a `batchSize \u003e 0` guard in `ConvertTreeReader.convertVector()` before accessing index 0.\n\n### Why are the changes needed?\nWhen reading an ORC file with schema evolution converting `array\u003cint\u003e` to `array\u003cstring\u003e`, an `ArrayIndexOutOfBoundsException` is thrown if the first batch processed by the element reader has `childCount\u003d0` (i.e., all rows in the batch contain empty arrays).\n\n```java\njava.lang.ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0\n\tat org.apache.orc.impl.ConvertTreeReaderFactory$StringGroupFromAnyIntegerTreeReader.setConvertVectorElement(ConvertTreeReaderFactory.java:1094)\n\tat org.apache.orc.impl.ConvertTreeReaderFactory$ConvertTreeReader.convertVector(ConvertTreeReaderFactory.java:305)\n\tat org.apache.orc.impl.ConvertTreeReaderFactory$StringGroupFromAnyIntegerTreeReader.nextVector(ConvertTreeReaderFactory.java:1115)\n\tat org.apache.orc.impl.TreeReaderFactory$ListTreeReader.nextVector(TreeReaderFactory.java:2892)\n\tat org.apache.orc.impl.reader.tree.StructBatchReader.readBatchColumn(StructBatchReader.java:66)\n\tat org.apache.orc.impl.reader.tree.StructBatchReader.nextBatchForLevel(StructBatchReader.java:101)\n\tat org.apache.orc.impl.reader.tree.StructBatchReader.nextBatch(StructBatchReader.java:78)\n\tat org.apache.orc.impl.RecordReaderImpl.nextBatch(RecordReaderImpl.java:1444)\n```\n\n### How was this patch tested?\nAdded `testIntArrayToStringArrayFirstBatchAllEmpty` in `TestConvertTreeReaderFactory`\n\n### Was this patch authored or co-authored using generative AI tooling?\nGenerated-by: Claude\n\nCloses #2638 from cxzl25/ORC-2177.\n\nAuthored-by: sychen \u003csychen@ctrip.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "325efd35f1ec69812e8e7ab078b2558a3bdb02f2",
      "tree": "d7cbd10dcc63613b89010f9de9d400c5136727d1",
      "parents": [
        "668fcc12335cc9e26e6c056ddc2d0da5e5db9c66"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Jun 16 09:53:25 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jun 16 09:53:25 2026 -0700"
      },
      "message": "ORC-2180: Upgrade `threeten-extra` to 1.9.0\n\nBumps [org.threeten:threeten-extra](https://github.com/ThreeTen/threeten-extra) from 1.8.0 to 1.9.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/releases\"\u003eorg.threeten:threeten-extra\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease v1.9.0\u003c/h2\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://www.threeten.org/threeten-extra/changes-report.html\"\u003echange notes\u003c/a\u003e for more information.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.4.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/344\"\u003eThreeTen/threeten-extra#344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate deployment from OSSRH by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/372\"\u003eThreeTen/threeten-extra#372\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional wordBased method on AmountFormats by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/373\"\u003eThreeTen/threeten-extra#373\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd PeriodDuration.truncatedTo by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/374\"\u003eThreeTen/threeten-extra#374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix Ethiopic calendar epoch in Javadoc by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/375\"\u003eThreeTen/threeten-extra#375\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix implementations of query() by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/376\"\u003eThreeTen/threeten-extra#376\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies and Prepare for release by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/377\"\u003eThreeTen/threeten-extra#377\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/compare/v1.8.0...v1.9.0\"\u003ehttps://github.com/ThreeTen/threeten-extra/compare/v1.8.0...v1.9.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/7ad2731e89445d7a5990ffe7e64e4506cc934e81\"\u003e\u003ccode\u003e7ad2731\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release v1.9.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/11b6c0c1d5f6a57606f36f7c56a4863ad8c81e98\"\u003e\u003ccode\u003e11b6c0c\u003c/code\u003e\u003c/a\u003e Enable workflow dispatch\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/64f62be51fcdbcdca51ada4357eb166a4f25dd3b\"\u003e\u003ccode\u003e64f62be\u003c/code\u003e\u003c/a\u003e Update dependencies and Prepare for release (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/377\"\u003e#377\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/052f0fb11d86c43bdfa08e9b78986bd4862d9d70\"\u003e\u003ccode\u003e052f0fb\u003c/code\u003e\u003c/a\u003e Fix implementations of query() (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/376\"\u003e#376\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/d896bcf17ee4604d4ca1f2f62b538594ecc40c5f\"\u003e\u003ccode\u003ed896bcf\u003c/code\u003e\u003c/a\u003e Fix Ethiopic calendar epoch in Javadoc (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/375\"\u003e#375\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/8a44e4109d9f897ff6737d1c66624a1151befee5\"\u003e\u003ccode\u003e8a44e41\u003c/code\u003e\u003c/a\u003e Add PeriodDuration.truncatedTo (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/374\"\u003e#374\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/1af9bdc5cd9661d5051ccaa1f8e21969e00a1fa0\"\u003e\u003ccode\u003e1af9bdc\u003c/code\u003e\u003c/a\u003e Additional wordBased method on AmountFormats (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/373\"\u003e#373\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/54834ca24b2b6aa046c8285e3fcee474b8f03d0e\"\u003e\u003ccode\u003e54834ca\u003c/code\u003e\u003c/a\u003e Update deployment from OSSRH (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/372\"\u003e#372\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/4e016340b97cab604114d10e02a672c1e94c6be5\"\u003e\u003ccode\u003e4e01634\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.4.0 (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/344\"\u003e#344\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/51679d62e430bffca7c2e47e33a7f5abd098003c\"\u003e\u003ccode\u003e51679d6\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/compare/v1.8.0...v1.9.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.threeten:threeten-extra\u0026package-manager\u003dmaven\u0026previous-version\u003d1.8.0\u0026new-version\u003d1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2643 from dependabot[bot]/dependabot/maven/java/org.threeten-threeten-extra-1.9.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "668fcc12335cc9e26e6c056ddc2d0da5e5db9c66",
      "tree": "85d2b313759d8098ff514172889f4d49c9391484",
      "parents": [
        "36a4f4d1ab5e0572e2dad6ddbe6fe992a22cb6ac"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jun 10 15:16:25 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Jun 10 15:16:25 2026 +0800"
      },
      "message": "ORC-2176: Upgrade `spotless-maven-plugin` to 3.6.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.5.1 to 3.6.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.6.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003e\u0026lt;cacheDirectory\u0026gt;\u003c/code\u003e to \u003ccode\u003e\u0026lt;eclipse\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026lt;greclipse\u0026gt;\u003c/code\u003e, and \u003ccode\u003e\u0026lt;eclipseCdt\u0026gt;\u003c/code\u003e for the Equo/Solstice P2 cache. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eEclipseJdtFormtterStep\u003c/code\u003e now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;versionCatalog\u0026gt;\u003c/code\u003e no longer splits long inline tables across multiple lines — Gradle\u0027s TOML 1.0 parser cannot read multi-line inline tables. The \u003ccode\u003emaxLineLength\u003c/code\u003e option has been removed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2948\"\u003e#2948\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003espotless:apply\u003c/code\u003e no longer aborts on the first file with lints; it now formats all files and reports a single aggregated lint failure across every file, matching the Gradle plugin\u0027s behavior. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2937\"\u003e#2937\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;greclipse\u0026gt;\u003c/code\u003e and \u003ccode\u003e\u0026lt;eclipseCdt\u0026gt;\u003c/code\u003e now default P2 data to the Maven local repository. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eforbidWildcardImports\u003c/code\u003e and \u003ccode\u003eforbidModuleImports\u003c/code\u003e now detect imports that have leading whitespace (indentation/tabs). (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2939\"\u003e#2939\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved formatting performance by eliminating redundant per-step line-ending normalization in the core formatter loop. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2934\"\u003e#2934\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/71a433c5cd5e8a4983c6600a10032ce3415700ba\"\u003e\u003ccode\u003e71a433c\u003c/code\u003e\u003c/a\u003e Published maven/3.6.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3a0f1017dcdfd49042a638119c1b6d998b28c67f\"\u003e\u003ccode\u003e3a0f101\u003c/code\u003e\u003c/a\u003e Published gradle/8.6.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/007e9d858177c93a3c7b6f9d1eb068937022613f\"\u003e\u003ccode\u003e007e9d8\u003c/code\u003e\u003c/a\u003e Published lib/4.6.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a074d53565e0f523c3bba7f5135ba0d8f959f98b\"\u003e\u003ccode\u003ea074d53\u003c/code\u003e\u003c/a\u003e Allow setting the local P2 cache dir in the Spotless Gradle plugin (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a266fc2b97098aed703300ecfb00a7fc6ab57467\"\u003e\u003ccode\u003ea266fc2\u003c/code\u003e\u003c/a\u003e Merge branch \u0027main\u0027 into add-cache-directory-dsl\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/e0d466e5c157d41208ba84f3b0c767a4ad3d4330\"\u003e\u003ccode\u003ee0d466e\u003c/code\u003e\u003c/a\u003e Fix: sort members treats record declarations as types (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3936b6f2f9290bfe946a890c1efc791eb969c7db\"\u003e\u003ccode\u003e3936b6f\u003c/code\u003e\u003c/a\u003e Merge branch \u0027main\u0027 into main\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/278765fcbbdc91d9bbcd3bff41005a350746792c\"\u003e\u003ccode\u003e278765f\u003c/code\u003e\u003c/a\u003e fix: expandWildcardImports support pom type dependency, fix \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2839\"\u003e#2839\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2935\"\u003e#2935\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a18ddec9bd578c77177c9478207892d63f942826\"\u003e\u003ccode\u003ea18ddec\u003c/code\u003e\u003c/a\u003e Remove maxLineLength from versionCatalog step (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2949\"\u003e#2949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b91ad871a69bb7c3722120c81f9dae3e1ee11836\"\u003e\u003ccode\u003eb91ad87\u003c/code\u003e\u003c/a\u003e Add changelog entries for versionCatalog maxLineLength removal\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.5.1...maven/3.6.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.5.1\u0026new-version\u003d3.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2635 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.6.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "36a4f4d1ab5e0572e2dad6ddbe6fe992a22cb6ac",
      "tree": "a535fe9e6370c1e8efd7930d52d49eaeeeb1f824",
      "parents": [
        "25f2e749aae0e34dd00c8376a780d3a3e329da2e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jun 10 15:14:17 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Jun 10 15:14:17 2026 +0800"
      },
      "message": "ORC-2175: Upgrade `maven-dependency-plugin` to 3.11.0\n\nBumps [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) from 3.10.0 to 3.11.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/releases\"\u003eorg.apache.maven.plugins:maven-dependency-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.11.0\u003c/h2\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd dependency:add and dependency:remove goals (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1599\"\u003e#1599\u003c/a\u003e) \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded ability to provide arbitrary dependencies to properties mojo (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1561\"\u003e#1561\u003c/a\u003e) \u003ca href\u003d\"https://github.com/treilhes\"\u003e\u003ccode\u003e​treilhes\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix artifact relocation support (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1633\"\u003e#1633\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: fix addParentPoms\u003dtrue causes repositories to be ignored. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1585\"\u003e#1585\u003c/a\u003e) \u003ca href\u003d\"https://github.com/k-wall\"\u003e\u003ccode\u003e​k-wall\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix false positive in analyze-exclusions with transitive dependency exclusion (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1628\"\u003e#1628\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake AbstractAnalyzeMojo.filterArtifactsByScope() null-safe (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1622\"\u003e#1622\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrevent NPE in BuildClasspathMojo.appendArtifactPath() when an artifact has no resolved file (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1623\"\u003e#1623\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eLog unpacking at debug level (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1624\"\u003e#1624\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve plugins declared in pluginManagement for resolve-plugins and go-offline (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1603\"\u003e#1603\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eanalyze-exclusions\u003c/code\u003e crashes if there is no \u003ccode\u003edependencyManagement\u003c/code\u003e element (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1597\"\u003e#1597\u003c/a\u003e) \u003ca href\u003d\"https://github.com/JackPGreen\"\u003e\u003ccode\u003e​JackPGreen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable ITs for dependency:remove and use mock dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1613\"\u003e#1613\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMore meaningful assertions (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1611\"\u003e#1611\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCure various typos IntelliJ complains about (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1612\"\u003e#1612\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove unused jansi dependency (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1606\"\u003e#1606\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnable ITs for dependecy:add and use mock dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1610\"\u003e#1610\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCleaner exception handling (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1566\"\u003e#1566\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eManage ASM version 9.10 to support JDK 27 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1632\"\u003e#1632\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump eu.maveniverse.maven.domtrip:domtrip-core from 1.5.0 to 1.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1631\"\u003e#1631\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump eu.maveniverse.maven.domtrip:domtrip-maven from 1.5.0 to 1.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1630\"\u003e#1630\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.15 to 3.9.16 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1626\"\u003e#1626\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.shared:maven-dependency-analyzer from 1.17.0 to 1.17.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1627\"\u003e#1627\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 in /src/it/projects/remove-dependency/basic (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1607\"\u003e#1607\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-plugins from 47 to 48 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1605\"\u003e#1605\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1601\"\u003e#1601\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.jsoup:jsoup from 1.22.1 to 1.22.2 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1602\"\u003e#1602\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.doxia:doxia-sink-api from 2.0.0 to 2.1.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1595\"\u003e#1595\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1596\"\u003e#1596\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.12 to 3.9.14 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1594\"\u003e#1594\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1589\"\u003e#1589\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/c186d05d80e15cd18651a3071a5186e275e04029\"\u003e\u003ccode\u003ec186d05\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release maven-dependency-plugin-3.11.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/371261124f9cff27cf0439fe3abaec4e322fae7e\"\u003e\u003ccode\u003e3712611\u003c/code\u003e\u003c/a\u003e Fix artifact relocation support\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/e873e0eb87775c0346b22cf6fe0c565e93e0b01f\"\u003e\u003ccode\u003ee873e0e\u003c/code\u003e\u003c/a\u003e Manage ASM version 9.10 to support JDK 27\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/70b535690ecbf985e795cabca9869d66a2c68e10\"\u003e\u003ccode\u003e70b5356\u003c/code\u003e\u003c/a\u003e fix: fix addParentPoms\u003dtrue causes repositories to be ignored. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/issues/1585\"\u003e#1585\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/51d893970655d18dade1f06ca48e2bf676349629\"\u003e\u003ccode\u003e51d8939\u003c/code\u003e\u003c/a\u003e Fix false positive in analyze-exclusions with transitive dependency exclusion...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/02b865b98376be8e9a0c31a028b87a4e1d4ff7a3\"\u003e\u003ccode\u003e02b865b\u003c/code\u003e\u003c/a\u003e Bump eu.maveniverse.maven.domtrip:domtrip-core from 1.5.0 to 1.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/04f4de17e7bd73276baeacc7275308d20f1257fd\"\u003e\u003ccode\u003e04f4de1\u003c/code\u003e\u003c/a\u003e Bump eu.maveniverse.maven.domtrip:domtrip-maven from 1.5.0 to 1.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/2812490a1263d186950becfe2d214f03e807048f\"\u003e\u003ccode\u003e2812490\u003c/code\u003e\u003c/a\u003e Bump mavenVersion from 3.9.15 to 3.9.16\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/ce117da219149e28f4253f85a805093222b8f868\"\u003e\u003ccode\u003ece117da\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.shared:maven-dependency-analyzer\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/aea7a6400a73696f8819071c607e3c0d16bb9294\"\u003e\u003ccode\u003eaea7a64\u003c/code\u003e\u003c/a\u003e Prevent NPE (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/issues/1622\"\u003e#1622\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.10.0...maven-dependency-plugin-3.11.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.apache.maven.plugins:maven-dependency-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.10.0\u0026new-version\u003d3.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2634 from dependabot[bot]/dependabot/maven/java/org.apache.maven.plugins-maven-dependency-plugin-3.11.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "25f2e749aae0e34dd00c8376a780d3a3e329da2e",
      "tree": "f9d91ba78ebb0532702e8e5f9ae62a3397a35239",
      "parents": [
        "dd3ec892123e42d6dfe3e0db3da40fd36d62c46a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jun 10 15:10:39 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Jun 10 15:10:39 2026 +0800"
      },
      "message": "ORC-2174: Upgrade `jackson` to 2.21.4\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.3 to 2.21.4.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/d1abd31e4fec3035965d57a05a6256171ea8d980\"\u003e\u003ccode\u003ed1abd31\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.21.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/2aaea43db8480aa7d405ebc0de503cffc864f6f6\"\u003e\u003ccode\u003e2aaea43\u003c/code\u003e\u003c/a\u003e Prep for 2.21.4 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/9d3a9d54e40312ef0ac9192d599b59b541f65fb8\"\u003e\u003ccode\u003e9d3a9d5\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/84bcf7f5b268bc2b47a92bd08391f75e9d956793\"\u003e\u003ccode\u003e84bcf7f\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.3...jackson-bom-2.21.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson:jackson-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d2.21.3\u0026new-version\u003d2.21.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2633 from dependabot[bot]/dependabot/maven/java/com.fasterxml.jackson-jackson-bom-2.21.4.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "dd3ec892123e42d6dfe3e0db3da40fd36d62c46a",
      "tree": "6290ac279eafdb2300223fe9e553be59428bfd8f",
      "parents": [
        "c00006393237a6d081b5b53478f53bb361246bc6"
      ],
      "author": {
        "name": "shouzhi",
        "email": "shouzhi.zh@alibaba-inc.com",
        "time": "Mon Jun 08 18:01:06 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Mon Jun 08 18:01:06 2026 +0800"
      },
      "message": "ORC-2167: [C++] Fix integer overflow in PostScript footer length validation\n\n### What changes were proposed in this pull request?\n\n Added overflow-safe bounds checking in three locations in c++/src/Reader.cc using __builtin_add_overflow to prevent integer overflow when parsing malformed\n   ORC files with extremely large length values in PostScript:\n\n  1. readMetadata() - Use __builtin_add_overflow to safely compute total tail size (footerLength + metadataSize + postscriptLength + 1) before comparing\n  against fileLength\n  2. createReader() - Use __builtin_add_overflow to safely compute tailSize (1 + postscriptLength + footerSize) before bounds validation\n  3. startNextStripe() - Use __builtin_add_overflow to safely sum stripe length components (offset + indexLength + dataLength + footerLength) before\n  comparing against fileLength\n\n### Why are the changes needed?\n\nWhen an ORC file\u0027s PostScript is crafted with footer_length or metadata_length set to UINT64_MAX, the bounds check using unsigned addition (e.g.,\n  metadataSize + footerLength + postscriptLength_ + 1) can overflow and wrap around to a small value, bypassing validation.\n\n  For example, given a 58-byte file with footerLength \u003d UINT64_MAX, metadataSize \u003d 0, and postscriptLength_ \u003d 23:\n  - The sum wraps to 23 (mod 2^64)\n  - The check 58 \u003c 23 evaluates to false, allowing invalid offset calculation\n  - This can cause SIGBUS crash due to out-of-bounds memory access\n\n  Using __builtin_add_overflow (a GCC/Clang builtin) provides a standard, efficient way to detect overflow without manual subtraction logic.\n\n### How was this patch tested?\n\nAdded two unit tests in c++/test/TestReader.cc:\n\n  1. testMalformedFooterLengthOverflow - Constructs a minimal malformed ORC file with footer_length \u003d UINT64_MAX and verifies that createReader() throws\n  ParseError\n  2. testMalformedMetadataLengthOverflow - Constructs a malformed file with metadata_length \u003d UINT64_MAX and verifies ParseError is thrown\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude code\n\nCloses #2629 from luffy-zh/ORC-2167.\n\nAuthored-by: shouzhi \u003cshouzhi.zh@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "c00006393237a6d081b5b53478f53bb361246bc6",
      "tree": "d2b0dfe47b3bdf8f345cb7cc5572037bfcb8b9d8",
      "parents": [
        "072cc2c3941534936af26554b0c6c71edfe4e6b7"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jun 05 09:23:37 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jun 05 09:23:37 2026 -0700"
      },
      "message": "ORC-2173: Add `SECURITY.md` for scan-agent discoverability\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add `SECURITY.md` for scan-agent discoverability.\n\n### Why are the changes needed?\n\nTo improve the visibility of ORC\u0027s security guidance in a standard way.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #2636 from dongjoon-hyun/ORC-2173.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "072cc2c3941534936af26554b0c6c71edfe4e6b7",
      "tree": "22ec43f506f11aa9033804a556c21ccafe04a874",
      "parents": [
        "6e63ad9b5c926ddb6ad545e64b11db513ddc5d2c"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jun 03 13:36:17 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jun 03 13:36:17 2026 +0800"
      },
      "message": "Update security model\n\n### What changes were proposed in this pull request?\nThis PR adds a new \"Threat Model\" section to the project\u0027s Security documentation (`site/security/index.md`).\nThe new section outlines:\n1. The trusted vs. untrusted data boundaries for the `orc` library.\n2. The distinction between robustness issues (e.g., crashes or Out-Of-Bounds reads caused by maliciously fuzzed files) and actual security vulnerabilities.\n3. The responsibilities of the low-level parsing library versus the data ingestion layer.\n\n### Why are the changes needed?\nThis update is needed to align Apache ORC\u0027s security threat model with other foundational data format libraries like Apache Arrow.\n\nThe community occasionally receives reports from fuzzing tools regarding crashes, OOMs, or memory issues caused by parsing maliciously corrupted files. This documentation clarifies our stance: because `orc` is a low-level format library designed for trusted environments, parsing malformed files that cause a crash (without leading to Remote Code Execution or bypassing a defined security boundary) is considered a normal software bug (a robustness issue) rather than a security vulnerability (CVE).\n\nThis will help avoid overwhelming maintainers with non-exploitable CVEs and set clear expectations for security researchers.\n\n### How was this patch tested?\nThis is a documentation-only change updating the website Markdown. No functional code changes were introduced.\n\n### Was this patch authored or co-authored using generative AI tooling?\nGenerated-by: Gemini 3.1 Pro\n\nThis patch had conflicts when merged, resolved by\nCommitter: Gang Wu \u003custcwg@gmail.com\u003e\n\nCloses #2632 from wgtmac/security_model.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "6e63ad9b5c926ddb6ad545e64b11db513ddc5d2c",
      "tree": "91a9be0c21e20978c773fe42291e9bd77991083b",
      "parents": [
        "86c0ad44df8448ad8dc710da625ca754e39b521c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:58:46 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:58:46 2026 +0800"
      },
      "message": "ORC-2172: Upgrade `zstd-jni` to 1.5.7-9\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-8 to 1.5.7-9.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/ea32a0208b74446922647c33b82c6a151ab06e8e\"\u003e\u003ccode\u003eea32a02\u003c/code\u003e\u003c/a\u003e v1.5.7-9\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/6660ec34c6188dfa390872d865f4c748d1b4a725\"\u003e\u003ccode\u003e6660ec3\u003c/code\u003e\u003c/a\u003e Fix some possible int overflows\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/luben/zstd-jni/compare/v1.5.7-8...v1.5.7-9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.luben:zstd-jni\u0026package-manager\u003dmaven\u0026previous-version\u003d1.5.7-8\u0026new-version\u003d1.5.7-9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2631 from dependabot[bot]/dependabot/maven/java/com.github.luben-zstd-jni-1.5.7-9.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "86c0ad44df8448ad8dc710da625ca754e39b521c",
      "tree": "61003d2c81ee4f52369d2ae263799e49837d31ce",
      "parents": [
        "8aebad4e063f61c39931a5c39604d62764fb90c5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:56:23 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:56:23 2026 +0800"
      },
      "message": "ORC-2171: Upgrade `spotless-maven-plugin` to 3.5.1\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.4.0 to 3.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.5.1\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;licenseHeader\u0026gt;\u003c/code\u003e with \u003ccode\u003e\u0026lt;yearMode\u0026gt;SET_FROM_GIT\u0026lt;/yearMode\u0026gt;\u003c/code\u003e no longer runs \u003ccode\u003egit log\u003c/code\u003e through a shell, eliminating a shell-injection vector when formatting files whose names contain shell metacharacters.\u003c/li\u003e\n\u003cli\u003eBump transitive \u003ccode\u003eplexus-utils\u003c/code\u003e \u003ccode\u003e4.0.2\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.0.3\u003c/code\u003e to address \u003ca href\u003d\"https://github.com/advisories/GHSA-6fmv-xxpf-w3cw\"\u003eCVE-2025-67030\u003c/a\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2919\"\u003e#2919\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.5.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;scalafmt\u0026gt;\u003c/code\u003e now reads the version from the \u003ccode\u003eversion\u003c/code\u003e field in the scalafmt config file when no \u003ccode\u003e\u0026lt;version\u0026gt;\u003c/code\u003e is explicitly set, falling back to the built-in default only if neither is available. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2922\"\u003e#2922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003e\u0026lt;toml\u0026gt;\u003c/code\u003e format type with \u003ccode\u003e\u0026lt;versionCatalog\u0026gt;\u003c/code\u003e step for formatting and sorting Gradle version catalog files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2916\"\u003e#2916\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003e\u0026lt;javaparserVersion\u0026gt;\u003c/code\u003e option to \u003ccode\u003e\u0026lt;cleanthat\u0026gt;\u003c/code\u003e, allowing users to override the JavaParser version pulled in transitively by Cleanthat. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd a \u003ccode\u003eexpandWildcardImports\u003c/code\u003e API for java (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2930\"\u003e#2829\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve case of JDBI named bind params that collide with SQL keywords (e.g. \u003ccode\u003e:limit\u003c/code\u003e, \u003ccode\u003e:offset\u003c/code\u003e) in the DBeaver SQL formatter. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2899\"\u003e#2899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e-Dspotless.ratchetFrom\u003d...\u003c/code\u003e user property now takes priority over \u003ccode\u003e\u0026lt;ratchetFrom\u0026gt;\u003c/code\u003e configured in the plugin or in individual formatters, instead of being overridden by them. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2896\"\u003e#2896\u003c/a\u003e, fixes \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2842\"\u003e#2842\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix non-idempotent formatting when \u003ccode\u003eimportOrder()\u003c/code\u003e is combined with \u003ccode\u003egreclipse()\u003c/code\u003e: a single catch-all group no longer strips blank lines that \u003ccode\u003egreclipse()\u003c/code\u003e independently inserted between import groups. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2914\"\u003e#2914\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eexpandWildcardImports\u003c/code\u003e failing on JDK XML types such as \u003ccode\u003eorg.xml.sax.InputSource\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2921\"\u003e#2921\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse Eclipse JDT\u0027s collator-based comparison when sorting Java members to better match Eclipse save actions. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2920\"\u003e#2920\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ecleanthat\u003c/code\u003e version \u003ccode\u003e2.24\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.25\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003eeclipse-jdt\u003c/code\u003e version from \u003ccode\u003e4.35\u003c/code\u003e to \u003ccode\u003e4.39\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2912\"\u003e#2912\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/0c48edf9597ec16e82e1a0b6da76a6a6dcc0d5de\"\u003e\u003ccode\u003e0c48edf\u003c/code\u003e\u003c/a\u003e Published maven/3.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/c1595c815d5fdd344505792aa4df588f467f0ca9\"\u003e\u003ccode\u003ec1595c8\u003c/code\u003e\u003c/a\u003e Published gradle/8.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b26b570f7eba32554061b036206f675180cd2384\"\u003e\u003ccode\u003eb26b570\u003c/code\u003e\u003c/a\u003e Published lib/4.6.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/ac3f6f14a2e007c2d36223335df96a2c9ba92719\"\u003e\u003ccode\u003eac3f6f1\u003c/code\u003e\u003c/a\u003e Bump plexus-utils to 4.0.3 to address CVE-2025-67030 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2932\"\u003e#2932\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/f5039f633d436a8831d09a934a3490d68968d684\"\u003e\u003ccode\u003ef5039f6\u003c/code\u003e\u003c/a\u003e Bump plexus-utils to 4.0.3 to address CVE-2025-67030\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/0e77837d4789cb43b83c21d566fe4185adc4ae2b\"\u003e\u003ccode\u003e0e77837\u003c/code\u003e\u003c/a\u003e Fix shell-injection in LicenseHeaderStep SET_FROM_GIT mode (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2931\"\u003e#2931\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/84f642329de804615ff16f34d12a2249f1890850\"\u003e\u003ccode\u003e84f6423\u003c/code\u003e\u003c/a\u003e Fix shell-injection in LicenseHeaderStep SET_FROM_GIT mode\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b87eb75efe54e94a7248ff5e2d07231bcc3a1b55\"\u003e\u003ccode\u003eb87eb75\u003c/code\u003e\u003c/a\u003e Published maven/3.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/97c3baf34b79d0028a343776bb2c2fb223930355\"\u003e\u003ccode\u003e97c3baf\u003c/code\u003e\u003c/a\u003e Published gradle/8.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3dd1a9690270e7191f2c7db8314a9079b127ee76\"\u003e\u003ccode\u003e3dd1a96\u003c/code\u003e\u003c/a\u003e Published lib/4.6.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.4.0...maven/3.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.4.0\u0026new-version\u003d3.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2630 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.5.1.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "8aebad4e063f61c39931a5c39604d62764fb90c5",
      "tree": "7ce0e90af431fe6ed83d3e88c813c18b7cc78637",
      "parents": [
        "ded8277ce610c3490ff7d2bde989378e3bd8ccd7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:54:35 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:54:35 2026 +0800"
      },
      "message": "ORC-2170: Upgrade `slf4j` to 2.0.18\n\nBumps `slf4j.version` from 2.0.17 to 2.0.18.\nUpdates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.18\n\nUpdates `org.slf4j:slf4j-simple` from 2.0.17 to 2.0.18\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2627 from dependabot[bot]/dependabot/maven/java/slf4j.version-2.0.18.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "ded8277ce610c3490ff7d2bde989378e3bd8ccd7",
      "tree": "39ef0c65c762005bbc464223baf430977b157768",
      "parents": [
        "8847022f0114fb18e9377f3197fdca59426d24f9"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:52:40 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:52:40 2026 +0800"
      },
      "message": "ORC-2169: Upgrade `maven-enforcer-plugin` to 3.6.3\n\nBumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.6.2 to 3.6.3.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/maven-enforcer/releases\"\u003eorg.apache.maven.plugins:maven-enforcer-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMake bannedDependencies report root and transitive dependency in case both are banned. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/940\"\u003e#940\u003c/a\u003e) \u003ca href\u003d\"https://github.com/hvoynov\"\u003e\u003ccode\u003e​hvoynov\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd enforceBytecodeVersion rule based on mojohaus (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/968\"\u003e#968\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cstamas\"\u003e\u003ccode\u003e​cstamas\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove formatting of deprecated API warning (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/951\"\u003e#951\u003c/a\u003e) \u003ca href\u003d\"https://github.com/mthmulders\"\u003e\u003ccode\u003e​mthmulders\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix handling of Java versions like 21.0.10.0.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/967\"\u003e#967\u003c/a\u003e) \u003ca href\u003d\"https://github.com/parttimenerd\"\u003e\u003ccode\u003e​parttimenerd\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd null checks for modelId in PluginWrapper (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/974\"\u003e#974\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cpfeiffer\"\u003e\u003ccode\u003e​cpfeiffer\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📝 Documentation updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDocument the banMavenDefaults option for the requirePluginVersions rule. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/936\"\u003e#936\u003c/a\u003e) \u003ca href\u003d\"https://github.com/rpkrajewski\"\u003e\u003ccode\u003e​rpkrajewski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ePlexusStringUtils\u003c/code\u003e Refaster recipes (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/943\"\u003e#943\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eJUnit Jupiter migration from JUnit 4.x (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/941\"\u003e#941\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4 in /maven-enforcer-plugin/src/it/projects/MENFORCER-434 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/970\"\u003e#970\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDeps: Parent POM 48 and align deps (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/979\"\u003e#979\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cstamas\"\u003e\u003ccode\u003e​cstamas\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.21.0 to 1.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/976\"\u003e#976\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-io:commons-io from 2.21.0 to 2.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/975\"\u003e#975\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/973\"\u003e#973\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.13 to 3.9.14 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/965\"\u003e#965\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.12 to 3.9.13 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/964\"\u003e#964\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/963\"\u003e#963\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate log4j in test to avoid CVE (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/961\"\u003e#961\u003c/a\u003e) \u003ca href\u003d\"https://github.com/Bukama\"\u003e\u003ccode\u003e​Bukama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.20.0 to 1.21.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/962\"\u003e#962\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.assertj:assertj-core from 3.27.6 to 3.27.7 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/960\"\u003e#960\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mrm-maven-plugin from 1.7.0 to 1.7.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/959\"\u003e#959\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven:maven-parent from 46 to 47 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/958\"\u003e#958\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-archiver from 4.10.4 to 4.11.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/957\"\u003e#957\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to 46 including fixes (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/955\"\u003e#955\u003c/a\u003e) \u003ca href\u003d\"https://github.com/Bukama\"\u003e\u003ccode\u003e​Bukama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.3.0 to 3.5.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/956\"\u003e#956\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.11 to 3.9.12 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/948\"\u003e#948\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/947\"\u003e#947\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-io:commons-io from 2.20.0 to 2.21.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/946\"\u003e#946\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.19.0 to 1.20.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/945\"\u003e#945\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/c7daff33d46c9c3ee0666540c6857c66cf159e70\"\u003e\u003ccode\u003ec7daff3\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release enforcer-3.6.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/ee46e78b046be9882a739c07556940329a7345d6\"\u003e\u003ccode\u003eee46e78\u003c/code\u003e\u003c/a\u003e Make bannedDependencies report root and transitive dependency in case both ar...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/0806924d8f6c5ad6105ac387bf323846e769b18c\"\u003e\u003ccode\u003e0806924\u003c/code\u003e\u003c/a\u003e Document the banMavenDefaults option for the requirePluginVersions rule. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/936\"\u003e#936\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/8e4f5b94453de97592cf3935b79319894f013329\"\u003e\u003ccode\u003e8e4f5b9\u003c/code\u003e\u003c/a\u003e Add better enforceBytecodeVersion rule based on mojohaus (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/968\"\u003e#968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/fd4b1486dcc93394d5f6a11687efd51d0d30b22d\"\u003e\u003ccode\u003efd4b148\u003c/code\u003e\u003c/a\u003e Add fix for 21.0.10.0.1 issue (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/967\"\u003e#967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/f32d5979ef387668162c2beb905b368e25accd70\"\u003e\u003ccode\u003ef32d597\u003c/code\u003e\u003c/a\u003e Deps: Parent POM 48 and align deps (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/979\"\u003e#979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/df0f2a6d7fbbaf79914cdb56fa5899d99c8eaf19\"\u003e\u003ccode\u003edf0f2a6\u003c/code\u003e\u003c/a\u003e Bump commons-codec:commons-codec from 1.21.0 to 1.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/976\"\u003e#976\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/2da7a68b4d8d9d2da866ffaf1e07a206c9b7115d\"\u003e\u003ccode\u003e2da7a68\u003c/code\u003e\u003c/a\u003e Add null checks for modelId in PluginWrapper\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/91eb4d9fe1f6f65137991c1131131ceaca542245\"\u003e\u003ccode\u003e91eb4d9\u003c/code\u003e\u003c/a\u003e Bump commons-io:commons-io from 2.21.0 to 2.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/975\"\u003e#975\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/b6222459bf3256bfd747731a7f4ea81577777ffe\"\u003e\u003ccode\u003eb622245\u003c/code\u003e\u003c/a\u003e Bump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/973\"\u003e#973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/maven-enforcer/compare/enforcer-3.6.2...enforcer-3.6.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.apache.maven.plugins:maven-enforcer-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.6.2\u0026new-version\u003d3.6.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2626 from dependabot[bot]/dependabot/maven/java/org.apache.maven.plugins-maven-enforcer-plugin-3.6.3.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "8847022f0114fb18e9377f3197fdca59426d24f9",
      "tree": "117d19be17367a17f63ea71f12b4172e4a169f1b",
      "parents": [
        "588c966245108c64978f1b99ae1a6fde7b22095c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:49:59 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:49:59 2026 +0800"
      },
      "message": "ORC-2168: Bump `parquet` to 1.17.1\n\nBumps `parquet.version` from 1.17.0 to 1.17.1.\nUpdates `org.apache.parquet:parquet-hadoop` from 1.17.0 to 1.17.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-mr/releases\"\u003eorg.apache.parquet:parquet-hadoop\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1 RC0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/78a8d3230eb4769db93de5f2f2e18363c04cae81\"\u003e\u003ccode\u003e78a8d32\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release apache-parquet-1.17.1-rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/b4351b2bbb08b30a1e5dafed0b7d995179c8208f\"\u003e\u003ccode\u003eb4351b2\u003c/code\u003e\u003c/a\u003e Bump version to 1.17.1-SNAPSHOT (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3544\"\u003e#3544\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/aa65eb460b204622f20848787b329d395b727756\"\u003e\u003ccode\u003eaa65eb4\u003c/code\u003e\u003c/a\u003e Bump jackson.version from 2.21.2 to 2.21.3 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3538\"\u003e#3538\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/ef00c4634233c714b3fd8d82a09a6c7e58c4e8a3\"\u003e\u003ccode\u003eef00c46\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3112\"\u003eGH-3112\u003c/a\u003e: Fix reading of proto Uint32Value (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3113\"\u003e#3113\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/0f91a199853bfcb48aff9af919ae4967f305ef7e\"\u003e\u003ccode\u003e0f91a19\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3410\"\u003eGH-3410\u003c/a\u003e: Bump jackson dependencies from 2.19.2 to 2.21.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3460\"\u003e#3460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/apache/parquet-mr/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `org.apache.parquet:parquet-avro` from 1.17.0 to 1.17.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-mr/releases\"\u003eorg.apache.parquet:parquet-avro\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1 RC0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/78a8d3230eb4769db93de5f2f2e18363c04cae81\"\u003e\u003ccode\u003e78a8d32\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release apache-parquet-1.17.1-rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/b4351b2bbb08b30a1e5dafed0b7d995179c8208f\"\u003e\u003ccode\u003eb4351b2\u003c/code\u003e\u003c/a\u003e Bump version to 1.17.1-SNAPSHOT (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3544\"\u003e#3544\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/aa65eb460b204622f20848787b329d395b727756\"\u003e\u003ccode\u003eaa65eb4\u003c/code\u003e\u003c/a\u003e Bump jackson.version from 2.21.2 to 2.21.3 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3538\"\u003e#3538\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/ef00c4634233c714b3fd8d82a09a6c7e58c4e8a3\"\u003e\u003ccode\u003eef00c46\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3112\"\u003eGH-3112\u003c/a\u003e: Fix reading of proto Uint32Value (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3113\"\u003e#3113\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/0f91a199853bfcb48aff9af919ae4967f305ef7e\"\u003e\u003ccode\u003e0f91a19\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3410\"\u003eGH-3410\u003c/a\u003e: Bump jackson dependencies from 2.19.2 to 2.21.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3460\"\u003e#3460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/apache/parquet-mr/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2623 from dependabot[bot]/dependabot/maven/java/parquet.version-1.17.1.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "588c966245108c64978f1b99ae1a6fde7b22095c",
      "tree": "2c4a6caa0d46189899358e0c44e437e0dfcd0ffa",
      "parents": [
        "473ac95ed62cf254e3fff25af835c42f9059fad1"
      ],
      "author": {
        "name": "The Apache Software Foundation",
        "email": "root-asf-gitbox-commits@apache.org",
        "time": "Mon May 18 14:29:59 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon May 18 12:29:59 2026 -0700"
      },
      "message": "INFRA: Set up default rulesets for default and release branches"
    },
    {
      "commit": "473ac95ed62cf254e3fff25af835c42f9059fad1",
      "tree": "6c50f04af04bfbf5ec303ebf71855e0e521259b0",
      "parents": [
        "cc7cc193074ccc96535abbbd52de37514eeff043"
      ],
      "author": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Thu May 14 11:24:48 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu May 14 11:24:48 2026 -0700"
      },
      "message": "ORC-2165: [C++] Fix bounds check for LZO stop command trailer\n\n### What changes were proposed in this pull request?\n\n  This PR fixes the C++ LZO decompressor stop command trailer validation. It now checks that two trailer bytes are available before reading them, and validates the trailer bytes\n  explicitly.\n\n  A regression test was added for truncated LZO stop command trailers.\n\n### Why are the changes needed?\n\n  Malformed LZO-compressed ORC input can end immediately after the LZO stop command, or with only one trailer byte remaining. The previous validation could read two bytes before safely\n  confirming that two bytes were available, causing an out-of-bounds read on truncated input.\n\n  The new check makes truncated LZO input fail cleanly with `ParseError`.\n\n### How was this patch tested?\n\n  Ran:\n\n```bash\n  cmake --build build --target orc-test -j 8\n  build/c++/test/orc-test \u0027--gtest_filter\u003dTestDecompression.testLzo*\u0027\n```\n  The LZO decompression tests passed.\n\n  Also ran a minimal AddressSanitizer harness against truncated LZO stop command inputs and confirmed there was no ASan report.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\n  Yes. Generated with OpenAI Codex.\n\nCloses #2621 from ffacs/ORC-2165-lzo-stop-trailer.\n\nAuthored-by: ffacs \u003cffacs520@gmail.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "cc7cc193074ccc96535abbbd52de37514eeff043",
      "tree": "149f8e09daf3b4dbcb893daa33906d2c5bb43349",
      "parents": [
        "fbc8c8771864ce08127a843237534b4f50f3e256"
      ],
      "author": {
        "name": "yongqian",
        "email": "yongqian@trip.com",
        "time": "Thu May 14 11:19:05 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu May 14 11:19:05 2026 -0700"
      },
      "message": "ORC-2149: Supports merging multiple ORC files with the same schema into multiple ORC files\n\n### What changes were proposed in this pull request?\nExtends the Java merge tool so that, for inputs sharing the same schema, you can still merge to one ORC file by default, or use -m / --maxSize to write multiple ORC files under an output directory as part-xxxxx.orc, batching by input file size.\n\n### Why are the changes needed?\nUsers often need to merge many compatible ORC files without producing a single huge output file. This adds an optional mode that caps output size at whole-file boundaries while keeping the existing single-file behavior when --maxSize is not set.\n\n### How was this patch tested?\nAdd UT\n\nCloses #2601 from QianyongY/features/ORC-2149.\n\nAuthored-by: yongqian \u003cyongqian@trip.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "fbc8c8771864ce08127a843237534b4f50f3e256",
      "tree": "7db570982739bd5021f760d2f82dbb91cfa9894a",
      "parents": [
        "41484da9c107c3f5a38da5f129b44c71ab03ae1d"
      ],
      "author": {
        "name": "yonghao.fyh",
        "email": "yonghao.fyh@alibaba-inc.com",
        "time": "Tue May 12 10:24:12 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Tue May 12 10:24:12 2026 +0800"
      },
      "message": "ORC-2164: [C++] Add external-buffer support in DataBuffer lifecycle management\n\n### What changes were proposed in this pull request?\n\nThis PR adds non-owning buffer support to DataBuffer so it can attach externally managed memory (via setData) without taking ownership of allocation/free, updates reserve/resize/destructor paths to be ownership-aware, and adds a focused unit test to verify that non-owning buffers keep external size semantics and do not free external memory during destruction.\n\n### Why are the changes needed?\n\nThese changes are needed to safely integrate with external prebuffer cache scenarios where memory is managed outside ORC, avoiding unnecessary reallocations and preventing ownership/lifecycle mismatches.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: GPT-5.3-codex\n\nCloses #2617 from lucasfang/mempool.\n\nAuthored-by: yonghao.fyh \u003cyonghao.fyh@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "41484da9c107c3f5a38da5f129b44c71ab03ae1d",
      "tree": "ea47778b9060fa10c5367021aac7489ff36598d8",
      "parents": [
        "2775e83494563223f670354cc6e9092bd19e2bbd"
      ],
      "author": {
        "name": "yonghao.fyh",
        "email": "yonghao.fyh@alibaba-inc.com",
        "time": "Mon May 11 15:29:25 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Mon May 11 15:29:25 2026 +0800"
      },
      "message": "ORC-2160: [C++] Expose prefetch range planning via Reader::preBufferRange and refactor preBuffer to reuse it\n\n### What changes were proposed in this pull request?\n\nThis PR introduces a new Reader API, preBufferRange(stripes, includeTypes), which computes and returns the exact prefetch ranges (offset/length pairs), implements it in ReaderImpl, and refactors the existing preBuffer path to reuse that range-planning logic before populating cache.\n\n### Why are the changes needed?\n\nThe change is needed because preBuffer previously did not expose the planned ranges, but external users now have a multi-Reader scenario where different Readers prefetch different ranges of the same file and share an external prebuffer cache, so they must know the precise ranges in advance to coordinate prefetching and avoid duplicated work.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #2616 from lucasfang/prebuffer.\n\nAuthored-by: yonghao.fyh \u003cyonghao.fyh@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "2775e83494563223f670354cc6e9092bd19e2bbd",
      "tree": "288522da5d6934e579217bc106a2bf68e18b2b65",
      "parents": [
        "cdb9a2d7c3fbbec383eb075dffe441ccd37f80d6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat May 09 19:56:42 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Sat May 09 19:56:42 2026 +0800"
      },
      "message": "ORC-2163: Upgrade `zstd-jni` to 1.5.7-8\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-7 to 1.5.7-8.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/0afb51a8420183cfb894063ea06cb08b91f63ce2\"\u003e\u003ccode\u003e0afb51a\u003c/code\u003e\u003c/a\u003e Use gcc on AIX\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/1addabc11201bc2a33df8cbd4f90c0508a273d46\"\u003e\u003ccode\u003e1addabc\u003c/code\u003e\u003c/a\u003e v1.5.7-8\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/3044e793cb449c0d55367a2232955136ee0d95f2\"\u003e\u003ccode\u003e3044e79\u003c/code\u003e\u003c/a\u003e More validation\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/8257354d97008c8cee736246bd45277e0998ce06\"\u003e\u003ccode\u003e8257354\u003c/code\u003e\u003c/a\u003e Remove the check for OSGI when trying to load from JAR\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/702105065a4973e4faf179a32dd535e7ef64a93a\"\u003e\u003ccode\u003e7021050\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Test on RISE RISC-V runners\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/9a1ed43541d6bd833eaa4c7537624e15fbc95151\"\u003e\u003ccode\u003e9a1ed43\u003c/code\u003e\u003c/a\u003e Test on RISE RISC-V runners\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/92a338167cc6221b618f34e22010ec62ff2eea95\"\u003e\u003ccode\u003e92a3381\u003c/code\u003e\u003c/a\u003e ignore .DS_Store\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/luben/zstd-jni/compare/v1.5.7-7...v1.5.7-8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.luben:zstd-jni\u0026package-manager\u003dmaven\u0026previous-version\u003d1.5.7-7\u0026new-version\u003d1.5.7-8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2613 from dependabot[bot]/dependabot/maven/java/com.github.luben-zstd-jni-1.5.7-8.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "cdb9a2d7c3fbbec383eb075dffe441ccd37f80d6",
      "tree": "4c95b3ee88ac596dc2d7e977eb9d1f91a65ef448",
      "parents": [
        "3563ee5bdb1b461b0df425b7ccabb4aa12a4b30b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat May 09 19:54:42 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Sat May 09 19:54:42 2026 +0800"
      },
      "message": "ORC-2162: Upgrade `jackson` to 2.21.3\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.2 to 2.21.3.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/374fbd08ee91a6c91626bae1d6497df21c89b541\"\u003e\u003ccode\u003e374fbd0\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.21.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/7059df78cc36832349acad026169ff890f4c718c\"\u003e\u003ccode\u003e7059df7\u003c/code\u003e\u003c/a\u003e Prep for 2.21.3 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/2fd60bdab3228f6b99dce81326d9fd7eaf587401\"\u003e\u003ccode\u003e2fd60bd\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.20\u0027 into 2.21\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/b82a3640491f66be2e56bef377b5002cd9d1567b\"\u003e\u003ccode\u003eb82a364\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.19\u0027 into 2.20\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/ef4e013e95fc64583b0a414711648a84fc50be46\"\u003e\u003ccode\u003eef4e013\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.18\u0027 into 2.19\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/536ae51c1db9dfbfc8dda697ccfd6545cf626d2b\"\u003e\u003ccode\u003e536ae51\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/536c5339035643fdca46ddd947f253afd072f764\"\u003e\u003ccode\u003e536c533\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/426b778e5ea490d164e572a63319c7cf2f362f2f\"\u003e\u003ccode\u003e426b778\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.18.7\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/a73cda9be3e57f29c53fea748f1f867eaa1457ab\"\u003e\u003ccode\u003ea73cda9\u003c/code\u003e\u003c/a\u003e Prep for 2.18.7 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/76b4a05087a9e42eb1b26f59d5b7028b0496da5e\"\u003e\u003ccode\u003e76b4a05\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.2...jackson-bom-2.21.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson:jackson-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d2.21.2\u0026new-version\u003d2.21.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2612 from dependabot[bot]/dependabot/maven/java/com.fasterxml.jackson-jackson-bom-2.21.3.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "3563ee5bdb1b461b0df425b7ccabb4aa12a4b30b",
      "tree": "2d19596e4ebf694359981238f7c23302c3812c4e",
      "parents": [
        "757c4fa107af1336c2bdd94288a951f4e8ede0bd"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 17:43:29 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 17:43:29 2026 +0800"
      },
      "message": "ORC-2161: [C++] UnionColumnReader should reject out-of-range union tags\n\n### What changes were proposed in this pull request?\n\nThis PR adds validation for C++ union tag values before they are used as child indexes.\n\nThe change covers:\n- UnionColumnReader::skip\n- UnionColumnReader::nextInternal\n- UnionColumnPrinter::printRow\n\nIf a malformed ORC file contains a union tag that is greater than or equal to the number of union children, the C++ reader/printer now throws ParseError instead of indexing out of bounds.\n\n### Why are the changes needed?\n\nUnion tags are decoded from the ORC data stream as byte values, but the valid range depends on the number of union children. Malformed input can contain a tag outside that range. The C++ reader previously trusted the tag value directly when indexing per-child state.\n\nThis patch makes malformed union tags fail cleanly.\n\n### How was this patch tested?\n\nAdded C++ unit tests for a two-child union with invalid tag value 200, covering:\n- next\n- next with nulls\n- skip\n- ColumnPrinter\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: OpenAI Codex GPT-5.\n\nCloses #2618 from wgtmac/fix_union.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "757c4fa107af1336c2bdd94288a951f4e8ede0bd",
      "tree": "69864dac40d2755ecfb50b1a5d842eefa15d9abc",
      "parents": [
        "6546fafadcfd76f3722041bba7d7c90913a6517e"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 15:37:49 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 15:37:49 2026 +0800"
      },
      "message": "ORC-2159: [C++] Fix C++ build with nodiscard return values\n\n### What changes were proposed in this pull request?\n\nHandle protobuf and ZeroCopyStream boolean results required by newer headers. Check serialization and text-format failures in writer/tool code, and make affected tests assert parse, next, and skip results explicitly while preserving existing reader skip behavior.\n\n### Why are the changes needed?\n\nThe C++ build fails with newer protobuf / compiler headers because several boolean-returning APIs are marked nodiscard and their return values are ignored. Since the C++ build treats warnings as errors, these become hard build failures.\n\nThe build fails with errors like:\n\n  ColumnReader.cc:438:9: error: ignoring return value of function declared with \u0027nodiscard\u0027 attribute [-Werror,-Wunused-result]\n    inputStream_-\u003eSkip(static_cast\u003cint\u003e(step));\n\n  ColumnReader.cc:684:9: error: ignoring return value of function declared with \u0027nodiscard\u0027 attribute [-Werror,-Wunused-result]\n    blobStream_-\u003eSkip(static_cast\u003cint\u003e(step));\n\n  ColumnWriter.cc:215:5: error: ignoring return value of function declared with \u0027nodiscard\u0027 attribute [-Werror,-Wunused-result]\n    rowIndex-\u003eSerializeToZeroCopyStream(indexStream.get());\n\n### How was this patch tested?\n\nPass CIs and build are happy locally.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Codex Version 26.429.61741 (2429)\n\nCloses #2615 from wgtmac/fix_build.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "6546fafadcfd76f3722041bba7d7c90913a6517e",
      "tree": "2150148ab77185103e3cc9f4fbf98bfbc1899726",
      "parents": [
        "7d302ebe69241a4c6089773a04f2a2a839203597"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon May 04 10:02:23 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon May 04 10:02:23 2026 -0700"
      },
      "message": "ORC-2158: Add 7-day cooldown to Dependabot maven updates\n\n### What changes were proposed in this pull request?\n\nThis PR adds a 7-day `cooldown` to Dependabot for the Maven ecosystem.\n\n```yaml\ncooldown:\n  default-days: 7\n```\n\n### Why are the changes needed?\n\nTo skip newly released versions until 7 days have passed, reducing the risk of importing early-release regressions and supply-chain attacks (e.g., compromised or malicious releases that are typically yanked or flagged within days of publication).\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7 (1M context)\n\nCloses #2614 from dongjoon-hyun/ORC-2158.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "7d302ebe69241a4c6089773a04f2a2a839203597",
      "tree": "e7e4ee61f999ec6126d4cfa24fa002a8ea8987de",
      "parents": [
        "69f56897acc7c7ecda86d495fc9081a877dda039"
      ],
      "author": {
        "name": "lisizhuo.lsz",
        "email": "lisizhuo.lsz@alibaba-inc.com",
        "time": "Thu Apr 30 00:18:47 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu Apr 30 00:18:47 2026 +0800"
      },
      "message": "ORC-2151: [C++] Move the timestamp compensation before timezone conversion to prevent incorrect DST offset lookup\n\n### What changes were proposed in this pull request?\nMoving the compensation to before the timezone conversion, we ensure that getVariant() always receives the corrected wall-clock time, producing the correct DST offset and an accurate final result.\n\n### Why are the changes needed?\nPreviously, the -1 second compensation for pre-1970 timestamps was applied after the writer-to-reader timezone adjustment. This means writerTimezone.getVariant(writerTime) was called with an uncorrected writerTime that could be 1 second larger than the true value. If this 1-second discrepancy happens to cross a DST (Daylight Saving Time) boundary, the timezone lookup would return an incorrect GMT offset, causing the final timestamp result to be off by the entire DST shift (typically 1 hour) rather than just 1 second.\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #2609 from lszskye/fix_ts.\n\nAuthored-by: lisizhuo.lsz \u003clisizhuo.lsz@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "69f56897acc7c7ecda86d495fc9081a877dda039",
      "tree": "02bd4f7ddcf32138122d8f37caa8c3e109a381f9",
      "parents": [
        "58a1218ef101396572df595a290b8f3e2a4fbbdc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Apr 28 18:39:06 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Tue Apr 28 18:39:06 2026 +0800"
      },
      "message": "ORC-2157: Upgrade `gson` to 2.14.0\n\nBumps [com.google.code.gson:gson](https://github.com/google/gson) from 2.13.2 to 2.14.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/google/gson/releases\"\u003ecom.google.code.gson:gson\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eGson 2.14.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eAdd type adapters for \u003ccode\u003ejava.time\u003c/code\u003e classes by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2948\"\u003egoogle/gson#2948\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eWhen the \u003ccode\u003ejava.time\u003c/code\u003e API is available, Gson automatically can read and write instances of classes like \u003ccode\u003eInstant\u003c/code\u003e and \u003ccode\u003eDuration\u003c/code\u003e. The format it uses essentially freezes the JSON representation that \u003ccode\u003eReflectiveTypeAdapterFactory\u003c/code\u003e established by default, based on the private fields of \u003ccode\u003ejava.time\u003c/code\u003e classes. That\u0027s not a great representation, but it is understandable. Changing it to anything else would break compatibility with systems that are expecting the current format.\u003c/p\u003e\n\u003cp\u003eWith this change, Gson no longer tries to access private fields of these classes using reflection. So it is no longer necessary to run with \u003ccode\u003e--add-opens\u003c/code\u003e for these classes on recent JDKs.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRemove \u003ccode\u003ecom.google.gson.graph\u003c/code\u003e by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2990\"\u003egoogle/gson#2990\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThis package was not part of any released artifact and depended on Gson internals in potentially problematic ways.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eValidate that strings being parsed as integers consist of ASCII characters by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2995\"\u003egoogle/gson#2995\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003ePreviously, strings could contain non-ASCII Unicode digits and still be parsed as integers. That\u0027s inconsistent with how JSON numbers are treated.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix duplicate key detection when first value is null by \u003ca href\u003d\"https://github.com/andrewstellman\"\u003e\u003ccode\u003e​andrewstellman\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3006\"\u003egoogle/gson#3006\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis could potentially break code that was relying on the incorrect behaviour. For example, this JSON string was previously accepted but will no longer be: \u003ccode\u003e{\u0026quot;foo\u0026quot;: null, \u0026quot;foo\u0026quot;: bar}\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRemove \u003ccode\u003eSerializable\u003c/code\u003e from internal \u003ccode\u003eType\u003c/code\u003e implementation classes. by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3011\"\u003egoogle/gson#3011\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThe nested classes \u003ccode\u003eParameterizedTypeImpl\u003c/code\u003e, \u003ccode\u003eGenericArrayTypeImpl\u003c/code\u003e, and \u003ccode\u003eWildcardTypeImpl\u003c/code\u003e in \u003ccode\u003eGsonTypes\u003c/code\u003e are implementations of the corresponding types (without \u003ccode\u003eImpl\u003c/code\u003e) in \u003ccode\u003ejava.lang.reflect\u003c/code\u003e. For some reason, they were serializable, even though the \u003ccode\u003ejava.lang.reflect\u003c/code\u003e implementations are not. Having unnecessarily serializable classes could \u003cem\u003econceivably\u003c/em\u003e have been a security problem if they were part of a larger exploit using serialization. (We do not consider this a likely scenario and do not suggest that you need to update Gson just to get this change.)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003eLegacyProtoTypeAdapterFactory\u003c/code\u003e. by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3014\"\u003egoogle/gson#3014\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis is not part of any released artifact, but may be of use when trying to fix code that is currently accessing the internals of protobuf classes via reflection.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eMake AppendableWriter do flush and close if delegation object supports by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2925\"\u003egoogle/gson#2925\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eOther less visible changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd default capacity to EnumTypeAdapter maps by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2959\"\u003egoogle/gson#2959\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: move derived adapters from Gson to TypeAdapters by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2951\"\u003egoogle/gson#2951\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOptimize \u003ccode\u003enew Gson()\u003c/code\u003e by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2864\"\u003egoogle/gson#2864\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThirdGoddess\"\u003e\u003ccode\u003e​ThirdGoddess\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2944\"\u003egoogle/gson#2944\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lmj798\"\u003e\u003ccode\u003e​lmj798\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2988\"\u003egoogle/gson#2988\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Eng-YasminKotb\"\u003e\u003ccode\u003e​Eng-YasminKotb\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3005\"\u003egoogle/gson#3005\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/andrewstellman\"\u003e\u003ccode\u003e​andrewstellman\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3006\"\u003egoogle/gson#3006\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0\"\u003ehttps://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/3ff35d6269894901ab8006258395aafc4b9765cd\"\u003e\u003ccode\u003e3ff35d6\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release gson-parent-2.14.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/a3024fde2a5c12b9a9a0b6b914ae4899aa574d81\"\u003e\u003ccode\u003ea3024fd\u003c/code\u003e\u003c/a\u003e Bump the maven group with 13 updates (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3002\"\u003e#3002\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/5689ffe44952ca6ed44c595886b9043286311b23\"\u003e\u003ccode\u003e5689ffe\u003c/code\u003e\u003c/a\u003e Bump the github-actions group across 1 directory with 3 updates (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3018\"\u003e#3018\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/48db33cbf93af6b2f5b117dfdfd826de47f7229c\"\u003e\u003ccode\u003e48db33c\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003eLegacyProtoTypeAdapterFactory\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3014\"\u003e#3014\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/53d703ee76ca3e951fa4a727307c1f28dbcaf3aa\"\u003e\u003ccode\u003e53d703e\u003c/code\u003e\u003c/a\u003e Update outdated comment regarding serializable types (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3012\"\u003e#3012\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/0189b727761f31596d1a27b7c60b42478dc9f331\"\u003e\u003ccode\u003e0189b72\u003c/code\u003e\u003c/a\u003e Remove \u003ccode\u003eSerializable\u003c/code\u003e from internal \u003ccode\u003eType\u003c/code\u003e implementation classes. (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3011\"\u003e#3011\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/f4d371d29c04066dbe7fdb31f642831f9c7f40cd\"\u003e\u003ccode\u003ef4d371d\u003c/code\u003e\u003c/a\u003e Fix duplicate key detection when first value is null (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3006\"\u003e#3006\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/27d9ba1eeeeb156540cf5397504a4f9f256e911f\"\u003e\u003ccode\u003e27d9ba1\u003c/code\u003e\u003c/a\u003e Fix typo in README (JPMS dependencies section) (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3005\"\u003e#3005\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/1fa9b7a0a994b006b3be00e2df9de778e71e6807\"\u003e\u003ccode\u003e1fa9b7a\u003c/code\u003e\u003c/a\u003e Validate that strings being parsed as integers consist of ASCII characters (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/b7d59549188867deb42e46073fb38735a5beda1c\"\u003e\u003ccode\u003eb7d5954\u003c/code\u003e\u003c/a\u003e Add iterator fail-fast tests for LinkedTreeMap.clear() (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/2992\"\u003e#2992\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.google.code.gson:gson\u0026package-manager\u003dmaven\u0026previous-version\u003d2.13.2\u0026new-version\u003d2.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2610 from dependabot[bot]/dependabot/maven/java/com.google.code.gson-gson-2.14.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "58a1218ef101396572df595a290b8f3e2a4fbbdc",
      "tree": "f8fd637d129227807092b89234f9f96caed5795f",
      "parents": [
        "61fd15507ab1002b051937e2ff0c9f8aee5d0360"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Apr 28 18:35:52 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Tue Apr 28 18:35:52 2026 +0800"
      },
      "message": "ORC-2156: Upgrade `brotli4j` to 1.23.0\n\nBumps [com.aayushatharva.brotli4j:brotli4j](https://github.com/hyperxpro/Brotli4j) from 1.22.0 to 1.23.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/releases\"\u003ecom.aayushatharva.brotli4j:brotli4j\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eBrotli4j v1.23.0 Release\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the actions group with 2 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/250\"\u003ehyperxpro/Brotli4j#250\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump io.netty:netty-buffer from 4.2.10.Final to 4.2.12.Final in the dependencies group by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/249\"\u003ehyperxpro/Brotli4j#249\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd per-pull output cap to decoder by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/251\"\u003ehyperxpro/Brotli4j#251\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare release and bump version to 1.23.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/252\"\u003ehyperxpro/Brotli4j#252\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.22.0...v1.23.0\"\u003ehttps://github.com/hyperxpro/Brotli4j/compare/v1.22.0...v1.23.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/205afeafd65d1e1c83f88a059e150687a1117426\"\u003e\u003ccode\u003e205afea\u003c/code\u003e\u003c/a\u003e Prepare release and bump version to 1.23.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/252\"\u003e#252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/3af3b973376a27923e0cdd94b7ac8aa53f301301\"\u003e\u003ccode\u003e3af3b97\u003c/code\u003e\u003c/a\u003e Add per-pull output cap to decoder (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/251\"\u003e#251\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/c860ffa60668ec5b5d8f0b3d378cc25c1d03ecd8\"\u003e\u003ccode\u003ec860ffa\u003c/code\u003e\u003c/a\u003e Bump io.netty:netty-buffer from 4.2.10.Final to 4.2.12.Final in the dependenc...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/ed4a3d7f2c017b4a2c2cbd6166ad61eac577c6a3\"\u003e\u003ccode\u003eed4a3d7\u003c/code\u003e\u003c/a\u003e Bump the actions group with 2 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/250\"\u003e#250\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.22.0...v1.23.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.aayushatharva.brotli4j:brotli4j\u0026package-manager\u003dmaven\u0026previous-version\u003d1.22.0\u0026new-version\u003d1.23.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2611 from dependabot[bot]/dependabot/maven/java/com.aayushatharva.brotli4j-brotli4j-1.23.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "61fd15507ab1002b051937e2ff0c9f8aee5d0360",
      "tree": "5c1ddde9af836ff50ba5d8d2c4d721f23a03d7a7",
      "parents": [
        "f352c856b773b99d986f1afe5d6d988d00c8a84f"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:17:01 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:17:01 2026 -0700"
      },
      "message": "ORC-2155: Upgrade `spotbugs-maven-plugin` to 4.9.8.3\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `spotbugs-maven-plugin` to 4.9.8.3.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes.\n- https://github.com/spotbugs/spotbugs-maven-plugin/releases/tag/spotbugs-maven-plugin-4.9.8.3\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7\n\nCloses #2608 from dongjoon-hyun/ORC-2155.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f352c856b773b99d986f1afe5d6d988d00c8a84f",
      "tree": "efef2a0a7ca8eb9fface5a057f0571a5ba7aabb2",
      "parents": [
        "f573536286f26b739b1b2b95334957b1d1179ecf"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:16:25 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:16:25 2026 -0700"
      },
      "message": "ORC-2154: Upgrade Guava to 33.6.0-jre\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade Guava to 33.6.0-jre.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes and improvements from the upstream Guava project.\n\n- https://github.com/google/guava/releases/tag/v33.6.0\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7\n\nCloses #2607 from dongjoon-hyun/ORC-2154.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f573536286f26b739b1b2b95334957b1d1179ecf",
      "tree": "5a11310dc5f9423b37ba1cc9293dd2ccb006b5e4",
      "parents": [
        "845eefaa2e7589fff58bd431fb315781dc3f1a67"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:15:42 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:15:42 2026 -0700"
      },
      "message": "ORC-2153: Upgrade `bcpkix-jdk18on` to 1.84\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `bcpkix-jdk18on` to 1.84.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes.\n- https://www.bouncycastle.org/download/bouncy-castle-java/#releasenotes\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7\n\nCloses #2606 from dongjoon-hyun/ORC-2153.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "845eefaa2e7589fff58bd431fb315781dc3f1a67",
      "tree": "b29a5f8b5e320e2d488089b48dbaaf1bf9245bc3",
      "parents": [
        "45435f1693df145fadf663d93682cd09f5fffccb"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 13:08:55 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 13:08:55 2026 -0700"
      },
      "message": "ORC-2152: Upgrade Maven to 3.9.15\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade Maven to 3.9.15.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes.\n- https://maven.apache.org/docs/3.9.15/release-notes.html\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7 (1M context)\n\nCloses #2605 from dongjoon-hyun/ORC-2152.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "45435f1693df145fadf663d93682cd09f5fffccb",
      "tree": "be095b7d7fafb7ad54d873858808efe9912e6540",
      "parents": [
        "1ba55eaa7c2306a663a01289b81ce1e7007ea6c5"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Apr 15 13:38:44 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Apr 15 13:38:44 2026 -0700"
      },
      "message": "ORC-2150: Upgrade ZLIB to 1.3.2\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades the C++ ZLIB dependency from 1.3.1 to 1.3.2.\n\n### Why are the changes needed?\n\nTo keep the dependency up to date with the latest stable release.\n- https://www.zlib.net/ChangeLog.txt\n\n```\nChanges in 1.3.2 (17 Feb 2026)\n- Continued rewrite of CMake build [Vollstrecker]\n- Various portability improvements\n- Various github workflow additions and improvements\n- Check for negative lengths in crc32_combine functions\n- Copy only the initialized window contents in inflateCopy\n- Prevent the use of insecure functions without an explicit request\n- Add compressBound_z and deflateBound_z functions for large values\n- Use atomics to build inflate fixed tables once\n- Add definition of ZLIB_INSECURE to build tests with c89 and c94\n- Add --undefined option to ./configure for UBSan checker\n- Copy only the initialized deflate state in deflateCopy\n- Zero inflate state on allocation\n- Remove untgz from contrib\n- Add _z versions of the compress and uncompress functions\n- Vectorize the CRC-32 calculation on the s390x\n- Set bit 11 of the zip header flags in minizip if UTF-8\n- Update OS/400 support\n- Add a test to configure to check for a working compiler\n- Check for invalid NULL pointer inputs to zlib operations\n- Add --mandir to ./configure to specify manual directory\n- Add LICENSE.Info-Zip to contrib/minizip\n- Remove vstudio projects in lieu of cmake-generated projects\n- Replace strcpy() with memcpy() in contrib/minizip\n```\n\n### How was this patch tested?\n\nExisting tests.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code\n\nCloses #2602 from dongjoon-hyun/ORC-2150.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1ba55eaa7c2306a663a01289b81ce1e7007ea6c5",
      "tree": "a8892121b2026d015dee8f7a9b042f50d6739c74",
      "parents": [
        "f3f8fb74cb0e723ce099956dbebd28f9bc552988"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Apr 10 10:14:56 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Apr 10 10:14:56 2026 -0700"
      },
      "message": "ORC-2148: Upgrade `lz4-java` to 1.11.0\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `at.yawk.lz4:lz4-java` to 1.11.0.\n\n### Why are the changes needed?\n\nTo keep up with the latest version of `lz4-java`.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.6\n\nCloses #2600 from dongjoon-hyun/ORC-2148.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f3f8fb74cb0e723ce099956dbebd28f9bc552988",
      "tree": "c78e3c6850ab1b5f42926df53ca90bef46de0724",
      "parents": [
        "2d6bd1e0a03705825d8c22edf98d1c0c4e3726f7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Apr 07 12:37:43 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 07 12:37:43 2026 -0700"
      },
      "message": "ORC-2147: Upgrade Hadoop to 3.5.0\n\nBumps `hadoop.version` from 3.4.3 to 3.5.0.\nUpdates `org.apache.hadoop:hadoop-client-api` from 3.4.3 to 3.5.0\n\nUpdates `org.apache.hadoop:hadoop-client-runtime` from 3.4.3 to 3.5.0\n\nUpdates `org.apache.hadoop:hadoop-yarn-common` from 3.4.3 to 3.5.0\n\nUpdates `org.apache.hadoop:hadoop-mapreduce-client-core` from 3.4.3 to 3.5.0\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2599 from dependabot[bot]/dependabot/maven/java/hadoop.version-3.5.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "2d6bd1e0a03705825d8c22edf98d1c0c4e3726f7",
      "tree": "60b133739ea9bb9e534cfd8458367b0273695113",
      "parents": [
        "016b076998cbe08fdbbb6841d971accd863a9894"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 30 16:17:17 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 30 16:17:17 2026 -0700"
      },
      "message": "ORC-2146: Upgrade `brotli4j` to 1.22.0\n\nBumps [com.aayushatharva.brotli4j:brotli4j](https://github.com/hyperxpro/Brotli4j) from 1.20.0 to 1.22.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/releases\"\u003ecom.aayushatharva.brotli4j:brotli4j\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eBrotli4j v1.22.0 Release\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd native binary validation script by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/247\"\u003ehyperxpro/Brotli4j#247\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare release and bump version to 1.22.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/248\"\u003ehyperxpro/Brotli4j#248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eImportant Fix:\u003c/h2\u003e\n\u003cp\u003ev1.21.0 was released with missing native binaries for OSX aarch64 and OSX amd64; See \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/246\"\u003ehyperxpro/Brotli4j#246\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.21.0...v1.22.0\"\u003ehttps://github.com/hyperxpro/Brotli4j/compare/v1.21.0...v1.22.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eBrotli4j v1.21.0 Release\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CI workflow for Maven Central release by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/228\"\u003ehyperxpro/Brotli4j#228\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group with 5 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/229\"\u003ehyperxpro/Brotli4j#229\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump CMake to 3.5 min by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/238\"\u003ehyperxpro/Brotli4j#238\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 4 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/237\"\u003ehyperxpro/Brotli4j#237\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd hardwood project link to README by \u003ca href\u003d\"https://github.com/sullis\"\u003e\u003ccode\u003e​sullis\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/240\"\u003ehyperxpro/Brotli4j#240\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group with 2 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/241\"\u003ehyperxpro/Brotli4j#241\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSync with Brotli 1.2.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/242\"\u003ehyperxpro/Brotli4j#242\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the dependencies group across 1 directory with 12 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/235\"\u003ehyperxpro/Brotli4j#235\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 in the actions group by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/244\"\u003ehyperxpro/Brotli4j#244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the dependencies group with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/243\"\u003ehyperxpro/Brotli4j#243\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRelease v1.21.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/245\"\u003ehyperxpro/Brotli4j#245\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.20.0...v1.21.0\"\u003ehttps://github.com/hyperxpro/Brotli4j/compare/v1.20.0...v1.21.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/0dd11c1ac24b2b29a985cc6ff203e501cd7eea35\"\u003e\u003ccode\u003e0dd11c1\u003c/code\u003e\u003c/a\u003e Prepare release and bump version to 1.22.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/248\"\u003e#248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/91bc58b70cc3cb7fee1cb4a58c34cdd6bbd667c0\"\u003e\u003ccode\u003e91bc58b\u003c/code\u003e\u003c/a\u003e Add native binary validation script (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/247\"\u003e#247\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/4dce45f14df4e70999c2e722014d86090dedf8f3\"\u003e\u003ccode\u003e4dce45f\u003c/code\u003e\u003c/a\u003e Release v1.21.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/245\"\u003e#245\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/7d81bc37357e1ac1a68565a8f6459b5f04eb3351\"\u003e\u003ccode\u003e7d81bc3\u003c/code\u003e\u003c/a\u003e Bump the dependencies group with 3 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/243\"\u003e#243\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/7ecf24973ca6eca75231a658935b7827da66172e\"\u003e\u003ccode\u003e7ecf249\u003c/code\u003e\u003c/a\u003e Bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 in the actions group (...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/606013e4624e7a02c8450c0ed4e42c3ae75cfebf\"\u003e\u003ccode\u003e606013e\u003c/code\u003e\u003c/a\u003e Bump the dependencies group across 1 directory with 12 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/235\"\u003e#235\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/c462c361f3179809cb204c629958162a26e47e09\"\u003e\u003ccode\u003ec462c36\u003c/code\u003e\u003c/a\u003e Sync with Brotli 1.2.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/242\"\u003e#242\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/9a27043baf5cffd0620924ada5a0006d72ccaa1c\"\u003e\u003ccode\u003e9a27043\u003c/code\u003e\u003c/a\u003e Bump the actions group with 2 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/241\"\u003e#241\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/4e1e36f57d253911df82ff25e66f010da5abe72b\"\u003e\u003ccode\u003e4e1e36f\u003c/code\u003e\u003c/a\u003e Add hardwood project link to README (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/240\"\u003e#240\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/d65b3d2529c533b16cea08dd7c367cffa1594767\"\u003e\u003ccode\u003ed65b3d2\u003c/code\u003e\u003c/a\u003e Bump the actions group across 1 directory with 4 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/237\"\u003e#237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.20.0...v1.22.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.aayushatharva.brotli4j:brotli4j\u0026package-manager\u003dmaven\u0026previous-version\u003d1.20.0\u0026new-version\u003d1.22.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2597 from dependabot[bot]/dependabot/maven/java/com.aayushatharva.brotli4j-brotli4j-1.22.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "016b076998cbe08fdbbb6841d971accd863a9894",
      "tree": "44107cde703be6aa988824879c8bb6a7cc48f325",
      "parents": [
        "1d51a8bd093d7d0932f0006b2044c6d092ec960c"
      ],
      "author": {
        "name": "yongqian",
        "email": "yongqian@trip.com",
        "time": "Wed Mar 25 14:43:21 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Mar 25 14:43:21 2026 +0800"
      },
      "message": "ORC-2131: Set default of orc.stripe.size.check.ratio and orc.dictionary.max.size.bytes to 0\n\n### What changes were proposed in this pull request?\n\nSet default of `orc.stripe.size.check.ratio` and `orc.dictionary.max.size.bytes` to 0\n\n### Why are the changes needed?\n\nAfter enabling the optimizations related to orc.stripe.size.check.ratio and orc.dictionary.max.size.bytes, we observed that ORC files written with the current defaults are about 10%–20% larger than before. For example, datasets that were previously ~1.0–1.1 TB grow to ~1.2 TB with the current defaults, causing noticeable storage cost increase.\n\n### How was this patch tested?\nLocal test\n\nWith orc.dictionary.max.size.bytes\u003d16777216 or orc.stripe.size.check.ratio\u003d2.0, the written ORC data grows to 1.2 TB (data inflation).\n\n```shell\n           1         6665      1300347279057 hdfs://ns/user/hive/warehouse/tmp_sandbox_xxx.db/tmp_test_123_2/d\u003d2026-03-15\n```\n\nWith orc.dictionary.max.size.bytes\u003d0 and orc.stripe.size.check.ratio\u003d0.0, the data size remains at the expected 1.0 TB.\n```shell\n           1         6665      1143347882367 hdfs://ns/user/hive/warehouse/tmp_sandbox_xxx.db/tmp_test_123_1/d\u003d2026-03-15\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #2580 from QianyongY/features/ORC-2131.\n\nAuthored-by: yongqian \u003cyongqian@trip.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "1d51a8bd093d7d0932f0006b2044c6d092ec960c",
      "tree": "6a635fc37173551908ee2369338921075ee53b8d",
      "parents": [
        "9b170ed8ff3b691277324ed9bef0726634d40aae"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 22:49:08 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 22:49:08 2026 -0700"
      },
      "message": "ORC-2145: Add `CLAUDE.md` for `Claude Code`\n\n### What changes were proposed in this pull request?\n\nThis PR adds a `CLAUDE.md` file at the repository root that references `AGENTS.md` using the `AGENTS.md` import directive, enabling Claude Code to automatically load the AI agent guidelines.\n\n### Why are the changes needed?\n\n`AGENTS.md` already contains comprehensive guidelines for AI coding assistants. By adding a `CLAUDE.md` that imports it, Claude Code sessions will automatically load these guidelines without duplicating content. This keeps `AGENTS.md` as the single source of truth.\n\n### How was this patch tested?\n\nThis is a documentation-only change. Verified the file was created correctly with the expected content.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2595 from dongjoon-hyun/ORC-2145.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "9b170ed8ff3b691277324ed9bef0726634d40aae",
      "tree": "e729f75574e5207b2d20d4096d38fd95f1f7ab3f",
      "parents": [
        "440fa1b6a0df7e1dd771ee9adcf87f9d1c3a5fb0"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 21:58:49 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 21:58:49 2026 -0700"
      },
      "message": "ORC-2144: Upgrade `byte-buddy` to 1.18.7\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `byte-buddy` and `byte-buddy-agent` to 1.18.7.\n\n### Why are the changes needed?\n\nTo keep the test dependency up to date with the latest bug fixes and improvements.\n- https://github.com/raphw/byte-buddy/releases/tag/byte-buddy-1.18.7\n- https://github.com/raphw/byte-buddy/releases/tag/byte-buddy-1.18.5\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-4-opus)\n\nCloses #2594 from dongjoon-hyun/ORC-2144.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "440fa1b6a0df7e1dd771ee9adcf87f9d1c3a5fb0",
      "tree": "8b40ff8cafc287b4b696a53a1247eb061ca9103d",
      "parents": [
        "f22a2d69c1c60a2a6090e45c1d75ef64aafedc60"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:33:27 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:33:27 2026 -0700"
      },
      "message": "ORC-2142: Upgrade `maven-surefire-plugin` to 3.5.5\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `maven-surefire-plugin` to 3.5.5.\n\n### Why are the changes needed?\n\nTo keep the dependency up to date with the latest release\n- https://github.com/apache/maven-surefire/releases/tag/surefire-3.5.5 (2026-02-18)\n- https://github.com/apache/maven-surefire/releases/tag/maven-surefire-3.5.4\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2592 from dongjoon-hyun/dongjoon/youthful-darwin.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f22a2d69c1c60a2a6090e45c1d75ef64aafedc60",
      "tree": "85a53ee1889427173c9144be01247af75e95c5d5",
      "parents": [
        "3ebeed865fa7e4bac59e0bf6f8cb6c71236170f6"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:32:36 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:32:36 2026 -0700"
      },
      "message": "ORC-2141: Upgrade `spotbugs` to 4.9.8\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `spotbugs` to 4.9.8.\n\n### Why are the changes needed?\n\nTo bring the dependency up to date with the latest release.\n\n### How was this patch tested?\n\nPass the existing CI.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2591 from dongjoon-hyun/dongjoon/condescending-ellis.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "3ebeed865fa7e4bac59e0bf6f8cb6c71236170f6",
      "tree": "5e50ef853c3123049faf4799b937d95df824f80d",
      "parents": [
        "acb12adcad2e044d956b46bfff4e4604f2490c09"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:48:09 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:48:09 2026 -0700"
      },
      "message": "ORC-2143: Add `AGENTS.md` for AI coding assistants\n\n### What changes were proposed in this pull request?\nThis PR introduces an `AGENTS.md` file at the root of the repository. `AGENTS.md` is a dedicated documentation file intended to guide AI coding assistants (such as GitHub Copilot, Cursor, Gemini, etc.) when they are used by contributors.\n\nIt provides AI agents with essential project context, including:\n- The separation of C++ (`c++/`) and Java (`java/`) modules\n- Accurate build and testing commands (CMake / Maven wrap)\n- Issue tracking conventions (requiring JIRA `ORC-XXXX`, `dev/create_orc_jira.py`)\n- Recommended local multi-environment testing strategy [docker/run-all.sh] and personal fork GitHub Actions tests.\n\n### Why are the changes needed?\nAs more developers use AI-assisted tools for coding, these tools often lack repository-specific context, leading to incorrect assumptions (e.g., suggesting raw `mvn` instead of `./mvnw`, or standard CMake instead of `make test-out`). This guideline will significantly improve the quality, accuracy, and compliance of the code and commands generated by AI agents for both new and existing contributors.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`.\n\nCloses #2593 from dongjoon-hyun/ORC-2143.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "acb12adcad2e044d956b46bfff4e4604f2490c09",
      "tree": "b0a7aab956e49c81e0fcfcbc0144832e7fa49eb5",
      "parents": [
        "ccce00ad850435d158b3b51ab40b3e6a9e5acba0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 23 14:04:45 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:04:45 2026 -0700"
      },
      "message": "ORC-2140: Upgrade `spotless-maven-plugin` to 3.4.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.3.0 to 3.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.4.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003etableTest\u003c/code\u003e format type for standalone \u003ccode\u003e.table\u003c/code\u003e files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003etabletest-formatter\u003c/code\u003e version \u003ccode\u003e1.0.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e1.1.1\u003c/code\u003e, now works with Java 17+. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eLib v3.3.1\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eGitPrePushHookInstaller\u003c/code\u003e didn\u0027t work on windows, now fixed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2562\"\u003e#2562\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003espotless-lib and spotless-lib-extra releases\u003c/h1\u003e\n\u003cp\u003eIf you are a Spotless user (as opposed to developer), then you are probably looking for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis document is intended for Spotless developers.\u003c/p\u003e\n\u003cp\u003eWe adhere to the \u003ca href\u003d\"https://keepachangelog.com/en/1.0.0/\"\u003ekeepachangelog\u003c/a\u003e format (starting after version \u003ccode\u003e1.27.0\u003c/code\u003e).\u003c/p\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[4.5.0] - 2026-03-18\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003etableTest\u003c/code\u003e format type for standalone \u003ccode\u003e.table\u003c/code\u003e files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003etabletest-formatter\u003c/code\u003e version \u003ccode\u003e1.0.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e1.1.1\u003c/code\u003e, now works with Java 17+. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.4.0] - 2026-03-02\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003etabletest-formatter\u003c/code\u003e support for Java and Kotlin. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2860\"\u003e#2860\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix the ability to specify a wildcard version (\u003ccode\u003e*\u003c/code\u003e) for external formatter executables, which did not work. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2848\"\u003e#2848\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[fix] \u003ccode\u003eConcurrentModificationException\u003c/code\u003e in \u003ccode\u003eexpandWildcardImports\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2830\"\u003e#2830\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.3.0] - 2026-01-27\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eP2Provisioner\u003c/code\u003e interface in lib-extra to enable build-tool-specific caching strategies for Eclipse P2 dependencies, fixing OutOfMemoryError in large multi-project builds. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2788\"\u003e#2788\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eremoveSemicolons()\u003c/code\u003e should not be applied to multiline strings in groovy \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2780\"\u003e#2780\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2792\"\u003e#2792\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.2.0] - 2026-01-22\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a \u003ccode\u003eexpandWildcardImports\u003c/code\u003e API for java (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2594\"\u003e#2679\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd the ability to specify a wildcard version (\u003ccode\u003e*\u003c/code\u003e) for external formatter executables. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2757\"\u003e#2757\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePrevent race conditions when multiple npm-based formatters launch the server process simultaneously while sharing the same \u003ccode\u003enode_modules\u003c/code\u003e directory. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2786\"\u003e#2786\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGit ratchet no longer throws an error with Git worktrees. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2779\"\u003e#2779\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003ektfmt\u003c/code\u003e version to latest \u003ccode\u003e0.59\u003c/code\u003e -\u0026gt; \u003ccode\u003e0.61\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2804\"\u003e2804\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ektlint\u003c/code\u003e version to latest \u003ccode\u003e1.7.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e1.8.0\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2763\"\u003e2763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egherkin-utils\u003c/code\u003e version to latest \u003ccode\u003e9.2.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e10.0.0\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2619\"\u003e#2619\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.1.0] - 2025-11-18\u003c/h2\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003ektfmt\u003c/code\u003e version to latest \u003ccode\u003e0.58\u003c/code\u003e -\u0026gt; \u003ccode\u003e0.59\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2681\"\u003e#2681\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejackson\u003c/code\u003e version to latest \u003ccode\u003e2.20.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.20.1\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2730\"\u003e#2730\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ecleanthat\u003c/code\u003e version to latest \u003ccode\u003e2.23\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.24\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2620\"\u003e#2620\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/708a1b0e6383ad2dd34cf3def185bb085a786789\"\u003e\u003ccode\u003e708a1b0\u003c/code\u003e\u003c/a\u003e Published maven/3.4.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/1cc0163c25b52824cd57b56cdcb8c4cb0c7b4795\"\u003e\u003ccode\u003e1cc0163\u003c/code\u003e\u003c/a\u003e Published gradle/8.4.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a4cd808f6092c6ed9371205de4af5285beea9533\"\u003e\u003ccode\u003ea4cd808\u003c/code\u003e\u003c/a\u003e Published lib/4.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/9066bf6ede907e913fbe30259de0763f1b0b55ea\"\u003e\u003ccode\u003e9066bf6\u003c/code\u003e\u003c/a\u003e Add links to the changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/db8dc1cc8e83b18ef357a0e660f03556fd792247\"\u003e\u003ccode\u003edb8dc1c\u003c/code\u003e\u003c/a\u003e Fix for illegal mutation issue with \u003ccode\u003epredeclareDeps\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2892\"\u003e#2892\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/0eb98a9574304e362f0ca6ddbfb71617de46df75\"\u003e\u003ccode\u003e0eb98a9\u003c/code\u003e\u003c/a\u003e chore: Updated gradle plugin change\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3f7f12e649b1085a7937b8730e6a7689a52ca6da\"\u003e\u003ccode\u003e3f7f12e\u003c/code\u003e\u003c/a\u003e chore: Removes check for predeclare as it\u0027s not needed anymore\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/55c0c5c081b83ad35e92911718e3069a64467c2a\"\u003e\u003ccode\u003e55c0c5c\u003c/code\u003e\u003c/a\u003e fix: IsolatedProjectTest.predeclaredIsUnsupported() is now actually supported...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/47489afd92aa79f56372bd53e82d09a44f606a32\"\u003e\u003ccode\u003e47489af\u003c/code\u003e\u003c/a\u003e fix: avoid IllegalMutationException when root project uses predeclareDeps() w...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/4010e8b42c32b8dfac31a988c6820b6b0ef499bd\"\u003e\u003ccode\u003e4010e8b\u003c/code\u003e\u003c/a\u003e test: Introduce a test harnessing predeclared deps\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/lib/3.3.0...maven/3.4.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.3.0\u0026new-version\u003d3.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2589 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.4.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "ccce00ad850435d158b3b51ab40b3e6a9e5acba0",
      "tree": "e795b9c1dc0947111257c6eb49f2fd81d6fdd8ad",
      "parents": [
        "ef96e73073bf57b803a72090c879d6915629b0d9"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:01:37 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:01:37 2026 -0700"
      },
      "message": "ORC-2139: Improve `create_orc_jira.py` to provide no-commit feature\n\n### What changes were proposed in this pull request?\n\nAdd `-n`/`--no-commit` option to `dev/create_orc_jira.py` to skip the commit step after branch creation.\n\n### Why are the changes needed?\n\nWhen there are no changes to commit, `git commit -a` fails. This option allows users to create a JIRA issue and branch without forcing a commit.\n\n### How was this patch tested?\n\nManual testing with `--help` to verify the new option is displayed, and with `-n` flag to confirm the commit step is skipped.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2590 from dongjoon-hyun/ORC-2139.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "ef96e73073bf57b803a72090c879d6915629b0d9",
      "tree": "c779407ad137aa42e2da353b4c4f9b54f24b67a6",
      "parents": [
        "1d5387e56b2b6cd48e73bf8176903888bbd262ca"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 23 13:45:00 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 13:45:00 2026 -0700"
      },
      "message": "ORC-2138: Upgrade `jackson` to 2.21.2\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.1 to 2.21.2.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/10e12a55b0a1d0caaa82b8b41101e8ecd39ed976\"\u003e\u003ccode\u003e10e12a5\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.21.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/d75490376b71e112c18fbe4d5f43a984bb2b2d6d\"\u003e\u003ccode\u003ed754903\u003c/code\u003e\u003c/a\u003e Prep for 2.21.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/63e1b3bb3e115e40580cd8c57263955d4fcbee24\"\u003e\u003ccode\u003e63e1b3b\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/716ab0d1d95d45d07e9f00f5b8a889f500375981\"\u003e\u003ccode\u003e716ab0d\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.1...jackson-bom-2.21.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson:jackson-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d2.21.1\u0026new-version\u003d2.21.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2588 from dependabot[bot]/dependabot/maven/java/com.fasterxml.jackson-jackson-bom-2.21.2.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1d5387e56b2b6cd48e73bf8176903888bbd262ca",
      "tree": "246f4f4076ffa5dfb90ea44b5642008a223ed092",
      "parents": [
        "25d32b7a71505cabff68a37f93e99dcfee1a67e9"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 02:19:18 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 02:19:18 2026 -0700"
      },
      "message": "ORC-2137: Upgrade `kryo-shaded` to 4.0.3\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `kryo-shaded` from 4.0.2 to 4.0.3.\n\n### Why are the changes needed?\n\nTo bring in the latest patch release of `kryo-shaded`.\n\n- https://github.com/EsotericSoftware/kryo/compare/kryo-parent-4.0.2...kryo-parent-4.0.3\n  - https://github.com/EsotericSoftware/kryo/issues/651\n  - https://github.com/EsotericSoftware/kryo/issues/850\n  - https://github.com/EsotericSoftware/kryo/issues/978\n\nIn addition, Apache Spark 4.0+ has been using `4.0.3`.\n- apache/spark#50586\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2587 from dongjoon-hyun/ORC-2137.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "25d32b7a71505cabff68a37f93e99dcfee1a67e9",
      "tree": "cc6c42d6d57cdbaaae8b60e9f4aa3c8d0070ba8b",
      "parents": [
        "b2dc0f8d20f512d3b8b6fed40bf1f4cf627cb98f"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 00:39:15 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 00:39:15 2026 -0700"
      },
      "message": "ORC-2135: Upgrade `mockito` to 5.23.0\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `mockito` to 5.23.0 to bring Java 25 related bug fix.\n\n### Why are the changes needed?\n\nTo keep the test dependency up to date with the latest bug fixes.\n- https://github.com/mockito/mockito/releases/tag/v5.23.0\n- https://github.com/mockito/mockito/releases/tag/v5.22.0\n  - https://github.com/mockito/mockito/issues/3778\n  - https://github.com/mockito/mockito/pull/3785\n\n### How was this patch tested?\n\nPass the CIs with the existing tests.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2585 from dongjoon-hyun/ORC-2135.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "b2dc0f8d20f512d3b8b6fed40bf1f4cf627cb98f",
      "tree": "92957df9b4059c07bfdb18b80ba40b0acc4fb96f",
      "parents": [
        "c23ed58a943a3f443c5541db9a6b450076791285"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 23:31:28 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 23:31:28 2026 -0700"
      },
      "message": "ORC-2134: Remove `microsoft/setup-msbuild` from GitHub Actions jobs\n\n### What changes were proposed in this pull request?\n\nRemove `microsoft/setup-msbuild` from GitHub Actions jobs.\n\n### Why are the changes needed?\n\nCurrently, the CI is broken because `microsoft/setup-msbuild` is no longer allowed by ASF Infra patterns.\n- https://github.com/apache/orc/actions/runs/23372953082\n\u003e microsoft/setup-msbuildv1.1 is not allowed in apache/orc because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: ...\n\nTechnically, the `windows-2025` runner already includes MSBuild in PATH, so the `microsoft/setup-msbuildv1.1` step is unnecessary.\n\n### How was this patch tested?\n\nPassed the existing GitHub Actions.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2584 from dongjoon-hyun/ORC-2134.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "c23ed58a943a3f443c5541db9a6b450076791285",
      "tree": "1452790b2f7c0898242420cedbce0c24d27fab6b",
      "parents": [
        "ebd9e98704c897190efc2293dd3626ed235873ea"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 22:28:30 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 22:28:30 2026 -0700"
      },
      "message": "ORC-2133: Remove `Super-Linter` from GitHub Actions jobs\n\n### What changes were proposed in this pull request?\n\nRemove `Super-Linter` from GitHub Actions jobs.\n\n### Why are the changes needed?\n\n`Super-Linter` is no longer allowed by ASF Infra patterns.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2582 from dongjoon-hyun/ORC-2133.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    }
  ],
  "next": "ebd9e98704c897190efc2293dd3626ed235873ea"
}