)]}'
{
  "log": [
    {
      "commit": "3738b82366ba64cacae450e7e0e1702c66148afe",
      "tree": "25723cbef3398e601e16d8ce607e06d33cc79200",
      "parents": [
        "da33ff031472561788d7bc70a6395927ef07cd01"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jul 22 10:12:14 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jul 22 10:12:14 2026 +0800"
      },
      "message": "ORC-2213: [C++] Add option to read timestamps with writer timezone\n\n### What changes were proposed in this pull request?\n\nAdd a RowReaderOptions flag that lets timestamp readers use the writer timezone recorded in each stripe footer instead of the configured reader timezone. This preserves the stored timestamp value for callers that need to avoid ORC timestamp timezone conversion.\n\n### Why are the changes needed?\n\nIn old days, ORC only supports orc::TIMESTAMP type. The semantics of orc::TIMESTAMP is equivalent to TIMESTAMP_NTZ but with a complex writer and reader timezone adjustment.  So it is difficult to support both TIMESTAMP_NTZ and TIMESTAMP_LTZ types using a single orc::TIMESTAMP. In later versions, orc::TIMESTAMP_INSTANT has been added to support TIMESTAMP_LTZ type. However, users may not know the difference under the hood and still use legacy systems to write both TIMESTAMP_LTZ and TIMESTAMP_NTZ semantics to the old orc::TIMESTAMP type. When users use orc::TIMESTAMP as TIMESTAMP_LTZ values, we should set reader timezone to the writer timezone to avoid value conversion. However, users may not know the writer timezone in advance and ORC files may have different writer timezone (considering files are produced by teams in different time zones.) We need an approach to enforce reader to use writer timezone via explicit configuration.\n\n### How was this patch tested?\n\nAdded a new test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Codex GPT-5.6 Sol\n\nCloses #2699 from wgtmac/ORC-2213.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "da33ff031472561788d7bc70a6395927ef07cd01",
      "tree": "01abc19b54a236a990b960093cbf97c9cd4cbb8d",
      "parents": [
        "a6f12fd5590963ee3d9f78b4e2785e595999a1d0"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 21 08:58:56 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 21 08:58:56 2026 -0700"
      },
      "message": "ORC-2210: Upgrade Spark to 4.2.0 and align Jackson, Avro, and Netty dependencies\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade Spark to 4.2.0 in `java/bench` module and align the Spark-related transitive dependencies.\n\n- `spark.version`: 4.2.0-preview2 -\u003e 4.2.0\n- `spark.jackson.version`: 2.21.4 -\u003e 2.21.2 (**Note that this is a downgrade to match**)\n- `avro.version`: 1.12.0 -\u003e 1.12.1\n- `netty-all`: 4.2.10.Final -\u003e 4.2.13.Final\n\n### Why are the changes needed?\n\nApache Spark 4.2.0 is the official GA release which supersedes 4.2.0-preview2.\n- https://repo1.maven.org/maven2/org/apache/spark/spark-sql_2.13/4.2.0/\n\nThe Jackson, Avro, and Netty versions are aligned with Spark 4.2.0\u0027s dependencies.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2693\n\nCloses #2696 from dongjoon-hyun/ORC-2210.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "a6f12fd5590963ee3d9f78b4e2785e595999a1d0",
      "tree": "a5a2b450097eb1166266ae78840e590dd5aed3fd",
      "parents": [
        "bed0c371acaf312380d9d62bda49a9ff65bb7a94"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 13:03:44 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 13:03:44 2026 -0700"
      },
      "message": "ORC-2212: Fix AvroReader to handle java.time.Instant timestamps\n\n### What changes were proposed in this pull request?\n\nThis PR aims to fix `AvroReader.TimestampConverter` to handle `java.time.Instant` values produced by Avro 1.12.1.\n\n- The converter now accepts both `java.time.Instant` (Avro 1.12.1+) and `Long` (older behavior), extracting epoch milliseconds via `Instant.toEpochMilli()` while preserving the existing `nanos \u003d 0` behavior.\n\n### Why are the changes needed?\n\nStarting from Avro 1.12.1, decoding the `timestamp-millis` logical type returns a `java.time.Instant` instead of a raw `Long`. The existing converter cast the value directly to `Long`, causing a `ClassCastException` and breaking `java-bench-scan-test`:\n\n```\njava.lang.ClassCastException: class java.time.Instant cannot be cast to class java.lang.Long\n    at org.apache.orc.bench.core.convert.avro.AvroReader$TimestampConverter.convert(AvroReader.java:192)\n    at org.apache.orc.bench.core.convert.parquet.ParquetReader.nextBatch(ParquetReader.java:58)\n    at org.apache.orc.bench.core.convert.ScanVariants.run(ScanVariants.java:92)\n    at org.apache.orc.bench.core.Driver.main(Driver.java:64)\n```\n\nSince `timestamp-millis` has millisecond precision, an `Instant`\u0027s sub-millisecond nanoseconds are always zero, so keeping `nanos \u003d 0` preserves the previous observable behavior.\n\n### How was this patch tested?\n\nPass the CIs, including the previously failing `java-bench-scan-test`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2698 from dongjoon-hyun/ORC-2212.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "bed0c371acaf312380d9d62bda49a9ff65bb7a94",
      "tree": "22bc3e7bad4c8f195f4a057169e307ee9a90800d",
      "parents": [
        "0b18b320bfdd5769fa1ed4618ff697c5f97a1e8b"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 11:06:31 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 11:06:31 2026 -0700"
      },
      "message": "ORC-2211: Use `javadoc.io` links in Maven Javadoc configuration\n\n### What changes were proposed in this pull request?\n\nThis PR aims to use `javadoc.io` links in the Maven Javadoc plugin configuration instead of the removed `orc.apache.org/api` links, and to remove the obsolete `\u003cofflineLinks\u003e` block.\n\n### Why are the changes needed?\n\nSince the website stopped hosting Javadoc under `orc.apache.org/api` (ORC-2207), the `Javadoc generation` CI job fails on all PRs.\n\n- https://github.com/apache/orc/actions/runs/29601757265/job/87955299789\n\n```\n[ERROR] error: Error fetching URL: https://orc.apache.org/api/orc-core/ (java.io.FileNotFoundException: https://orc.apache.org/api/orc-core/package-list)\n```\n\n### How was this patch tested?\n\nManually ran the same commands as the `Javadoc generation` CI job and verified `BUILD SUCCESS`.\n\n```\ncd java\n./mvnw install -DskipTests\n./mvnw javadoc:javadoc\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2697 from dongjoon-hyun/ORC-2211.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "0b18b320bfdd5769fa1ed4618ff697c5f97a1e8b",
      "tree": "0832bb05cfbb06cbfe9901780d391a29ad5fa89f",
      "parents": [
        "661a40e8371fb94216c3e1e95e08d419582e018e"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 09:44:43 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 09:44:43 2026 -0700"
      },
      "message": "ORC-2209: Upgrade `site` Docker image to Ubuntu 26.04\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade the base image of `site/Dockerfile` from `ubuntu:24.04` to `ubuntu:26.04`.\n\n### Why are the changes needed?\n\nUbuntu 26.04 LTS is the latest LTS release. This allows the ORC site builder image to use the newer toolchain and receive the latest security updates.\n\n### How was this patch tested?\n\nBuild the site Docker image manually.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2695 from dongjoon-hyun/ORC-2209.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "661a40e8371fb94216c3e1e95e08d419582e018e",
      "tree": "f6eec73799a6cf3bcaafc69869da38570535a2f7",
      "parents": [
        "98af9fc2b3ec1b2c4a11a6ecfacdd02ffb7627e6"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 08:42:45 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 17 08:42:45 2026 -0700"
      },
      "message": "ORC-2208: Update Python documentation with PyArrow 25.0.0, Pandas 3.0.3, and Dask 2026.7.1\n\n### What changes were proposed in this pull request?\n\nThis PR aims to update Python documentation with PyArrow 25.0.0, Pandas 3.0.3, and Dask 2026.7.1.\n\nIn addition, the expected outputs of the PyArrow and Pandas examples are updated because\nPandas 3.x displays missing string values as `NaN` instead of `None`.\n\n### Why are the changes needed?\n\nTo provide an up-to-date Python documentation.\n\n### How was this patch tested?\n\nManually tested with `Python 3.14.6`.\n\n```\n$ pip3 install pyarrow\u003d\u003d25.0.0\n$ pip3 install pandas\u003d\u003d3.0.3\n$ pip3 install \"dask[dataframe]\u003d\u003d2026.7.1\"\n```\n\nAll examples in `pyarrow.md`, `pandas.md`, and `dask.md` were executed and the outputs were verified.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2694 from dongjoon-hyun/ORC-2208.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "98af9fc2b3ec1b2c4a11a6ecfacdd02ffb7627e6",
      "tree": "9375cce19e586b494bc19b3e6ed76ab24784500a",
      "parents": [
        "7694e1ce559a8727ef065517dcb9a650536c5992"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:55:38 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:55:38 2026 -0700"
      },
      "message": "Add news for 2.3.1\n"
    },
    {
      "commit": "7694e1ce559a8727ef065517dcb9a650536c5992",
      "tree": "5ad478c011ca8b7b050988080da3e1465b25afdf",
      "parents": [
        "f7b93abbdc4a557ff2bcdb17764a2cb48ff6721c"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:16:27 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:16:27 2026 -0700"
      },
      "message": "Forward `/api` to `javadoc.io`\n"
    },
    {
      "commit": "f7b93abbdc4a557ff2bcdb17764a2cb48ff6721c",
      "tree": "f64efdd2c41927b97edeacf4e63d9ca3df902ab0",
      "parents": [
        "5f34b04a42180398a0fca53fcf95a5c956fb7e9c"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:10:58 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 16 14:10:58 2026 -0700"
      },
      "message": "ORC-2207: Use `javadoc.io` links in `site` docs\n\n### What changes were proposed in this pull request?\n\nThis PR replaces the relative javadoc links under `site/` with absolute `javadoc.io` URLs, e.g.\n\n- Before: `/api/orc-core/index.html?org/apache/orc/OrcFile.html`\n- After: `https://javadoc.io/doc/org.apache.orc/orc-core/latest/org/apache/orc/OrcFile.html`\n\nAll 22 links in `site/_docs/core-java.md`, `site/_docs/mapred.md`, and `site/_docs/mapreduce.md` are converted.\n\n### Why are the changes needed?\n\nThe relative `/api/` links depend on javadoc being published alongside the website. Linking to `javadoc.io` points at the published artifact javadoc directly.\n\n### How was this patch tested?\n\nManual verification; documentation-only change. `grep -rn \"/api/\" site/` returns no matches.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2692 from dongjoon-hyun/ORC-2207.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "5f34b04a42180398a0fca53fcf95a5c956fb7e9c",
      "tree": "973f61ae05dce49dbeff1cfeb00be56aa2b67a6c",
      "parents": [
        "d1f9ffde46120bad06541f7fd980d5646d1f6cf9"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Jul 12 22:08:15 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 12 22:08:15 2026 -0700"
      },
      "message": "ORC-2205: Upgrade `spotless-maven-plugin` to 3.8.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.7.0 to 3.8.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.8.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for custom string format for license header copyright year via \u003ccode\u003eyearStringFormat()\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2965\"\u003e#2965\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;expandWildcardImports\u0026gt;\u003c/code\u003e no longer triggers a full transitive dependency resolution on every build. Dependency resolution is now deferred until the step actually runs, so projects that do not use \u003ccode\u003e\u0026lt;expandWildcardImports\u0026gt;\u003c/code\u003e (or that use version ranges) are no longer penalized. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2983\"\u003e#2983\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003espotless-lib and spotless-lib-extra releases\u003c/h1\u003e\n\u003cp\u003eIf you are a Spotless user (as opposed to developer), then you are probably looking for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis document is intended for Spotless developers.\u003c/p\u003e\n\u003cp\u003eWe adhere to the \u003ca href\u003d\"https://keepachangelog.com/en/1.0.0/\"\u003ekeepachangelog\u003c/a\u003e format (starting after version \u003ccode\u003e1.27.0\u003c/code\u003e).\u003c/p\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[4.8.0] - 2026-06-29\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for custom string format for license header copyright year via \u003ccode\u003eyearStringFormat()\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2965\"\u003e#2965\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.7.0] - 2026-06-16\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflexmark\u003c/code\u003e step now supports arbitrary formatter options via a \u003ccode\u003eformatterOptions\u003c/code\u003e map. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eFenceStep.preserveWithin\u003c/code\u003e now forwards lints from nested steps while still suppressing lints inside preserved blocks. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSupport \u003ccode\u003ektfmt\u003c/code\u003e 0.63 and use its new builder API for formatting options to better avoid future breaking changes.\u003c/li\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where copyright year is surrounded by whitespace. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003egreclipse\u003c/code\u003e version to latest \u003ccode\u003e4.35\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.39\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2924\"\u003e#2924\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.2] - 2026-05-27\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eP2Provisioner\u003c/code\u003e now passes cache directory overrides directly to Solstice. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eforbidWildcardImports\u003c/code\u003e and \u003ccode\u003eforbidModuleImports\u003c/code\u003e now detect imports that have leading whitespace (indentation/tabs). (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2939\"\u003e#2939\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eversionCatalog\u003c/code\u003e step no longer splits long inline tables across multiple lines — Gradle\u0027s TOML 1.0 parser cannot read multi-line inline tables. The \u003ccode\u003emaxLineLength\u003c/code\u003e option has been removed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2948\"\u003e#2948\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eEclipseJdtFormtterStep\u003c/code\u003e now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFormatter\u003c/code\u003e no longer recomputes line-ending normalization (\u003ccode\u003eLineEnding.toUnix\u003c/code\u003e) a second time for every formatter step that changes content, removing redundant O(n) work from the core formatting loop. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2934\"\u003e#2934\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eexpandWildcardImports support pom type dependency. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2839\"\u003e#2839\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.1] - 2026-05-15\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eLicenseHeaderStep\u003c/code\u003e in \u003ccode\u003eSET_FROM_GIT\u003c/code\u003e year mode no longer invokes \u003ccode\u003egit log\u003c/code\u003e through \u003ccode\u003ebash -c\u003c/code\u003e / \u003ccode\u003ecmd /c\u003c/code\u003e, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.0] - 2026-05-14\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003escalafmt()\u003c/code\u003e now reads the version from the \u003ccode\u003eversion\u003c/code\u003e field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2922\"\u003e#2922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eversionCatalog\u003c/code\u003e step for formatting and sorting Gradle version catalog (\u003ccode\u003e.toml\u003c/code\u003e) files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2916\"\u003e#2916\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ejavaparserVersion\u003c/code\u003e option to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/03d43ba2cdc81050e07b62646c08b22e39505368\"\u003e\u003ccode\u003e03d43ba\u003c/code\u003e\u003c/a\u003e Published maven/3.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/8b80c1388017f9b390fd9681007ba58a8c5d77f7\"\u003e\u003ccode\u003e8b80c13\u003c/code\u003e\u003c/a\u003e Published gradle/8.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/8ee6cf904ae77a4baec287132c69a63d4b5f4052\"\u003e\u003ccode\u003e8ee6cf9\u003c/code\u003e\u003c/a\u003e Published lib/4.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/6c02c0bf3fa0914206b28b2e9abec5e2061273e4\"\u003e\u003ccode\u003e6c02c0b\u003c/code\u003e\u003c/a\u003e Add missing changelog entry.\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/264f4cc904ad85149a90822c0835c17a615cee8e\"\u003e\u003ccode\u003e264f4cc\u003c/code\u003e\u003c/a\u003e Add regression test for forbidWildcardImports inside toggleOffOn (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2982\"\u003e#2982\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/6abb06449354899642d716dfb3daf67a888bac9b\"\u003e\u003ccode\u003e6abb064\u003c/code\u003e\u003c/a\u003e fix \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2983\"\u003e#2983\u003c/a\u003e, expandWildcardImports triggers a full transitive reso… (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2984\"\u003e#2984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/f4536d41caebdda8201cdb126832ea96a75e5afe\"\u003e\u003ccode\u003ef4536d4\u003c/code\u003e\u003c/a\u003e Update plugin spotbugs to v6.5.8 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2987\"\u003e#2987\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/873454acbc24dd66a0d334f29b30d5dcb645cd0a\"\u003e\u003ccode\u003e873454a\u003c/code\u003e\u003c/a\u003e Update plugin spotbugs to v6.5.8\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/000b8a8f9f0398f60aeafee4d2fbd90a6a61b7f1\"\u003e\u003ccode\u003e000b8a8\u003c/code\u003e\u003c/a\u003e Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2985\"\u003e#2985\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/84ebcab6a588c0ae7ddb8d883f5f60947e488e0a\"\u003e\u003ccode\u003e84ebcab\u003c/code\u003e\u003c/a\u003e Update dependency org.junit.jupiter:junit-jupiter to v6.1.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.7.0...maven/3.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.7.0\u0026new-version\u003d3.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2688 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.8.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "d1f9ffde46120bad06541f7fd980d5646d1f6cf9",
      "tree": "b19d99355281f930bb744478ea4fd9995728fa2e",
      "parents": [
        "fb922ea1cd9eeb1e2266329fd4b98d4afd65d671"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 16:03:58 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 16:03:58 2026 -0700"
      },
      "message": "ORC-2206: Add `publish_image.yml` GitHub Action job to publish docker images\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add a new GitHub Actions workflow, `publish_image.yml`, to publish the docker test images under the `docker` directory to Docker Hub as `apache/orc-dev:\u003cos\u003e`.\n\n- The workflow is triggered manually via `workflow_dispatch` with a JSON list input of OSes to publish. By default, all seven OSes are published: `amazonlinux23`, `debian13`, `oraclelinux10`, `oraclelinux9`, `ubi10`, `ubuntu24`, `ubuntu26`.\n- Multi-architecture images (`linux/amd64`, `linux/arm64`) are built via QEMU and Docker Buildx with GitHub Actions cache.\n- The workflow checks out the `main` branch and runs only on the `apache/orc` repository.\n\n### Why are the changes needed?\n\nApache ORC community provides pre-built docker images at https://hub.docker.com/r/apache/orc-dev/tags and uses them during testing. This workflow allows us to publish the images via GitHub Actions instead of building and pushing them manually.\n\n### How was this patch tested?\n\nManual review because this is a `workflow_dispatch`-triggered workflow which runs only on the `apache/orc` repository.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2689 from dongjoon-hyun/ORC-2206.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "fb922ea1cd9eeb1e2266329fd4b98d4afd65d671",
      "tree": "a9b64c5512f8f64969cb062e12b992bf33591786",
      "parents": [
        "211ffab213512120744654073da129065c0311e8"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 14:24:34 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 14:24:34 2026 -0700"
      },
      "message": "ORC-2204: Use `amazonlinux:2023` instead of a dated snapshot tag\n\n### What changes were proposed in this pull request?\n\nThis PR aims to use the rolling `amazonlinux:2023` tag instead of a dated snapshot tag in the `amazonlinux23` docker image.\n\n### Why are the changes needed?\n\nThis is consistent with the other docker images which use rolling tags, e.g., `oraclelinux:9`, `ubuntu:24.04`, and `ubi10`.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2687 from dongjoon-hyun/ORC-2204.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "211ffab213512120744654073da129065c0311e8",
      "tree": "22c0aa53b87672a7d2880b4d07fd76ee89836af7",
      "parents": [
        "df1c54b5b93bfc98ced4a878c589ddc0bbd91147"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 13:23:51 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 13:23:51 2026 -0700"
      },
      "message": "ORC-2203: Remove unused variables in docker/run-all.sh\n\n### What changes were proposed in this pull request?\n\nThis PR aims to remove unused variable assignments (`URL`, `CLONE`, `MAKEDIR`, `VOLUME`) from `docker/run-all.sh`.\n\n### Why are the changes needed?\n\nThese variables are leftovers from before the per-OS build logic was extracted into `docker/run-one.sh`, which defines and uses its own `CLONE`/`MAKEDIR`/`VOLUME`. In `run-all.sh`, they are never referenced; the build loop invokes `./run-one.sh $1 $2 $build` with the positional arguments directly. `URL` is also removed because it was only referenced by the unused `CLONE`. The `GITHUB_USER\u003d$1` and `BRANCH\u003d$2` assignments are kept as documentation of the expected arguments.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2686 from dongjoon-hyun/ORC-2203.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "df1c54b5b93bfc98ced4a878c589ddc0bbd91147",
      "tree": "14e65daa07f702c0e3ccfbb6ff5ad2f45358d215",
      "parents": [
        "7ae93748078d7c5d481c17d53548d6bf1c00153d"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 11:15:25 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jul 10 11:15:25 2026 -0700"
      },
      "message": "ORC-2202: Use `debian:13` instead of `13.1` in `docker/debian13/Dockerfile`\n\n### What changes were proposed in this pull request?\n\nThis PR aims to use `debian:13` instead of `debian:13.1` in `docker/debian13/Dockerfile`.\n\n### Why are the changes needed?\n\nDebian 13 has moved past the `13.1` point release, so the pinned tag no longer tracks the latest point releases. Using the `debian:13` tag keeps the image up to date automatically and is consistent with the other OS Dockerfiles (`ubuntu:24.04`, `oraclelinux:9`, `oraclelinux:10`), as well as the previous Debian Dockerfiles which used floating codename tags (`debian:bullseye`, `debian:bookworm`).\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2685 from dongjoon-hyun/ORC-2202.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "7ae93748078d7c5d481c17d53548d6bf1c00153d",
      "tree": "a3b3b66e610ea05e60fb62fed3c64c6282e38ce0",
      "parents": [
        "1c441dc9a68f94071c8ecac622b9eefd99d81153"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 09 23:40:04 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Jul 09 23:40:04 2026 -0700"
      },
      "message": "ORC-2201: Update `docker/README.md` to match the current docker test environment\n\n### What changes were proposed in this pull request?\n\nThis PR aims to update `docker/README.md` to match the current contents of the `docker/` directory.\n\n1. Update the supported OS list to match `docker/os-list.txt`: remove `Fedora 37` (removed in ORC-1915) and add `UBI 10` (added in ORC-2121).\n2. Replace the stale statement that the scripts test both JDK 17 and 21 across OSes. Each OS image now uses a single JDK version: JDK 17 (`oraclelinux9`, `amazonlinux23`), JDK 21 (`debian13`, `ubuntu24`, `oraclelinux10`), and JDK 25 (`ubuntu26`, `ubi10`).\n3. Fix the base image build example to match the actual tagging used by `reinit.sh` (`apache/orc-dev:$os`), and note that `debian13`/`ubuntu24`/`ubuntu26` accept a `--build-arg jdk\u003dN` to change the JDK version.\n\n### Why are the changes needed?\n\nThe README is out of sync with the actual docker test environment and misleads contributors who run the docker-based tests.\n\n### How was this patch tested?\n\nManually verified against `docker/os-list.txt`, `docker/reinit.sh`, and each `docker/*/Dockerfile`. Also checked with `markdownlint docker/README.md` (no warnings).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2684 from dongjoon-hyun/ORC-2201.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1c441dc9a68f94071c8ecac622b9eefd99d81153",
      "tree": "5d2c454eab9406c095a75c493ff7f1c473b8f205",
      "parents": [
        "30f8e242a4fcbebb306b1469cb2128be0915b990"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 23:26:24 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 23:26:24 2026 -0700"
      },
      "message": "ORC-2200: Validate stripe offset/index/data/footer lengths in the Java reader\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate stripe `offset`/`indexLength`/`dataLength`/`footerLength` in the Java reader before reading a stripe, like the C++ reader (`RowReaderImpl::startNextStripe`). `RecordReaderImpl` now throws `FileFormatException` if any value is negative, `footerLength` exceeds `Integer.MAX_VALUE`, or the sum overflows or exceeds the file length.\n\n### Why are the changes needed?\n\nA crafted `StripeInformation` could cause a `NegativeArraySizeException`, a huge allocation, or a read at a bogus offset. This matches the existing C++ reader validation.\n\n### How was this patch tested?\n\nPass the CIs with the newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2683 from dongjoon-hyun/ORC-2200.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "30f8e242a4fcbebb306b1469cb2128be0915b990",
      "tree": "ae7d05d7725044eff949a2309daafd9bfb77b8b0",
      "parents": [
        "f769ad79ad58da1227500164f8848f13ae663b15"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 22:36:46 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 22:36:46 2026 -0700"
      },
      "message": "Add news for 1.9.9\n"
    },
    {
      "commit": "f769ad79ad58da1227500164f8848f13ae663b15",
      "tree": "45f74be5bfb9f597e4d3745d4fed8b60d3a79825",
      "parents": [
        "5f2855dcf81a3dc2aec73b58571d5c58d0cec305"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 21:19:42 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 21:19:42 2026 -0700"
      },
      "message": "ORC-2199: Validate union tag against the number of children in `UnionTreeReader`\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate the union tag against the number of children in `UnionTreeReader`.\n\nBoth the `nextVector` and `skipRows` paths now check that each tag read from the `DATA` stream is within `[0, fields.length)` and throw `FileFormatException` with a clear message, consistent with the C++ reader\u0027s `getCheckedUnionTag`.\n\n### Why are the changes needed?\n\nThe Java `UnionTreeReader` used the raw tag byte from the `DATA` stream without validation. For a corrupt or malicious file with a tag greater than or equal to the number of union children (or a negative sign-extended byte), `skipRows` fails with `ArrayIndexOutOfBoundsException` and `nextVector` propagates the invalid tag downstream. The C++ reader already rejects this via `getCheckedUnionTag` (`ParseError`), so this closes a C++/Java parity gap.\n\n### How was this patch tested?\n\nPass the CIs with a newly added `TestTreeReaderFactory`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2682 from dongjoon-hyun/ORC-2199.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "5f2855dcf81a3dc2aec73b58571d5c58d0cec305",
      "tree": "e89a79ae8ff660fd39855780fcb30e942a0cbd81",
      "parents": [
        "f158e147b46013a3b0b12f5899a3280559a5aa47"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 19:30:36 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 19:30:36 2026 -0700"
      },
      "message": "ORC-2198: Validate stream offset+length against stripe data boundary in StripePlanner\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate each stream\u0027s `offset + length` against the stripe data boundary in the Java `StripePlanner`, throwing `FileFormatException` when a stream overflows or exceeds the stripe\u0027s index+data region.\n\n### Why are the changes needed?\n\nThis closes a C++/Java reader parity gap. The C++ reader already rejects such streams in `StripeStreamsImpl::getStream` by computing `dataEnd \u003d stripeOffset + indexLength + dataLength`, while the Java `StripePlanner.handleStream` accumulated `currentOffset +\u003d stream.getLength()` with no bound check. Since `stream.getLength()` is an untrusted protobuf `uint64`, a crafted stripe footer could drive reads outside the stripe region.\n\n### How was this patch tested?\n\nPass the CIs with the newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2681 from dongjoon-hyun/ORC-2198.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f158e147b46013a3b0b12f5899a3280559a5aa47",
      "tree": "8affd0f02be7af5b89e50881a64eac1c8e481c50",
      "parents": [
        "11f07f665eaf64e9c85c60870813096e4fb7effc"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 17:22:29 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 17:22:29 2026 -0700"
      },
      "message": "ORC-2197: Reject negative decoded dictionary entry length in Java string dictionary reader\n\n### What changes were proposed in this pull request?\n\nThis PR aims to reject a negative decoded dictionary entry length in the Java string dictionary reader by throwing a `FileFormatException` in `StringDictionaryTreeReader.readDictionaryLengthStream`.\n\n### Why are the changes needed?\n\nA corrupt file can encode a negative entry length in the LENGTH stream, making `dictionaryOffsets` non-monotonic and causing `setRef` to receive a negative length. The C++ reader already rejects this case (`DictionaryLoader.cc`), so this restores C++/Java reader parity.\n\n### How was this patch tested?\n\nPass the CIs with a newly added test case, `TestStringDictionaryTreeReader#testNegativeDictionaryEntryLength`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2680 from dongjoon-hyun/ORC-2197.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "11f07f665eaf64e9c85c60870813096e4fb7effc",
      "tree": "c8d2629d5630c5dd914df22fa113bf51038d3bcf",
      "parents": [
        "6770bce9fcfcbcfe3f541f980c7e880faa077ddd"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 16:14:06 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 08 16:14:06 2026 -0700"
      },
      "message": "ORC-2196: [C++] Validate type tree when creating reader from serialized file tail\n\n### What changes were proposed in this pull request?\n\nThis PR aims to validate the ORC type tree in `createReader` when the footer comes from a serialized file tail (`ReaderOptions.setSerializedFileTail`), by calling the existing `checkProtoTypes` in the same way as the file-read path.\n\n### Why are the changes needed?\n\nThe serialized-file-tail branch of `createReader` builds `contents-\u003efooter` directly from the parsed `proto::FileTail` without validation. A malformed footer with an out-of-range or back-referencing subtype flows into `convertType`, causing an out-of-bounds read or unbounded recursion (stack overflow) in release builds.\n\nThe file-read path already validates via `checkProtoTypes`, and the Java reader validates both tail paths (`OrcTail` and `ReaderImpl`). This closes the remaining C++ parity gap.\n\n### How was this patch tested?\n\nPass the CIs with a newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2679 from dongjoon-hyun/ORC-2196.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "6770bce9fcfcbcfe3f541f980c7e880faa077ddd",
      "tree": "a0b5ed75b7c488b7f5c0373e099535fb78f98caf",
      "parents": [
        "d92d9434d30d508b36abddcc8ec60824e6c4f54f"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 21:07:50 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 21:07:50 2026 -0700"
      },
      "message": "ORC-2195: Upgrade `lz4-java` to 1.11.1\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `at.yawk.lz4:lz4-java` to 1.11.1.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes from the following release.\n\n- https://github.com/yawkat/lz4-java/releases/tag/v1.11.1 (2026-07-06)\n  - [Native XXHash implementations can crash the JVM when passed invalid byte array ranges](https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r)\n\n### Does this PR introduce _any_ user-facing change?\n\nNo.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2676 from dongjoon-hyun/ORC-2195.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "d92d9434d30d508b36abddcc8ec60824e6c4f54f",
      "tree": "ce365243c2d86ec67ae2459cf7da4e3489ced02c",
      "parents": [
        "6015de56d279fce23cb6539a003afbe1752f7909"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 16:55:55 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 16:55:55 2026 -0700"
      },
      "message": "ORC-2191: Reject overflowing PostScript tail lengths in ReaderImpl\n\n### What changes were proposed in this pull request?\n\nThis PR validates the PostScript tail lengths in `ReaderImpl.extractFileTail` before they are cast\nfrom `long` to `int`, throwing `FileFormatException` when `footerLength`, `metadataLength`,\n`stripeStatisticsLength`, or their sum is negative or exceeds the file length / `Integer.MAX_VALUE`.\nIt is the Java counterpart of the C++ overflow checks in ORC-2167.\n\n### Why are the changes needed?\n\nThese fields are protobuf `uint64` read as Java `long`. A malformed value near `UINT64_MAX` or above\n2GB would truncate/overflow on the `int` cast into a bogus offset or allocation size instead of a\nclear error. Per the ORC threat model this is a fail-fast robustness fix, not a CVE.\n\n### How was this patch tested?\n\nAdded `TestReaderImpl.testMalformedTailLengthOverflow`, which crafts files with tail lengths of\n`2^31`, `2^32`, and `UINT64_MAX` and asserts `OrcFile.createReader` throws `FileFormatException`.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2672 from dongjoon-hyun/ORC-2191.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "6015de56d279fce23cb6539a003afbe1752f7909",
      "tree": "9916b62c2fece04cef512038703045ae264b6ddc",
      "parents": [
        "3cfa07321927eedc48c86bf3b8aadf45721fcbb6"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 15:52:17 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 15:52:17 2026 -0700"
      },
      "message": "ORC-2190: [C++] Reject compressed chunk length exceeding block size in C++ reader\n\n### What changes were proposed in this pull request?\n\nThis PR makes the ORC C++ reader reject a compressed chunk whose length exceeds the configured\ncompression block size, matching the Java reader.\n\nhttps://github.com/apache/orc/blob/5d3cf1318b58416719e89169ae9d56f758311f7e/java/core/src/java/org/apache/orc/impl/InStream.java#L504-L507\n\n### Why are the changes needed?\n\nThe Java reader already performs this check in `InStream.CompressedStream.readHeader`, but the C++\nreader was missing it. This is a defense-in-depth hardening (not a CVE): the chunk length is already\nbounded to ~8MB by the 3-byte header, but the spec-mandated first check was absent on the C++ side.\nWell-formed files are unaffected.\n\n### How was this patch tested?\n\nPass the CIs with the newly added test case.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2671 from dongjoon-hyun/ORC-2190.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "3cfa07321927eedc48c86bf3b8aadf45721fcbb6",
      "tree": "d56a083c15621b2236ca53df25336e602e857191",
      "parents": [
        "3b3f227d478f92e98906e4669466e3ef1ffef6c2"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 14:47:14 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 14:47:14 2026 -0700"
      },
      "message": "ORC-2194: Remove `Debian 12` support\n\n### What changes were proposed in this pull request?\n\nThis PR aims to remove `Debian 12` support from Apache ORC 3.0.0.\n\n### Why are the changes needed?\n\n`Debian 12` reaches its end-of-life on 2026-07-11.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2675 from dongjoon-hyun/ORC-2194.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "3b3f227d478f92e98906e4669466e3ef1ffef6c2",
      "tree": "f35e22a9c50a211e63d535654e9f24098612d52a",
      "parents": [
        "1ce1786b49c8af0ae21e2db4ef0e6526c5824f2a"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:40:04 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:40:04 2026 -0700"
      },
      "message": "ORC-2192: [C++] Reject invalid string length in StringDirectColumnReader\n\n### What changes were proposed in this pull request?\n\nThis PR adds validation to `StringDirectColumnReader::computeSize` in the C++ reader so a negative or overflowing string length throws `ParseError` before any blob is allocated. Both callers (`next` and `skip`) are covered, and since `buildReader` routes all direct-encoded string-family types to this reader, the single guard protects `BINARY`/`CHAR`/`STRING`/`VARCHAR`/`GEOMETRY`/`GEOGRAPHY`.\n\n### Why are the changes needed?\n\nThe LENGTH stream is decoded as unsigned RLE, so a malformed file can encode a varint `\u003e\u003d 2^63` that becomes a negative `int64_t`. Cast to `size_t`, this triggers a huge `blob.resize()` and an out-of-bounds pointer walk. This restores parity with the Java reader, which already guards this path in `BytesColumnVectorUtil.commonReadByteArrays`.\n\nhttps://github.com/apache/orc/blob/1ce1786b49c8af0ae21e2db4ef0e6526c5824f2a/java/core/src/java/org/apache/orc/impl/TreeReaderFactory.java#L2087-L2098\n\n### How was this patch tested?\n\nAdded `TestColumnReader.testStringDirectNegativeLength`, which feeds a crafted LENGTH stream decoding to `INT64_MIN` and asserts `ParseError` is thrown.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2673 from dongjoon-hyun/ORC-2192.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1ce1786b49c8af0ae21e2db4ef0e6526c5824f2a",
      "tree": "236f2d7f7c0f9afd6d6ddaaab056fbf4a0057671",
      "parents": [
        "5d3cf1318b58416719e89169ae9d56f758311f7e"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:36:30 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jul 07 13:36:30 2026 -0700"
      },
      "message": "ORC-2193: Parse encrypted FileStatistics via createCodedInputStream\n\n### What changes were proposed in this pull request?\n\nThis PR makes the encrypted `FileStatistics` parsing path in the Java reader consistent with all other protobuf parse paths by wrapping it with `InStream.createCodedInputStream(...)`.\n\n### Why are the changes needed?\n\nEvery other protobuf parse path in the reader (footer, metadata, stripe footer, row index, bloom filter, columnar stripe stats) goes through `createCodedInputStream`, which applies `setSizeLimit(1 GB)`. This was the only exception, so this aligns it for consistency. It is not a security fix: the input is an already-bounded in-memory sub-message from the footer.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2674 from dongjoon-hyun/ORC-2193.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "5d3cf1318b58416719e89169ae9d56f758311f7e",
      "tree": "6aad7155172bc8de906ee9e6741ebff564b7e91a",
      "parents": [
        "28199d72fbf54a10d485728a29e7f53dedd3d6da"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:16:12 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:16:12 2026 -0700"
      },
      "message": "ORC-2188: Reject invalid compression block size in PostScript\n\n### What changes were proposed in this pull request?\n\nThis PR aims to reject invalid PostScript `compressionBlockSize` values at file open in both C++ and Java readers. If the field is present and the value is `0` or `\u003e\u003d 2^23 (8MB)`, the readers now throw `ParseError` (C++) / `FileFormatException` (Java) with the message `Invalid compression block size: N`. A missing field keeps the existing 256KB default.\n\n- **C++**: check added in `getCompressionBlockSize` (`Reader.cc`), which covers all open paths.\n- **Java**: new `ReaderImpl.checkCompressionBlockSize` helper, called from `extractPostScript`, the `OrcTail` constructor branch, and the deprecated `extractFileTail(ByteBuffer)`.\n\n### Why are the changes needed?\n\nBoth writers already enforce `compressionBlockSize \u003c 2^23` because the compressed chunk header stores the length in 23 bits, but the readers used the value without validation. Applying the same bound at read time fails fast without affecting any legitimate file.\n\n### How was this patch tested?\n\nPass the CIs with newly added test cases.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2650\n\nCloses #2662 from dongjoon-hyun/ORC-2188.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "28199d72fbf54a10d485728a29e7f53dedd3d6da",
      "tree": "6989544d00df88da42b2fbd4ee6187c8f93c7f24",
      "parents": [
        "9b89ad3e168c3b18d9de93abc69af0563f84ea79"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:11:22 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 03:11:22 2026 -0700"
      },
      "message": "ORC-2189: Add `URL_HASH` to all third-party dependencies in `ThirdpartyToolchain.cmake`\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add `URL_HASH` (SHA256) to all third-party dependencies declared via `fetchcontent_declare` in `cmake_modules/ThirdpartyToolchain.cmake`.\n\n### Why are the changes needed?\n\nTo verify the integrity of the downloaded archives and fail the build explicitly on any checksum mismatch.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2663 from dongjoon-hyun/ORC-2189.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "9b89ad3e168c3b18d9de93abc69af0563f84ea79",
      "tree": "9eaadb2fc479b78c4322cba9a8995bbb50ea599c",
      "parents": [
        "7cc86ec686b4edcdb3c4d641ae362f101d4c8015"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 02:06:09 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sun Jul 05 02:06:09 2026 -0700"
      },
      "message": "ORC-2187: Set protobuf message size limit in C++ reader\n\n### What changes were proposed in this pull request?\n\nThis PR caps the size of protobuf messages parsed from ORC file contents in the C++ reader, matching the Java reader.\n\n### Why are the changes needed?\n\nThe Java reader already caps protobuf message size at 1 GB, but the C++ reader parsed with no limit.\n\nhttps://github.com/apache/orc/blob/7cc86ec686b4edcdb3c4d641ae362f101d4c8015/java/core/src/java/org/apache/orc/impl/InStream.java#L45\n\nhttps://github.com/apache/orc/blob/7cc86ec686b4edcdb3c4d641ae362f101d4c8015/java/core/src/java/org/apache/orc/impl/InStream.java#L922\n\n`SetTotalBytesLimit` has the same mechanism with `InStream.setSizeLimit`.\n\n### How was this patch tested?\n\nPass the existing C++ tests (`orc-test`).\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Fable 5\n\nCloses #2661 from dongjoon-hyun/ORC-2187.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "7cc86ec686b4edcdb3c4d641ae362f101d4c8015",
      "tree": "39ea103671e5e227f73c4f12288260c900e22f51",
      "parents": [
        "2007cf5f5ab9111374d8a8fc1d4b08dc4740e9fc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Jul 04 23:10:42 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 23:10:42 2026 -0700"
      },
      "message": "ORC-2186: Upgrade `spotbugs-maven-plugin` to 4.10.2.0\n\nBumps [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.9.8.3 to 4.10.2.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/releases\"\u003ecom.github.spotbugs:spotbugs-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eSpotbugs Maven Plugin 4.10.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport spotbugs 4.10.2\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate ci.yaml by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1429\"\u003espotbugs/spotbugs-maven-plugin#1429\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate spotbugs.version to v4.10.2 by \u003ca href\u003d\"https://github.com/renovate\"\u003e\u003ccode\u003e​renovate\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1425\"\u003espotbugs/spotbugs-maven-plugin#1425\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.5...spotbugs-maven-plugin-4.10.2.0\"\u003ehttps://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.5...spotbugs-maven-plugin-4.10.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eSpotbugs Maven Plugin 4.9.8.5\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate README.md by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1426\"\u003espotbugs/spotbugs-maven-plugin#1426\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[fix] Toolchain used wrong flag name \u0027executable\u0027 instead of \u0027jvm\u0027 by \u003ca href\u003d\"https://github.com/hazendaz\"\u003e\u003ccode\u003e​hazendaz\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/pull/1428\"\u003espotbugs/spotbugs-maven-plugin#1428\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.4...spotbugs-maven-plugin-4.9.8.5\"\u003ehttps://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.4...spotbugs-maven-plugin-4.9.8.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eSpotbugs Maven Plugin 4.9.8.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebuild support for maven 4 with maven 4 plugins\u003c/li\u003e\n\u003cli\u003espotbugs extensions jars now moved to target/spotbugs instead of root\u003c/li\u003e\n\u003cli\u003enew spotbugs-aggregate mojo for multi module\u003c/li\u003e\n\u003cli\u003esupport maven toolchains\u003c/li\u003e\n\u003cli\u003eblock gui when environment is headless\u003c/li\u003e\n\u003cli\u003eall spotbug extensions as regular dependencies\u003c/li\u003e\n\u003cli\u003elearn to map spotbug extensions to their source project documentation\u003c/li\u003e\n\u003cli\u003ein auxiliary class path exclude java.* packages\u003c/li\u003e\n\u003cli\u003eimprove code coverage\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003enote: This release was done on older spotbugs (not the new 4.10.1) on purpose to keep these changes separate from that of spotbugs.  The spotbugs 4.10.1 support release will be available in a day or two and users can otherwise override the core module as there are no changes to be done internally.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/2d39b75b4c08fb520f936517783efd904bffc063\"\u003e\u003ccode\u003e2d39b75\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release spotbugs-maven-plugin-4.10.2.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/6c300e6fe4f69409b142a8bc8b4100ec3dc06384\"\u003e\u003ccode\u003e6c300e6\u003c/code\u003e\u003c/a\u003e [pom] Bump internal spotbugs to 4.9.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/250d68518dd97260380925c3cd30dcf53a0b38c0\"\u003e\u003ccode\u003e250d685\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1425\"\u003e#1425\u003c/a\u003e from spotbugs/renovate/spotbugs.version\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/12f6fb3c1539e294fa916644f614cd9a8edcc4d8\"\u003e\u003ccode\u003e12f6fb3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href\u003d\"https://redirect.github.com/spotbugs/spotbugs-maven-plugin/issues/1429\"\u003e#1429\u003c/a\u003e from spotbugs/hazendaz-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/aaf0a09933fd09c495187a412f9163a10955debe\"\u003e\u003ccode\u003eaaf0a09\u003c/code\u003e\u003c/a\u003e Update ci.yaml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/8b5dff48959c4a350b6f17ab74d2f5479cc3fece\"\u003e\u003ccode\u003e8b5dff4\u003c/code\u003e\u003c/a\u003e Merge branch \u0027master\u0027 into renovate/spotbugs.version\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/c83698dea617fa5f0cd81186ab717ae33c764c73\"\u003e\u003ccode\u003ec83698d\u003c/code\u003e\u003c/a\u003e Update pom.xml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/b8788fd3c210b91040393d9cc14a96d41aba7df0\"\u003e\u003ccode\u003eb8788fd\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/f758cb536ea3b7f72e1bf71156073799e0b347eb\"\u003e\u003ccode\u003ef758cb5\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release spotbugs-maven-plugin-4.9.8.5\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/commit/cec6af52b92791869e9320cf9a30d10468f3fab7\"\u003e\u003ccode\u003ecec6af5\u003c/code\u003e\u003c/a\u003e Update pom.xml\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.9.8.3...spotbugs-maven-plugin-4.10.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eMost Recent Ignore Conditions Applied to This Pull Request\u003c/summary\u003e\n\n| Dependency Name | Ignore Conditions |\n| --- | --- |\n| com.github.spotbugs:spotbugs-maven-plugin | [\u003c 4.8, \u003e 4.7.3.4] |\n\u003c/details\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.spotbugs:spotbugs-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d4.9.8.3\u0026new-version\u003d4.10.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2649 from dependabot[bot]/dependabot/maven/java/com.github.spotbugs-spotbugs-maven-plugin-4.10.2.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "2007cf5f5ab9111374d8a8fc1d4b08dc4740e9fc",
      "tree": "092d2967bd27045be9b6283f9abd8e043c3cc670",
      "parents": [
        "60ff3cfe591e22ca37f9b3ad8584b465f7064853"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Jul 04 23:08:38 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 23:08:38 2026 -0700"
      },
      "message": "ORC-2185: Upgrade `spotless-maven-plugin` to 3.7.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.6.0 to 3.7.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.7.0\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;toggleOffOn\u0026gt;\u003c/code\u003e no longer disables lint-only steps such as \u003ccode\u003e\u0026lt;forbidWildcardImports\u0026gt;\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where copyright year is surrounded by whitespace. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;flexmark\u0026gt;\u003c/code\u003e step now supports arbitrary formatter options via \u003ccode\u003e\u0026lt;formatterOptions\u0026gt;\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003espotless-lib and spotless-lib-extra releases\u003c/h1\u003e\n\u003cp\u003eIf you are a Spotless user (as opposed to developer), then you are probably looking for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis document is intended for Spotless developers.\u003c/p\u003e\n\u003cp\u003eWe adhere to the \u003ca href\u003d\"https://keepachangelog.com/en/1.0.0/\"\u003ekeepachangelog\u003c/a\u003e format (starting after version \u003ccode\u003e1.27.0\u003c/code\u003e).\u003c/p\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[4.7.0] - 2026-06-16\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for AsciiDoc formatting via \u003ccode\u003eadocfmt\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2960\"\u003e#2960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflexmark\u003c/code\u003e step now supports arbitrary formatter options via a \u003ccode\u003eformatterOptions\u003c/code\u003e map. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2968\"\u003e#2968\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eFenceStep.preserveWithin\u003c/code\u003e now forwards lints from nested steps while still suppressing lints inside preserved blocks. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2962\"\u003e#2962\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSupport \u003ccode\u003ektfmt\u003c/code\u003e 0.63 and use its new builder API for formatting options to better avoid future breaking changes.\u003c/li\u003e\n\u003cli\u003eParse standard git year output in LicenseHeaderStep. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenarios where copyright year is surrounded by whitespace. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2973\"\u003e#2973\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003egreclipse\u003c/code\u003e version to latest \u003ccode\u003e4.35\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.39\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2924\"\u003e#2924\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.2] - 2026-05-27\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eP2Provisioner\u003c/code\u003e now passes cache directory overrides directly to Solstice. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eforbidWildcardImports\u003c/code\u003e and \u003ccode\u003eforbidModuleImports\u003c/code\u003e now detect imports that have leading whitespace (indentation/tabs). (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2939\"\u003e#2939\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eversionCatalog\u003c/code\u003e step no longer splits long inline tables across multiple lines — Gradle\u0027s TOML 1.0 parser cannot read multi-line inline tables. The \u003ccode\u003emaxLineLength\u003c/code\u003e option has been removed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2948\"\u003e#2948\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eEclipseJdtFormtterStep\u003c/code\u003e now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFormatter\u003c/code\u003e no longer recomputes line-ending normalization (\u003ccode\u003eLineEnding.toUnix\u003c/code\u003e) a second time for every formatter step that changes content, removing redundant O(n) work from the core formatting loop. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2934\"\u003e#2934\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eexpandWildcardImports support pom type dependency. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2839\"\u003e#2839\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.1] - 2026-05-15\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eLicenseHeaderStep\u003c/code\u003e in \u003ccode\u003eSET_FROM_GIT\u003c/code\u003e year mode no longer invokes \u003ccode\u003egit log\u003c/code\u003e through \u003ccode\u003ebash -c\u003c/code\u003e / \u003ccode\u003ecmd /c\u003c/code\u003e, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.6.0] - 2026-05-14\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003escalafmt()\u003c/code\u003e now reads the version from the \u003ccode\u003eversion\u003c/code\u003e field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2922\"\u003e#2922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eversionCatalog\u003c/code\u003e step for formatting and sorting Gradle version catalog (\u003ccode\u003e.toml\u003c/code\u003e) files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2916\"\u003e#2916\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ejavaparserVersion\u003c/code\u003e option to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve case of JDBI named bind params that collide with SQL keywords (e.g. \u003ccode\u003e:limit\u003c/code\u003e, \u003ccode\u003e:offset\u003c/code\u003e) in the DBeaver SQL formatter. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2899\"\u003e#2899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix non-idempotent formatting when \u003ccode\u003eimportOrder()\u003c/code\u003e is combined with \u003ccode\u003egreclipse()\u003c/code\u003e: a single catch-all group no longer strips blank lines that \u003ccode\u003egreclipse()\u003c/code\u003e independently inserted between import groups. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2914\"\u003e#2914\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eexpandWildcardImports\u003c/code\u003e failing on JDK XML types such as \u003ccode\u003eorg.xml.sax.InputSource\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2921\"\u003e#2921\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/ef7703ae87f70bbf63d77c5275e6c687785706bc\"\u003e\u003ccode\u003eef7703a\u003c/code\u003e\u003c/a\u003e Published maven/3.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/91113e0fc7ec05f9a5f6a627869671290b4fa659\"\u003e\u003ccode\u003e91113e0\u003c/code\u003e\u003c/a\u003e Published gradle/8.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/611b48ea943e9e8faf8d98db206dcf7f15cf8ef3\"\u003e\u003ccode\u003e611b48e\u003c/code\u003e\u003c/a\u003e Published lib/4.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/5f3a85fd15241450ba9b33e43507ee995176032b\"\u003e\u003ccode\u003e5f3a85f\u003c/code\u003e\u003c/a\u003e ci(deploy): use \u003ccode\u003ebase64 -w0\u003c/code\u003e so the auth header has no embedded newline\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/f84f02512b83d2ebe2aede8e0c70837b3592e98f\"\u003e\u003ccode\u003ef84f025\u003c/code\u003e\u003c/a\u003e ci(deploy): force HTTP/1.1 on \u003ccode\u003egit fetch origin main\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/780f0f60b62a9d7a11e28dbf3fe63b5e9e50e623\"\u003e\u003ccode\u003e780f0f6\u003c/code\u003e\u003c/a\u003e fix(spotless/gradle-plugin): Fix \u003ccode\u003eStringIndexOutOfBoundsException\u003c/code\u003e in scenari...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b0328c849d5ba7dd50feb33b7d4ae7478a5e5436\"\u003e\u003ccode\u003eb0328c8\u003c/code\u003e\u003c/a\u003e Update plugin rewrite to v7.34.0 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2972\"\u003e#2972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/9a502ce0cbe0932de33e8543f9bc2a6ec714bc26\"\u003e\u003ccode\u003e9a502ce\u003c/code\u003e\u003c/a\u003e Update plugin com.gradle.develocity to v4.4.2 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2971\"\u003e#2971\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b4d9ec0b41f4b9fedf6874a8a4becac286403ec4\"\u003e\u003ccode\u003eb4d9ec0\u003c/code\u003e\u003c/a\u003e Revert the changes to \u003ccode\u003eassertUnchanged()\u003c/code\u003e and use \u003ccode\u003eassertTransform()\u003c/code\u003e when ne...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/787819d8f8640c011d245dafee492fc5bffb0405\"\u003e\u003ccode\u003e787819d\u003c/code\u003e\u003c/a\u003e Remove unneeded debug comments\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.6.0...maven/3.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.6.0\u0026new-version\u003d3.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2653 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.7.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "60ff3cfe591e22ca37f9b3ad8584b465f7064853",
      "tree": "a7e2c2ab13adc327ed6ebfbd9cfa7856004a3bfb",
      "parents": [
        "91345fa1c76f1168455cadb67f4ff18662f554da"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 20:27:31 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Jul 04 20:27:31 2026 -0700"
      },
      "message": "Revert \"ORC-2179: Add RISC-V Docker image and GitHub Actions support\"\n\nThis reverts commit 98aab65bf6d838bfdee8250ad469861a30a99ff1.\n"
    },
    {
      "commit": "91345fa1c76f1168455cadb67f4ff18662f554da",
      "tree": "b605155065d4ea5b38ced5cbd6027d3491cd443e",
      "parents": [
        "a8fff40fe01cb145c353e30f37e767cb10cb434c"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 09:52:10 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 09:52:10 2026 -0700"
      },
      "message": "ORC-2181: Add `ubuntu-26.04(-arm)?` to GitHub Actions `build` job\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add `ubuntu-26.04` and `ubuntu-26.04-arm` to the GitHub Action `build` job with Java 25.\n\n### Why are the changes needed?\n\nTo improve the test coverage by running the build and test on the latest Ubuntu 26.04 (both x86_64 and arm64) with the latest Java version.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2654 from dongjoon-hyun/ORC-2181.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "a8fff40fe01cb145c353e30f37e767cb10cb434c",
      "tree": "428a1861dd683992a1d07ead14e17a25b7ac2b4e",
      "parents": [
        "98aab65bf6d838bfdee8250ad469861a30a99ff1"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 08:39:49 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Jul 01 08:39:49 2026 -0700"
      },
      "message": "ORC-2182: Pin docker setup actions to approved commit hashes to recover CIs\n\n### What changes were proposed in this pull request?\n\nThis PR pins two `docker/*` GitHub Actions in `.github/workflows/build_and_test.yml` to commit hashes approved by the ASF (`apache/infrastructure-actions/approved_patterns.yml`):\n\n| Action | Before | After |\n| --- | --- | --- |\n| `docker/setup-qemu-action` | `v3` | `c7c53464625b32c7a7e944ae62b3e17d2b600130` (v3.7.0) |\n| `docker/setup-buildx-action` | `v3` | `d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5` (v4.1.0) |\n\nNote that the approved patterns list has no `v3.x` hash for `docker/setup-buildx-action`, so it is bumped from `v3` to the latest approved `v4.1.0`.\n\n### Why are the changes needed?\n\nThe ASF infrastructure policy requires third-party GitHub Actions to be pinned to approved commit hashes instead of mutable version tags, to prevent supply-chain attacks from tag reassignment.\n\nCurrently, the CI is broken like the following.\n- https://github.com/apache/orc/actions/runs/28527900078\n\n\u003cimg width\u003d\"612\" height\u003d\"213\" alt\u003d\"Screenshot 2026-07-01 at 08 35 48\" src\u003d\"https://github.com/user-attachments/assets/50e31ed2-b282-461e-be50-ee84db79360b\" /\u003e\n\n### How was this patch tested?\n\nPass the GitHub Actions.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.8\n\nCloses #2655 from dongjoon-hyun/ORC-2182.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "98aab65bf6d838bfdee8250ad469861a30a99ff1",
      "tree": "eebd926ab7676f977c8145dad509753e17a6f86c",
      "parents": [
        "56e88baf3b666c9b2378d7b62577401e9ded9224"
      ],
      "author": {
        "name": "changbao zhan",
        "email": "zhan.changbao@sanechips.com.cn",
        "time": "Sun Jun 28 16:39:03 2026 +0800"
      },
      "committer": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Sun Jun 28 16:39:03 2026 +0800"
      },
      "message": "ORC-2179: Add RISC-V Docker image and GitHub Actions support\n\n### What this PR does\n\nAdds a RISC-V (riscv64) Docker image for Ubuntu 24.04 and wires it into GitHub Actions so we can continuously build ORC on RISC-V.\n\n### Changes\n\n- `docker/riscv64-ubuntu24/Dockerfile`: new image based on the existing Ubuntu 24.04 Dockerfile. Supports both `cc\u003dgcc` (default) and `cc\u003dclang` build args.\n- `docker/os-list.txt`: registered the new image.\n- `.github/workflows/build_and_test.yml`: added a `riscv64` job running under QEMU on `ubuntu-latest`.\n\n### Notes\n\n- The job currently only builds ORC. RVV-specific tests will be added in follow-up PRs after the RVV decoder implementation is in.\n- I followed the same pattern as the existing `aarch64` / `ubuntu24` Docker images to keep things consistent.\n- Local verification was done with `docker buildx` on a host with QEMU user-static registered.\n\n### ScreenShot\n\u003cimg width\u003d\"970\" height\u003d\"340\" alt\u003d\"1\" src\u003d\"https://github.com/user-attachments/assets/4cee0ece-a594-4fbe-8cf7-4b6e2b8f7219\" /\u003e\n\u003cimg width\u003d\"875\" height\u003d\"255\" alt\u003d\"2\" src\u003d\"https://github.com/user-attachments/assets/6ece8345-a613-4bfe-8cd2-1ee9e92a32c7\" /\u003e\n\nCloses #2644 from zhanchangbao-sanechips/ORC-2179-riscv-docker.\n\nAuthored-by: changbao zhan \u003czhan.changbao@sanechips.com.cn\u003e\nSigned-off-by: ffacs \u003cffacs520@gmail.com\u003e\n"
    },
    {
      "commit": "56e88baf3b666c9b2378d7b62577401e9ded9224",
      "tree": "3df8be6de051ac0a7b7d66de76e2c6c137737482",
      "parents": [
        "6d125348a6aca67919de4e12c2a3b8c07a3cdefb"
      ],
      "author": {
        "name": "changbao zhan",
        "email": "zhan.changbao@sanechips.com.cn",
        "time": "Sun Jun 28 16:36:32 2026 +0800"
      },
      "committer": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Sun Jun 28 16:36:32 2026 +0800"
      },
      "message": "ORC-2178: [C++] Add basic RISC-V build system and CPU detection support\n\n### What changes were proposed in this pull request?\n\nadd the minimum to get RISC-V support in the build system and CPU detection. This is needed before can start add RVV-optimization.\n\n### changes:\n\n- Added `BUILD_ENABLE_RVV` CMake option (off by default)\n- Added rv64gcv toolchain detection in `ConfigSimdLevel.cmake`\n- `ORC_USER_SIMD_LEVEL` now accepts RVV or NONE\n\nIf RVV isn\u0027t available, it just falls back to scalar code.\n\n### Why are the changes needed?\n\nORC doesn\u0027t know anything about RISC-V. This is just the groundwork so follow-up patches can actually use RVV. (https://issues.apache.org/jira/browse/ORC-1971)\n\n### How was this patch tested?\n\n- Tested on a Sophgo SG2044 board with GCC 14.2.0\n- Built with `-DBUILD_ENABLE_RVV\u003dON`, config passed\n- Setting `ORC_USER_SIMD_LEVEL\u003dNONE` properly masks out RVV\n\nCloses #2639 from zhanchangbao-sanechips/rvvopt.\n\nAuthored-by: changbao zhan \u003czhan.changbao@sanechips.com.cn\u003e\nSigned-off-by: ffacs \u003cffacs520@gmail.com\u003e\n"
    },
    {
      "commit": "6d125348a6aca67919de4e12c2a3b8c07a3cdefb",
      "tree": "1c798fc39b1c4374de010bcedebd0163474fc581",
      "parents": [
        "325efd35f1ec69812e8e7ab078b2558a3bdb02f2"
      ],
      "author": {
        "name": "sychen",
        "email": "sychen@ctrip.com",
        "time": "Tue Jun 16 10:00:49 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jun 16 10:00:49 2026 -0700"
      },
      "message": "ORC-2177: Fix array conversion with empty first batch\n\n### What changes were proposed in this pull request?\nAdd a `batchSize \u003e 0` guard in `ConvertTreeReader.convertVector()` before accessing index 0.\n\n### Why are the changes needed?\nWhen reading an ORC file with schema evolution converting `array\u003cint\u003e` to `array\u003cstring\u003e`, an `ArrayIndexOutOfBoundsException` is thrown if the first batch processed by the element reader has `childCount\u003d0` (i.e., all rows in the batch contain empty arrays).\n\n```java\njava.lang.ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0\n\tat org.apache.orc.impl.ConvertTreeReaderFactory$StringGroupFromAnyIntegerTreeReader.setConvertVectorElement(ConvertTreeReaderFactory.java:1094)\n\tat org.apache.orc.impl.ConvertTreeReaderFactory$ConvertTreeReader.convertVector(ConvertTreeReaderFactory.java:305)\n\tat org.apache.orc.impl.ConvertTreeReaderFactory$StringGroupFromAnyIntegerTreeReader.nextVector(ConvertTreeReaderFactory.java:1115)\n\tat org.apache.orc.impl.TreeReaderFactory$ListTreeReader.nextVector(TreeReaderFactory.java:2892)\n\tat org.apache.orc.impl.reader.tree.StructBatchReader.readBatchColumn(StructBatchReader.java:66)\n\tat org.apache.orc.impl.reader.tree.StructBatchReader.nextBatchForLevel(StructBatchReader.java:101)\n\tat org.apache.orc.impl.reader.tree.StructBatchReader.nextBatch(StructBatchReader.java:78)\n\tat org.apache.orc.impl.RecordReaderImpl.nextBatch(RecordReaderImpl.java:1444)\n```\n\n### How was this patch tested?\nAdded `testIntArrayToStringArrayFirstBatchAllEmpty` in `TestConvertTreeReaderFactory`\n\n### Was this patch authored or co-authored using generative AI tooling?\nGenerated-by: Claude\n\nCloses #2638 from cxzl25/ORC-2177.\n\nAuthored-by: sychen \u003csychen@ctrip.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "325efd35f1ec69812e8e7ab078b2558a3bdb02f2",
      "tree": "d7cbd10dcc63613b89010f9de9d400c5136727d1",
      "parents": [
        "668fcc12335cc9e26e6c056ddc2d0da5e5db9c66"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Jun 16 09:53:25 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Jun 16 09:53:25 2026 -0700"
      },
      "message": "ORC-2180: Upgrade `threeten-extra` to 1.9.0\n\nBumps [org.threeten:threeten-extra](https://github.com/ThreeTen/threeten-extra) from 1.8.0 to 1.9.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/releases\"\u003eorg.threeten:threeten-extra\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease v1.9.0\u003c/h2\u003e\n\u003cp\u003eSee the \u003ca href\u003d\"https://www.threeten.org/threeten-extra/changes-report.html\"\u003echange notes\u003c/a\u003e for more information.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.4.0 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/344\"\u003eThreeTen/threeten-extra#344\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate deployment from OSSRH by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/372\"\u003eThreeTen/threeten-extra#372\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional wordBased method on AmountFormats by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/373\"\u003eThreeTen/threeten-extra#373\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd PeriodDuration.truncatedTo by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/374\"\u003eThreeTen/threeten-extra#374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix Ethiopic calendar epoch in Javadoc by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/375\"\u003eThreeTen/threeten-extra#375\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix implementations of query() by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/376\"\u003eThreeTen/threeten-extra#376\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate dependencies and Prepare for release by \u003ca href\u003d\"https://github.com/jodastephen\"\u003e\u003ccode\u003e​jodastephen\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/pull/377\"\u003eThreeTen/threeten-extra#377\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/compare/v1.8.0...v1.9.0\"\u003ehttps://github.com/ThreeTen/threeten-extra/compare/v1.8.0...v1.9.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/7ad2731e89445d7a5990ffe7e64e4506cc934e81\"\u003e\u003ccode\u003e7ad2731\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release v1.9.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/11b6c0c1d5f6a57606f36f7c56a4863ad8c81e98\"\u003e\u003ccode\u003e11b6c0c\u003c/code\u003e\u003c/a\u003e Enable workflow dispatch\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/64f62be51fcdbcdca51ada4357eb166a4f25dd3b\"\u003e\u003ccode\u003e64f62be\u003c/code\u003e\u003c/a\u003e Update dependencies and Prepare for release (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/377\"\u003e#377\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/052f0fb11d86c43bdfa08e9b78986bd4862d9d70\"\u003e\u003ccode\u003e052f0fb\u003c/code\u003e\u003c/a\u003e Fix implementations of query() (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/376\"\u003e#376\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/d896bcf17ee4604d4ca1f2f62b538594ecc40c5f\"\u003e\u003ccode\u003ed896bcf\u003c/code\u003e\u003c/a\u003e Fix Ethiopic calendar epoch in Javadoc (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/375\"\u003e#375\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/8a44e4109d9f897ff6737d1c66624a1151befee5\"\u003e\u003ccode\u003e8a44e41\u003c/code\u003e\u003c/a\u003e Add PeriodDuration.truncatedTo (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/374\"\u003e#374\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/1af9bdc5cd9661d5051ccaa1f8e21969e00a1fa0\"\u003e\u003ccode\u003e1af9bdc\u003c/code\u003e\u003c/a\u003e Additional wordBased method on AmountFormats (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/373\"\u003e#373\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/54834ca24b2b6aa046c8285e3fcee474b8f03d0e\"\u003e\u003ccode\u003e54834ca\u003c/code\u003e\u003c/a\u003e Update deployment from OSSRH (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/372\"\u003e#372\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/4e016340b97cab604114d10e02a672c1e94c6be5\"\u003e\u003ccode\u003e4e01634\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.4.0 (\u003ca href\u003d\"https://redirect.github.com/ThreeTen/threeten-extra/issues/344\"\u003e#344\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/commit/51679d62e430bffca7c2e47e33a7f5abd098003c\"\u003e\u003ccode\u003e51679d6\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/ThreeTen/threeten-extra/compare/v1.8.0...v1.9.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.threeten:threeten-extra\u0026package-manager\u003dmaven\u0026previous-version\u003d1.8.0\u0026new-version\u003d1.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2643 from dependabot[bot]/dependabot/maven/java/org.threeten-threeten-extra-1.9.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "668fcc12335cc9e26e6c056ddc2d0da5e5db9c66",
      "tree": "85d2b313759d8098ff514172889f4d49c9391484",
      "parents": [
        "36a4f4d1ab5e0572e2dad6ddbe6fe992a22cb6ac"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jun 10 15:16:25 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Jun 10 15:16:25 2026 +0800"
      },
      "message": "ORC-2176: Upgrade `spotless-maven-plugin` to 3.6.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.5.1 to 3.6.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.6.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003e\u0026lt;cacheDirectory\u0026gt;\u003c/code\u003e to \u003ccode\u003e\u0026lt;eclipse\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026lt;greclipse\u0026gt;\u003c/code\u003e, and \u003ccode\u003e\u0026lt;eclipseCdt\u0026gt;\u003c/code\u003e for the Equo/Solstice P2 cache. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eEclipseJdtFormtterStep\u003c/code\u003e now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;versionCatalog\u0026gt;\u003c/code\u003e no longer splits long inline tables across multiple lines — Gradle\u0027s TOML 1.0 parser cannot read multi-line inline tables. The \u003ccode\u003emaxLineLength\u003c/code\u003e option has been removed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2948\"\u003e#2948\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003espotless:apply\u003c/code\u003e no longer aborts on the first file with lints; it now formats all files and reports a single aggregated lint failure across every file, matching the Gradle plugin\u0027s behavior. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2937\"\u003e#2937\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;greclipse\u0026gt;\u003c/code\u003e and \u003ccode\u003e\u0026lt;eclipseCdt\u0026gt;\u003c/code\u003e now default P2 data to the Maven local repository. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eforbidWildcardImports\u003c/code\u003e and \u003ccode\u003eforbidModuleImports\u003c/code\u003e now detect imports that have leading whitespace (indentation/tabs). (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2939\"\u003e#2939\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved formatting performance by eliminating redundant per-step line-ending normalization in the core formatter loop. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2934\"\u003e#2934\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/71a433c5cd5e8a4983c6600a10032ce3415700ba\"\u003e\u003ccode\u003e71a433c\u003c/code\u003e\u003c/a\u003e Published maven/3.6.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3a0f1017dcdfd49042a638119c1b6d998b28c67f\"\u003e\u003ccode\u003e3a0f101\u003c/code\u003e\u003c/a\u003e Published gradle/8.6.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/007e9d858177c93a3c7b6f9d1eb068937022613f\"\u003e\u003ccode\u003e007e9d8\u003c/code\u003e\u003c/a\u003e Published lib/4.6.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a074d53565e0f523c3bba7f5135ba0d8f959f98b\"\u003e\u003ccode\u003ea074d53\u003c/code\u003e\u003c/a\u003e Allow setting the local P2 cache dir in the Spotless Gradle plugin (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a266fc2b97098aed703300ecfb00a7fc6ab57467\"\u003e\u003ccode\u003ea266fc2\u003c/code\u003e\u003c/a\u003e Merge branch \u0027main\u0027 into add-cache-directory-dsl\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/e0d466e5c157d41208ba84f3b0c767a4ad3d4330\"\u003e\u003ccode\u003ee0d466e\u003c/code\u003e\u003c/a\u003e Fix: sort members treats record declarations as types (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2942\"\u003e#2942\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3936b6f2f9290bfe946a890c1efc791eb969c7db\"\u003e\u003ccode\u003e3936b6f\u003c/code\u003e\u003c/a\u003e Merge branch \u0027main\u0027 into main\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/278765fcbbdc91d9bbcd3bff41005a350746792c\"\u003e\u003ccode\u003e278765f\u003c/code\u003e\u003c/a\u003e fix: expandWildcardImports support pom type dependency, fix \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2839\"\u003e#2839\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2935\"\u003e#2935\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a18ddec9bd578c77177c9478207892d63f942826\"\u003e\u003ccode\u003ea18ddec\u003c/code\u003e\u003c/a\u003e Remove maxLineLength from versionCatalog step (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2949\"\u003e#2949\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b91ad871a69bb7c3722120c81f9dae3e1ee11836\"\u003e\u003ccode\u003eb91ad87\u003c/code\u003e\u003c/a\u003e Add changelog entries for versionCatalog maxLineLength removal\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.5.1...maven/3.6.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.5.1\u0026new-version\u003d3.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2635 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.6.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "36a4f4d1ab5e0572e2dad6ddbe6fe992a22cb6ac",
      "tree": "a535fe9e6370c1e8efd7930d52d49eaeeeb1f824",
      "parents": [
        "25f2e749aae0e34dd00c8376a780d3a3e329da2e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jun 10 15:14:17 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Jun 10 15:14:17 2026 +0800"
      },
      "message": "ORC-2175: Upgrade `maven-dependency-plugin` to 3.11.0\n\nBumps [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) from 3.10.0 to 3.11.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/releases\"\u003eorg.apache.maven.plugins:maven-dependency-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.11.0\u003c/h2\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd dependency:add and dependency:remove goals (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1599\"\u003e#1599\u003c/a\u003e) \u003ca href\u003d\"https://github.com/brunoborges\"\u003e\u003ccode\u003e​brunoborges\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded ability to provide arbitrary dependencies to properties mojo (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1561\"\u003e#1561\u003c/a\u003e) \u003ca href\u003d\"https://github.com/treilhes\"\u003e\u003ccode\u003e​treilhes\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix artifact relocation support (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1633\"\u003e#1633\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: fix addParentPoms\u003dtrue causes repositories to be ignored. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1585\"\u003e#1585\u003c/a\u003e) \u003ca href\u003d\"https://github.com/k-wall\"\u003e\u003ccode\u003e​k-wall\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix false positive in analyze-exclusions with transitive dependency exclusion (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1628\"\u003e#1628\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMake AbstractAnalyzeMojo.filterArtifactsByScope() null-safe (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1622\"\u003e#1622\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrevent NPE in BuildClasspathMojo.appendArtifactPath() when an artifact has no resolved file (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1623\"\u003e#1623\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eLog unpacking at debug level (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1624\"\u003e#1624\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eResolve plugins declared in pluginManagement for resolve-plugins and go-offline (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1603\"\u003e#1603\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eanalyze-exclusions\u003c/code\u003e crashes if there is no \u003ccode\u003edependencyManagement\u003c/code\u003e element (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1597\"\u003e#1597\u003c/a\u003e) \u003ca href\u003d\"https://github.com/JackPGreen\"\u003e\u003ccode\u003e​JackPGreen\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable ITs for dependency:remove and use mock dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1613\"\u003e#1613\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMore meaningful assertions (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1611\"\u003e#1611\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCure various typos IntelliJ complains about (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1612\"\u003e#1612\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove unused jansi dependency (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1606\"\u003e#1606\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnable ITs for dependecy:add and use mock dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1610\"\u003e#1610\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCleaner exception handling (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1566\"\u003e#1566\u003c/a\u003e) \u003ca href\u003d\"https://github.com/elharo\"\u003e\u003ccode\u003e​elharo\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eManage ASM version 9.10 to support JDK 27 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1632\"\u003e#1632\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump eu.maveniverse.maven.domtrip:domtrip-core from 1.5.0 to 1.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1631\"\u003e#1631\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump eu.maveniverse.maven.domtrip:domtrip-maven from 1.5.0 to 1.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1630\"\u003e#1630\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.15 to 3.9.16 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1626\"\u003e#1626\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.shared:maven-dependency-analyzer from 1.17.0 to 1.17.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1627\"\u003e#1627\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 in /src/it/projects/remove-dependency/basic (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1607\"\u003e#1607\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugins:maven-plugins from 47 to 48 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1605\"\u003e#1605\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1601\"\u003e#1601\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.jsoup:jsoup from 1.22.1 to 1.22.2 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1602\"\u003e#1602\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.doxia:doxia-sink-api from 2.0.0 to 2.1.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1595\"\u003e#1595\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1596\"\u003e#1596\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.12 to 3.9.14 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1594\"\u003e#1594\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/pull/1589\"\u003e#1589\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/c186d05d80e15cd18651a3071a5186e275e04029\"\u003e\u003ccode\u003ec186d05\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release maven-dependency-plugin-3.11.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/371261124f9cff27cf0439fe3abaec4e322fae7e\"\u003e\u003ccode\u003e3712611\u003c/code\u003e\u003c/a\u003e Fix artifact relocation support\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/e873e0eb87775c0346b22cf6fe0c565e93e0b01f\"\u003e\u003ccode\u003ee873e0e\u003c/code\u003e\u003c/a\u003e Manage ASM version 9.10 to support JDK 27\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/70b535690ecbf985e795cabca9869d66a2c68e10\"\u003e\u003ccode\u003e70b5356\u003c/code\u003e\u003c/a\u003e fix: fix addParentPoms\u003dtrue causes repositories to be ignored. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/issues/1585\"\u003e#1585\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/51d893970655d18dade1f06ca48e2bf676349629\"\u003e\u003ccode\u003e51d8939\u003c/code\u003e\u003c/a\u003e Fix false positive in analyze-exclusions with transitive dependency exclusion...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/02b865b98376be8e9a0c31a028b87a4e1d4ff7a3\"\u003e\u003ccode\u003e02b865b\u003c/code\u003e\u003c/a\u003e Bump eu.maveniverse.maven.domtrip:domtrip-core from 1.5.0 to 1.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/04f4de17e7bd73276baeacc7275308d20f1257fd\"\u003e\u003ccode\u003e04f4de1\u003c/code\u003e\u003c/a\u003e Bump eu.maveniverse.maven.domtrip:domtrip-maven from 1.5.0 to 1.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/2812490a1263d186950becfe2d214f03e807048f\"\u003e\u003ccode\u003e2812490\u003c/code\u003e\u003c/a\u003e Bump mavenVersion from 3.9.15 to 3.9.16\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/ce117da219149e28f4253f85a805093222b8f868\"\u003e\u003ccode\u003ece117da\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.shared:maven-dependency-analyzer\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/commit/aea7a6400a73696f8819071c607e3c0d16bb9294\"\u003e\u003ccode\u003eaea7a64\u003c/code\u003e\u003c/a\u003e Prevent NPE (\u003ca href\u003d\"https://redirect.github.com/apache/maven-dependency-plugin/issues/1622\"\u003e#1622\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.10.0...maven-dependency-plugin-3.11.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.apache.maven.plugins:maven-dependency-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.10.0\u0026new-version\u003d3.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2634 from dependabot[bot]/dependabot/maven/java/org.apache.maven.plugins-maven-dependency-plugin-3.11.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "25f2e749aae0e34dd00c8376a780d3a3e329da2e",
      "tree": "f9d91ba78ebb0532702e8e5f9ae62a3397a35239",
      "parents": [
        "dd3ec892123e42d6dfe3e0db3da40fd36d62c46a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jun 10 15:10:39 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Jun 10 15:10:39 2026 +0800"
      },
      "message": "ORC-2174: Upgrade `jackson` to 2.21.4\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.3 to 2.21.4.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/d1abd31e4fec3035965d57a05a6256171ea8d980\"\u003e\u003ccode\u003ed1abd31\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.21.4\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/2aaea43db8480aa7d405ebc0de503cffc864f6f6\"\u003e\u003ccode\u003e2aaea43\u003c/code\u003e\u003c/a\u003e Prep for 2.21.4 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/9d3a9d54e40312ef0ac9192d599b59b541f65fb8\"\u003e\u003ccode\u003e9d3a9d5\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/84bcf7f5b268bc2b47a92bd08391f75e9d956793\"\u003e\u003ccode\u003e84bcf7f\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.3...jackson-bom-2.21.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson:jackson-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d2.21.3\u0026new-version\u003d2.21.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2633 from dependabot[bot]/dependabot/maven/java/com.fasterxml.jackson-jackson-bom-2.21.4.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "dd3ec892123e42d6dfe3e0db3da40fd36d62c46a",
      "tree": "6290ac279eafdb2300223fe9e553be59428bfd8f",
      "parents": [
        "c00006393237a6d081b5b53478f53bb361246bc6"
      ],
      "author": {
        "name": "shouzhi",
        "email": "shouzhi.zh@alibaba-inc.com",
        "time": "Mon Jun 08 18:01:06 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Mon Jun 08 18:01:06 2026 +0800"
      },
      "message": "ORC-2167: [C++] Fix integer overflow in PostScript footer length validation\n\n### What changes were proposed in this pull request?\n\n Added overflow-safe bounds checking in three locations in c++/src/Reader.cc using __builtin_add_overflow to prevent integer overflow when parsing malformed\n   ORC files with extremely large length values in PostScript:\n\n  1. readMetadata() - Use __builtin_add_overflow to safely compute total tail size (footerLength + metadataSize + postscriptLength + 1) before comparing\n  against fileLength\n  2. createReader() - Use __builtin_add_overflow to safely compute tailSize (1 + postscriptLength + footerSize) before bounds validation\n  3. startNextStripe() - Use __builtin_add_overflow to safely sum stripe length components (offset + indexLength + dataLength + footerLength) before\n  comparing against fileLength\n\n### Why are the changes needed?\n\nWhen an ORC file\u0027s PostScript is crafted with footer_length or metadata_length set to UINT64_MAX, the bounds check using unsigned addition (e.g.,\n  metadataSize + footerLength + postscriptLength_ + 1) can overflow and wrap around to a small value, bypassing validation.\n\n  For example, given a 58-byte file with footerLength \u003d UINT64_MAX, metadataSize \u003d 0, and postscriptLength_ \u003d 23:\n  - The sum wraps to 23 (mod 2^64)\n  - The check 58 \u003c 23 evaluates to false, allowing invalid offset calculation\n  - This can cause SIGBUS crash due to out-of-bounds memory access\n\n  Using __builtin_add_overflow (a GCC/Clang builtin) provides a standard, efficient way to detect overflow without manual subtraction logic.\n\n### How was this patch tested?\n\nAdded two unit tests in c++/test/TestReader.cc:\n\n  1. testMalformedFooterLengthOverflow - Constructs a minimal malformed ORC file with footer_length \u003d UINT64_MAX and verifies that createReader() throws\n  ParseError\n  2. testMalformedMetadataLengthOverflow - Constructs a malformed file with metadata_length \u003d UINT64_MAX and verifies ParseError is thrown\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude code\n\nCloses #2629 from luffy-zh/ORC-2167.\n\nAuthored-by: shouzhi \u003cshouzhi.zh@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "c00006393237a6d081b5b53478f53bb361246bc6",
      "tree": "d2b0dfe47b3bdf8f345cb7cc5572037bfcb8b9d8",
      "parents": [
        "072cc2c3941534936af26554b0c6c71edfe4e6b7"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jun 05 09:23:37 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Jun 05 09:23:37 2026 -0700"
      },
      "message": "ORC-2173: Add `SECURITY.md` for scan-agent discoverability\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add `SECURITY.md` for scan-agent discoverability.\n\n### Why are the changes needed?\n\nTo improve the visibility of ORC\u0027s security guidance in a standard way.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo.\n\nCloses #2636 from dongjoon-hyun/ORC-2173.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "072cc2c3941534936af26554b0c6c71edfe4e6b7",
      "tree": "22ec43f506f11aa9033804a556c21ccafe04a874",
      "parents": [
        "6e63ad9b5c926ddb6ad545e64b11db513ddc5d2c"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jun 03 13:36:17 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Wed Jun 03 13:36:17 2026 +0800"
      },
      "message": "Update security model\n\n### What changes were proposed in this pull request?\nThis PR adds a new \"Threat Model\" section to the project\u0027s Security documentation (`site/security/index.md`).\nThe new section outlines:\n1. The trusted vs. untrusted data boundaries for the `orc` library.\n2. The distinction between robustness issues (e.g., crashes or Out-Of-Bounds reads caused by maliciously fuzzed files) and actual security vulnerabilities.\n3. The responsibilities of the low-level parsing library versus the data ingestion layer.\n\n### Why are the changes needed?\nThis update is needed to align Apache ORC\u0027s security threat model with other foundational data format libraries like Apache Arrow.\n\nThe community occasionally receives reports from fuzzing tools regarding crashes, OOMs, or memory issues caused by parsing maliciously corrupted files. This documentation clarifies our stance: because `orc` is a low-level format library designed for trusted environments, parsing malformed files that cause a crash (without leading to Remote Code Execution or bypassing a defined security boundary) is considered a normal software bug (a robustness issue) rather than a security vulnerability (CVE).\n\nThis will help avoid overwhelming maintainers with non-exploitable CVEs and set clear expectations for security researchers.\n\n### How was this patch tested?\nThis is a documentation-only change updating the website Markdown. No functional code changes were introduced.\n\n### Was this patch authored or co-authored using generative AI tooling?\nGenerated-by: Gemini 3.1 Pro\n\nThis patch had conflicts when merged, resolved by\nCommitter: Gang Wu \u003custcwg@gmail.com\u003e\n\nCloses #2632 from wgtmac/security_model.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "6e63ad9b5c926ddb6ad545e64b11db513ddc5d2c",
      "tree": "91a9be0c21e20978c773fe42291e9bd77991083b",
      "parents": [
        "86c0ad44df8448ad8dc710da625ca754e39b521c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:58:46 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:58:46 2026 +0800"
      },
      "message": "ORC-2172: Upgrade `zstd-jni` to 1.5.7-9\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-8 to 1.5.7-9.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/ea32a0208b74446922647c33b82c6a151ab06e8e\"\u003e\u003ccode\u003eea32a02\u003c/code\u003e\u003c/a\u003e v1.5.7-9\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/6660ec34c6188dfa390872d865f4c748d1b4a725\"\u003e\u003ccode\u003e6660ec3\u003c/code\u003e\u003c/a\u003e Fix some possible int overflows\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/luben/zstd-jni/compare/v1.5.7-8...v1.5.7-9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.luben:zstd-jni\u0026package-manager\u003dmaven\u0026previous-version\u003d1.5.7-8\u0026new-version\u003d1.5.7-9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2631 from dependabot[bot]/dependabot/maven/java/com.github.luben-zstd-jni-1.5.7-9.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "86c0ad44df8448ad8dc710da625ca754e39b521c",
      "tree": "61003d2c81ee4f52369d2ae263799e49837d31ce",
      "parents": [
        "8aebad4e063f61c39931a5c39604d62764fb90c5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:56:23 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:56:23 2026 +0800"
      },
      "message": "ORC-2171: Upgrade `spotless-maven-plugin` to 3.5.1\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.4.0 to 3.5.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.5.1\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;licenseHeader\u0026gt;\u003c/code\u003e with \u003ccode\u003e\u0026lt;yearMode\u0026gt;SET_FROM_GIT\u0026lt;/yearMode\u0026gt;\u003c/code\u003e no longer runs \u003ccode\u003egit log\u003c/code\u003e through a shell, eliminating a shell-injection vector when formatting files whose names contain shell metacharacters.\u003c/li\u003e\n\u003cli\u003eBump transitive \u003ccode\u003eplexus-utils\u003c/code\u003e \u003ccode\u003e4.0.2\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.0.3\u003c/code\u003e to address \u003ca href\u003d\"https://github.com/advisories/GHSA-6fmv-xxpf-w3cw\"\u003eCVE-2025-67030\u003c/a\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2919\"\u003e#2919\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.5.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003e\u0026lt;scalafmt\u0026gt;\u003c/code\u003e now reads the version from the \u003ccode\u003eversion\u003c/code\u003e field in the scalafmt config file when no \u003ccode\u003e\u0026lt;version\u0026gt;\u003c/code\u003e is explicitly set, falling back to the built-in default only if neither is available. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2922\"\u003e#2922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003e\u0026lt;toml\u0026gt;\u003c/code\u003e format type with \u003ccode\u003e\u0026lt;versionCatalog\u0026gt;\u003c/code\u003e step for formatting and sorting Gradle version catalog files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2916\"\u003e#2916\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003e\u0026lt;javaparserVersion\u0026gt;\u003c/code\u003e option to \u003ccode\u003e\u0026lt;cleanthat\u0026gt;\u003c/code\u003e, allowing users to override the JavaParser version pulled in transitively by Cleanthat. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd a \u003ccode\u003eexpandWildcardImports\u003c/code\u003e API for java (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2930\"\u003e#2829\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve case of JDBI named bind params that collide with SQL keywords (e.g. \u003ccode\u003e:limit\u003c/code\u003e, \u003ccode\u003e:offset\u003c/code\u003e) in the DBeaver SQL formatter. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2899\"\u003e#2899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e-Dspotless.ratchetFrom\u003d...\u003c/code\u003e user property now takes priority over \u003ccode\u003e\u0026lt;ratchetFrom\u0026gt;\u003c/code\u003e configured in the plugin or in individual formatters, instead of being overridden by them. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2896\"\u003e#2896\u003c/a\u003e, fixes \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2842\"\u003e#2842\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix non-idempotent formatting when \u003ccode\u003eimportOrder()\u003c/code\u003e is combined with \u003ccode\u003egreclipse()\u003c/code\u003e: a single catch-all group no longer strips blank lines that \u003ccode\u003egreclipse()\u003c/code\u003e independently inserted between import groups. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2914\"\u003e#2914\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eexpandWildcardImports\u003c/code\u003e failing on JDK XML types such as \u003ccode\u003eorg.xml.sax.InputSource\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2921\"\u003e#2921\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse Eclipse JDT\u0027s collator-based comparison when sorting Java members to better match Eclipse save actions. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2920\"\u003e#2920\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ecleanthat\u003c/code\u003e version \u003ccode\u003e2.24\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.25\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2903\"\u003e#2903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003eeclipse-jdt\u003c/code\u003e version from \u003ccode\u003e4.35\u003c/code\u003e to \u003ccode\u003e4.39\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2912\"\u003e#2912\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/0c48edf9597ec16e82e1a0b6da76a6a6dcc0d5de\"\u003e\u003ccode\u003e0c48edf\u003c/code\u003e\u003c/a\u003e Published maven/3.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/c1595c815d5fdd344505792aa4df588f467f0ca9\"\u003e\u003ccode\u003ec1595c8\u003c/code\u003e\u003c/a\u003e Published gradle/8.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b26b570f7eba32554061b036206f675180cd2384\"\u003e\u003ccode\u003eb26b570\u003c/code\u003e\u003c/a\u003e Published lib/4.6.1\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/ac3f6f14a2e007c2d36223335df96a2c9ba92719\"\u003e\u003ccode\u003eac3f6f1\u003c/code\u003e\u003c/a\u003e Bump plexus-utils to 4.0.3 to address CVE-2025-67030 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2932\"\u003e#2932\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/f5039f633d436a8831d09a934a3490d68968d684\"\u003e\u003ccode\u003ef5039f6\u003c/code\u003e\u003c/a\u003e Bump plexus-utils to 4.0.3 to address CVE-2025-67030\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/0e77837d4789cb43b83c21d566fe4185adc4ae2b\"\u003e\u003ccode\u003e0e77837\u003c/code\u003e\u003c/a\u003e Fix shell-injection in LicenseHeaderStep SET_FROM_GIT mode (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2931\"\u003e#2931\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/84f642329de804615ff16f34d12a2249f1890850\"\u003e\u003ccode\u003e84f6423\u003c/code\u003e\u003c/a\u003e Fix shell-injection in LicenseHeaderStep SET_FROM_GIT mode\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b87eb75efe54e94a7248ff5e2d07231bcc3a1b55\"\u003e\u003ccode\u003eb87eb75\u003c/code\u003e\u003c/a\u003e Published maven/3.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/97c3baf34b79d0028a343776bb2c2fb223930355\"\u003e\u003ccode\u003e97c3baf\u003c/code\u003e\u003c/a\u003e Published gradle/8.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3dd1a9690270e7191f2c7db8314a9079b127ee76\"\u003e\u003ccode\u003e3dd1a96\u003c/code\u003e\u003c/a\u003e Published lib/4.6.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.4.0...maven/3.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.4.0\u0026new-version\u003d3.5.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2630 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.5.1.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "8aebad4e063f61c39931a5c39604d62764fb90c5",
      "tree": "7ce0e90af431fe6ed83d3e88c813c18b7cc78637",
      "parents": [
        "ded8277ce610c3490ff7d2bde989378e3bd8ccd7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:54:35 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:54:35 2026 +0800"
      },
      "message": "ORC-2170: Upgrade `slf4j` to 2.0.18\n\nBumps `slf4j.version` from 2.0.17 to 2.0.18.\nUpdates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.18\n\nUpdates `org.slf4j:slf4j-simple` from 2.0.17 to 2.0.18\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2627 from dependabot[bot]/dependabot/maven/java/slf4j.version-2.0.18.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "ded8277ce610c3490ff7d2bde989378e3bd8ccd7",
      "tree": "39ef0c65c762005bbc464223baf430977b157768",
      "parents": [
        "8847022f0114fb18e9377f3197fdca59426d24f9"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:52:40 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:52:40 2026 +0800"
      },
      "message": "ORC-2169: Upgrade `maven-enforcer-plugin` to 3.6.3\n\nBumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.6.2 to 3.6.3.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/maven-enforcer/releases\"\u003eorg.apache.maven.plugins:maven-enforcer-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMake bannedDependencies report root and transitive dependency in case both are banned. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/940\"\u003e#940\u003c/a\u003e) \u003ca href\u003d\"https://github.com/hvoynov\"\u003e\u003ccode\u003e​hvoynov\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd enforceBytecodeVersion rule based on mojohaus (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/968\"\u003e#968\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cstamas\"\u003e\u003ccode\u003e​cstamas\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove formatting of deprecated API warning (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/951\"\u003e#951\u003c/a\u003e) \u003ca href\u003d\"https://github.com/mthmulders\"\u003e\u003ccode\u003e​mthmulders\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix handling of Java versions like 21.0.10.0.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/967\"\u003e#967\u003c/a\u003e) \u003ca href\u003d\"https://github.com/parttimenerd\"\u003e\u003ccode\u003e​parttimenerd\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd null checks for modelId in PluginWrapper (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/974\"\u003e#974\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cpfeiffer\"\u003e\u003ccode\u003e​cpfeiffer\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📝 Documentation updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDocument the banMavenDefaults option for the requirePluginVersions rule. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/936\"\u003e#936\u003c/a\u003e) \u003ca href\u003d\"https://github.com/rpkrajewski\"\u003e\u003ccode\u003e​rpkrajewski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ePlexusStringUtils\u003c/code\u003e Refaster recipes (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/943\"\u003e#943\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eJUnit Jupiter migration from JUnit 4.x (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/941\"\u003e#941\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4 in /maven-enforcer-plugin/src/it/projects/MENFORCER-434 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/970\"\u003e#970\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDeps: Parent POM 48 and align deps (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/979\"\u003e#979\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cstamas\"\u003e\u003ccode\u003e​cstamas\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.21.0 to 1.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/976\"\u003e#976\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-io:commons-io from 2.21.0 to 2.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/975\"\u003e#975\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/973\"\u003e#973\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.13 to 3.9.14 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/965\"\u003e#965\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.12 to 3.9.13 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/964\"\u003e#964\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/963\"\u003e#963\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate log4j in test to avoid CVE (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/961\"\u003e#961\u003c/a\u003e) \u003ca href\u003d\"https://github.com/Bukama\"\u003e\u003ccode\u003e​Bukama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.20.0 to 1.21.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/962\"\u003e#962\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.assertj:assertj-core from 3.27.6 to 3.27.7 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/960\"\u003e#960\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mrm-maven-plugin from 1.7.0 to 1.7.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/959\"\u003e#959\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven:maven-parent from 46 to 47 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/958\"\u003e#958\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-archiver from 4.10.4 to 4.11.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/957\"\u003e#957\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to 46 including fixes (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/955\"\u003e#955\u003c/a\u003e) \u003ca href\u003d\"https://github.com/Bukama\"\u003e\u003ccode\u003e​Bukama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.3.0 to 3.5.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/956\"\u003e#956\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump mavenVersion from 3.9.11 to 3.9.12 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/948\"\u003e#948\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/947\"\u003e#947\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-io:commons-io from 2.20.0 to 2.21.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/946\"\u003e#946\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.19.0 to 1.20.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/pull/945\"\u003e#945\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/c7daff33d46c9c3ee0666540c6857c66cf159e70\"\u003e\u003ccode\u003ec7daff3\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release enforcer-3.6.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/ee46e78b046be9882a739c07556940329a7345d6\"\u003e\u003ccode\u003eee46e78\u003c/code\u003e\u003c/a\u003e Make bannedDependencies report root and transitive dependency in case both ar...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/0806924d8f6c5ad6105ac387bf323846e769b18c\"\u003e\u003ccode\u003e0806924\u003c/code\u003e\u003c/a\u003e Document the banMavenDefaults option for the requirePluginVersions rule. (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/936\"\u003e#936\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/8e4f5b94453de97592cf3935b79319894f013329\"\u003e\u003ccode\u003e8e4f5b9\u003c/code\u003e\u003c/a\u003e Add better enforceBytecodeVersion rule based on mojohaus (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/968\"\u003e#968\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/fd4b1486dcc93394d5f6a11687efd51d0d30b22d\"\u003e\u003ccode\u003efd4b148\u003c/code\u003e\u003c/a\u003e Add fix for 21.0.10.0.1 issue (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/967\"\u003e#967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/f32d5979ef387668162c2beb905b368e25accd70\"\u003e\u003ccode\u003ef32d597\u003c/code\u003e\u003c/a\u003e Deps: Parent POM 48 and align deps (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/979\"\u003e#979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/df0f2a6d7fbbaf79914cdb56fa5899d99c8eaf19\"\u003e\u003ccode\u003edf0f2a6\u003c/code\u003e\u003c/a\u003e Bump commons-codec:commons-codec from 1.21.0 to 1.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/976\"\u003e#976\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/2da7a68b4d8d9d2da866ffaf1e07a206c9b7115d\"\u003e\u003ccode\u003e2da7a68\u003c/code\u003e\u003c/a\u003e Add null checks for modelId in PluginWrapper\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/91eb4d9fe1f6f65137991c1131131ceaca542245\"\u003e\u003ccode\u003e91eb4d9\u003c/code\u003e\u003c/a\u003e Bump commons-io:commons-io from 2.21.0 to 2.22.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/975\"\u003e#975\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-enforcer/commit/b6222459bf3256bfd747731a7f4ea81577777ffe\"\u003e\u003ccode\u003eb622245\u003c/code\u003e\u003c/a\u003e Bump mavenVersion from 3.9.14 to 3.9.15 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-enforcer/issues/973\"\u003e#973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/maven-enforcer/compare/enforcer-3.6.2...enforcer-3.6.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.apache.maven.plugins:maven-enforcer-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.6.2\u0026new-version\u003d3.6.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2626 from dependabot[bot]/dependabot/maven/java/org.apache.maven.plugins-maven-enforcer-plugin-3.6.3.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "8847022f0114fb18e9377f3197fdca59426d24f9",
      "tree": "117d19be17367a17f63ea71f12b4172e4a169f1b",
      "parents": [
        "588c966245108c64978f1b99ae1a6fde7b22095c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 01 12:49:59 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Mon Jun 01 12:49:59 2026 +0800"
      },
      "message": "ORC-2168: Bump `parquet` to 1.17.1\n\nBumps `parquet.version` from 1.17.0 to 1.17.1.\nUpdates `org.apache.parquet:parquet-hadoop` from 1.17.0 to 1.17.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-mr/releases\"\u003eorg.apache.parquet:parquet-hadoop\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1 RC0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/78a8d3230eb4769db93de5f2f2e18363c04cae81\"\u003e\u003ccode\u003e78a8d32\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release apache-parquet-1.17.1-rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/b4351b2bbb08b30a1e5dafed0b7d995179c8208f\"\u003e\u003ccode\u003eb4351b2\u003c/code\u003e\u003c/a\u003e Bump version to 1.17.1-SNAPSHOT (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3544\"\u003e#3544\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/aa65eb460b204622f20848787b329d395b727756\"\u003e\u003ccode\u003eaa65eb4\u003c/code\u003e\u003c/a\u003e Bump jackson.version from 2.21.2 to 2.21.3 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3538\"\u003e#3538\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/ef00c4634233c714b3fd8d82a09a6c7e58c4e8a3\"\u003e\u003ccode\u003eef00c46\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3112\"\u003eGH-3112\u003c/a\u003e: Fix reading of proto Uint32Value (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3113\"\u003e#3113\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/0f91a199853bfcb48aff9af919ae4967f305ef7e\"\u003e\u003ccode\u003e0f91a19\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3410\"\u003eGH-3410\u003c/a\u003e: Bump jackson dependencies from 2.19.2 to 2.21.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3460\"\u003e#3460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/apache/parquet-mr/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `org.apache.parquet:parquet-avro` from 1.17.0 to 1.17.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/parquet-mr/releases\"\u003eorg.apache.parquet:parquet-avro\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Parquet Java 1.17.1 RC0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix reading of proto Uint32Value by \u003ca href\u003d\"https://github.com/0x26res\"\u003e\u003ccode\u003e​0x26res\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3113\"\u003eapache/parquet-java#3113\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson dependencies from 2.19.2 to 2.21.2 by \u003ca href\u003d\"https://github.com/manuzhang\"\u003e\u003ccode\u003e​manuzhang\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3460\"\u003eapache/parquet-java#3460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump jackson.version from 2.21.2 to 2.21.3 by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/apache/parquet-java/pull/3538\"\u003eapache/parquet-java#3538\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\"\u003ehttps://github.com/apache/parquet-java/compare/apache-parquet-1.17.0...apache-parquet-1.17.1-rc0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/78a8d3230eb4769db93de5f2f2e18363c04cae81\"\u003e\u003ccode\u003e78a8d32\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release apache-parquet-1.17.1-rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/b4351b2bbb08b30a1e5dafed0b7d995179c8208f\"\u003e\u003ccode\u003eb4351b2\u003c/code\u003e\u003c/a\u003e Bump version to 1.17.1-SNAPSHOT (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3544\"\u003e#3544\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/aa65eb460b204622f20848787b329d395b727756\"\u003e\u003ccode\u003eaa65eb4\u003c/code\u003e\u003c/a\u003e Bump jackson.version from 2.21.2 to 2.21.3 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3538\"\u003e#3538\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/ef00c4634233c714b3fd8d82a09a6c7e58c4e8a3\"\u003e\u003ccode\u003eef00c46\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3112\"\u003eGH-3112\u003c/a\u003e: Fix reading of proto Uint32Value (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3113\"\u003e#3113\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/parquet-java/commit/0f91a199853bfcb48aff9af919ae4967f305ef7e\"\u003e\u003ccode\u003e0f91a19\u003c/code\u003e\u003c/a\u003e \u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3410\"\u003eGH-3410\u003c/a\u003e: Bump jackson dependencies from 2.19.2 to 2.21.2 (\u003ca href\u003d\"https://redirect.github.com/apache/parquet-mr/issues/3460\"\u003e#3460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/apache/parquet-mr/compare/apache-parquet-1.17.0...apache-parquet-1.17.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2623 from dependabot[bot]/dependabot/maven/java/parquet.version-1.17.1.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "588c966245108c64978f1b99ae1a6fde7b22095c",
      "tree": "2c4a6caa0d46189899358e0c44e437e0dfcd0ffa",
      "parents": [
        "473ac95ed62cf254e3fff25af835c42f9059fad1"
      ],
      "author": {
        "name": "The Apache Software Foundation",
        "email": "root-asf-gitbox-commits@apache.org",
        "time": "Mon May 18 14:29:59 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon May 18 12:29:59 2026 -0700"
      },
      "message": "INFRA: Set up default rulesets for default and release branches"
    },
    {
      "commit": "473ac95ed62cf254e3fff25af835c42f9059fad1",
      "tree": "6c50f04af04bfbf5ec303ebf71855e0e521259b0",
      "parents": [
        "cc7cc193074ccc96535abbbd52de37514eeff043"
      ],
      "author": {
        "name": "ffacs",
        "email": "ffacs520@gmail.com",
        "time": "Thu May 14 11:24:48 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu May 14 11:24:48 2026 -0700"
      },
      "message": "ORC-2165: [C++] Fix bounds check for LZO stop command trailer\n\n### What changes were proposed in this pull request?\n\n  This PR fixes the C++ LZO decompressor stop command trailer validation. It now checks that two trailer bytes are available before reading them, and validates the trailer bytes\n  explicitly.\n\n  A regression test was added for truncated LZO stop command trailers.\n\n### Why are the changes needed?\n\n  Malformed LZO-compressed ORC input can end immediately after the LZO stop command, or with only one trailer byte remaining. The previous validation could read two bytes before safely\n  confirming that two bytes were available, causing an out-of-bounds read on truncated input.\n\n  The new check makes truncated LZO input fail cleanly with `ParseError`.\n\n### How was this patch tested?\n\n  Ran:\n\n```bash\n  cmake --build build --target orc-test -j 8\n  build/c++/test/orc-test \u0027--gtest_filter\u003dTestDecompression.testLzo*\u0027\n```\n  The LZO decompression tests passed.\n\n  Also ran a minimal AddressSanitizer harness against truncated LZO stop command inputs and confirmed there was no ASan report.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\n  Yes. Generated with OpenAI Codex.\n\nCloses #2621 from ffacs/ORC-2165-lzo-stop-trailer.\n\nAuthored-by: ffacs \u003cffacs520@gmail.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "cc7cc193074ccc96535abbbd52de37514eeff043",
      "tree": "149f8e09daf3b4dbcb893daa33906d2c5bb43349",
      "parents": [
        "fbc8c8771864ce08127a843237534b4f50f3e256"
      ],
      "author": {
        "name": "yongqian",
        "email": "yongqian@trip.com",
        "time": "Thu May 14 11:19:05 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu May 14 11:19:05 2026 -0700"
      },
      "message": "ORC-2149: Supports merging multiple ORC files with the same schema into multiple ORC files\n\n### What changes were proposed in this pull request?\nExtends the Java merge tool so that, for inputs sharing the same schema, you can still merge to one ORC file by default, or use -m / --maxSize to write multiple ORC files under an output directory as part-xxxxx.orc, batching by input file size.\n\n### Why are the changes needed?\nUsers often need to merge many compatible ORC files without producing a single huge output file. This adds an optional mode that caps output size at whole-file boundaries while keeping the existing single-file behavior when --maxSize is not set.\n\n### How was this patch tested?\nAdd UT\n\nCloses #2601 from QianyongY/features/ORC-2149.\n\nAuthored-by: yongqian \u003cyongqian@trip.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "fbc8c8771864ce08127a843237534b4f50f3e256",
      "tree": "7db570982739bd5021f760d2f82dbb91cfa9894a",
      "parents": [
        "41484da9c107c3f5a38da5f129b44c71ab03ae1d"
      ],
      "author": {
        "name": "yonghao.fyh",
        "email": "yonghao.fyh@alibaba-inc.com",
        "time": "Tue May 12 10:24:12 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Tue May 12 10:24:12 2026 +0800"
      },
      "message": "ORC-2164: [C++] Add external-buffer support in DataBuffer lifecycle management\n\n### What changes were proposed in this pull request?\n\nThis PR adds non-owning buffer support to DataBuffer so it can attach externally managed memory (via setData) without taking ownership of allocation/free, updates reserve/resize/destructor paths to be ownership-aware, and adds a focused unit test to verify that non-owning buffers keep external size semantics and do not free external memory during destruction.\n\n### Why are the changes needed?\n\nThese changes are needed to safely integrate with external prebuffer cache scenarios where memory is managed outside ORC, avoiding unnecessary reallocations and preventing ownership/lifecycle mismatches.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: GPT-5.3-codex\n\nCloses #2617 from lucasfang/mempool.\n\nAuthored-by: yonghao.fyh \u003cyonghao.fyh@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "41484da9c107c3f5a38da5f129b44c71ab03ae1d",
      "tree": "ea47778b9060fa10c5367021aac7489ff36598d8",
      "parents": [
        "2775e83494563223f670354cc6e9092bd19e2bbd"
      ],
      "author": {
        "name": "yonghao.fyh",
        "email": "yonghao.fyh@alibaba-inc.com",
        "time": "Mon May 11 15:29:25 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Mon May 11 15:29:25 2026 +0800"
      },
      "message": "ORC-2160: [C++] Expose prefetch range planning via Reader::preBufferRange and refactor preBuffer to reuse it\n\n### What changes were proposed in this pull request?\n\nThis PR introduces a new Reader API, preBufferRange(stripes, includeTypes), which computes and returns the exact prefetch ranges (offset/length pairs), implements it in ReaderImpl, and refactors the existing preBuffer path to reuse that range-planning logic before populating cache.\n\n### Why are the changes needed?\n\nThe change is needed because preBuffer previously did not expose the planned ranges, but external users now have a multi-Reader scenario where different Readers prefetch different ranges of the same file and share an external prebuffer cache, so they must know the precise ranges in advance to coordinate prefetching and avoid duplicated work.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #2616 from lucasfang/prebuffer.\n\nAuthored-by: yonghao.fyh \u003cyonghao.fyh@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "2775e83494563223f670354cc6e9092bd19e2bbd",
      "tree": "288522da5d6934e579217bc106a2bf68e18b2b65",
      "parents": [
        "cdb9a2d7c3fbbec383eb075dffe441ccd37f80d6"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat May 09 19:56:42 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Sat May 09 19:56:42 2026 +0800"
      },
      "message": "ORC-2163: Upgrade `zstd-jni` to 1.5.7-8\n\nBumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-7 to 1.5.7-8.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/0afb51a8420183cfb894063ea06cb08b91f63ce2\"\u003e\u003ccode\u003e0afb51a\u003c/code\u003e\u003c/a\u003e Use gcc on AIX\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/1addabc11201bc2a33df8cbd4f90c0508a273d46\"\u003e\u003ccode\u003e1addabc\u003c/code\u003e\u003c/a\u003e v1.5.7-8\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/3044e793cb449c0d55367a2232955136ee0d95f2\"\u003e\u003ccode\u003e3044e79\u003c/code\u003e\u003c/a\u003e More validation\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/8257354d97008c8cee736246bd45277e0998ce06\"\u003e\u003ccode\u003e8257354\u003c/code\u003e\u003c/a\u003e Remove the check for OSGI when trying to load from JAR\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/702105065a4973e4faf179a32dd535e7ef64a93a\"\u003e\u003ccode\u003e7021050\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Test on RISE RISC-V runners\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/9a1ed43541d6bd833eaa4c7537624e15fbc95151\"\u003e\u003ccode\u003e9a1ed43\u003c/code\u003e\u003c/a\u003e Test on RISE RISC-V runners\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/luben/zstd-jni/commit/92a338167cc6221b618f34e22010ec62ff2eea95\"\u003e\u003ccode\u003e92a3381\u003c/code\u003e\u003c/a\u003e ignore .DS_Store\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/luben/zstd-jni/compare/v1.5.7-7...v1.5.7-8\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.github.luben:zstd-jni\u0026package-manager\u003dmaven\u0026previous-version\u003d1.5.7-7\u0026new-version\u003d1.5.7-8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2613 from dependabot[bot]/dependabot/maven/java/com.github.luben-zstd-jni-1.5.7-8.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "cdb9a2d7c3fbbec383eb075dffe441ccd37f80d6",
      "tree": "4c95b3ee88ac596dc2d7e977eb9d1f91a65ef448",
      "parents": [
        "3563ee5bdb1b461b0df425b7ccabb4aa12a4b30b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat May 09 19:54:42 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Sat May 09 19:54:42 2026 +0800"
      },
      "message": "ORC-2162: Upgrade `jackson` to 2.21.3\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.2 to 2.21.3.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/374fbd08ee91a6c91626bae1d6497df21c89b541\"\u003e\u003ccode\u003e374fbd0\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.21.3\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/7059df78cc36832349acad026169ff890f4c718c\"\u003e\u003ccode\u003e7059df7\u003c/code\u003e\u003c/a\u003e Prep for 2.21.3 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/2fd60bdab3228f6b99dce81326d9fd7eaf587401\"\u003e\u003ccode\u003e2fd60bd\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.20\u0027 into 2.21\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/b82a3640491f66be2e56bef377b5002cd9d1567b\"\u003e\u003ccode\u003eb82a364\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.19\u0027 into 2.20\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/ef4e013e95fc64583b0a414711648a84fc50be46\"\u003e\u003ccode\u003eef4e013\u003c/code\u003e\u003c/a\u003e Merge branch \u00272.18\u0027 into 2.19\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/536ae51c1db9dfbfc8dda697ccfd6545cf626d2b\"\u003e\u003ccode\u003e536ae51\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/536c5339035643fdca46ddd947f253afd072f764\"\u003e\u003ccode\u003e536c533\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/426b778e5ea490d164e572a63319c7cf2f362f2f\"\u003e\u003ccode\u003e426b778\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.18.7\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/a73cda9be3e57f29c53fea748f1f867eaa1457ab\"\u003e\u003ccode\u003ea73cda9\u003c/code\u003e\u003c/a\u003e Prep for 2.18.7 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/76b4a05087a9e42eb1b26f59d5b7028b0496da5e\"\u003e\u003ccode\u003e76b4a05\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.2...jackson-bom-2.21.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson:jackson-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d2.21.2\u0026new-version\u003d2.21.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2612 from dependabot[bot]/dependabot/maven/java/com.fasterxml.jackson-jackson-bom-2.21.3.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "3563ee5bdb1b461b0df425b7ccabb4aa12a4b30b",
      "tree": "2d19596e4ebf694359981238f7c23302c3812c4e",
      "parents": [
        "757c4fa107af1336c2bdd94288a951f4e8ede0bd"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 17:43:29 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 17:43:29 2026 +0800"
      },
      "message": "ORC-2161: [C++] UnionColumnReader should reject out-of-range union tags\n\n### What changes were proposed in this pull request?\n\nThis PR adds validation for C++ union tag values before they are used as child indexes.\n\nThe change covers:\n- UnionColumnReader::skip\n- UnionColumnReader::nextInternal\n- UnionColumnPrinter::printRow\n\nIf a malformed ORC file contains a union tag that is greater than or equal to the number of union children, the C++ reader/printer now throws ParseError instead of indexing out of bounds.\n\n### Why are the changes needed?\n\nUnion tags are decoded from the ORC data stream as byte values, but the valid range depends on the number of union children. Malformed input can contain a tag outside that range. The C++ reader previously trusted the tag value directly when indexing per-child state.\n\nThis patch makes malformed union tags fail cleanly.\n\n### How was this patch tested?\n\nAdded C++ unit tests for a two-child union with invalid tag value 200, covering:\n- next\n- next with nulls\n- skip\n- ColumnPrinter\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: OpenAI Codex GPT-5.\n\nCloses #2618 from wgtmac/fix_union.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "757c4fa107af1336c2bdd94288a951f4e8ede0bd",
      "tree": "69864dac40d2755ecfb50b1a5d842eefa15d9abc",
      "parents": [
        "6546fafadcfd76f3722041bba7d7c90913a6517e"
      ],
      "author": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 15:37:49 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu May 07 15:37:49 2026 +0800"
      },
      "message": "ORC-2159: [C++] Fix C++ build with nodiscard return values\n\n### What changes were proposed in this pull request?\n\nHandle protobuf and ZeroCopyStream boolean results required by newer headers. Check serialization and text-format failures in writer/tool code, and make affected tests assert parse, next, and skip results explicitly while preserving existing reader skip behavior.\n\n### Why are the changes needed?\n\nThe C++ build fails with newer protobuf / compiler headers because several boolean-returning APIs are marked nodiscard and their return values are ignored. Since the C++ build treats warnings as errors, these become hard build failures.\n\nThe build fails with errors like:\n\n  ColumnReader.cc:438:9: error: ignoring return value of function declared with \u0027nodiscard\u0027 attribute [-Werror,-Wunused-result]\n    inputStream_-\u003eSkip(static_cast\u003cint\u003e(step));\n\n  ColumnReader.cc:684:9: error: ignoring return value of function declared with \u0027nodiscard\u0027 attribute [-Werror,-Wunused-result]\n    blobStream_-\u003eSkip(static_cast\u003cint\u003e(step));\n\n  ColumnWriter.cc:215:5: error: ignoring return value of function declared with \u0027nodiscard\u0027 attribute [-Werror,-Wunused-result]\n    rowIndex-\u003eSerializeToZeroCopyStream(indexStream.get());\n\n### How was this patch tested?\n\nPass CIs and build are happy locally.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Codex Version 26.429.61741 (2429)\n\nCloses #2615 from wgtmac/fix_build.\n\nAuthored-by: Gang Wu \u003custcwg@gmail.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "6546fafadcfd76f3722041bba7d7c90913a6517e",
      "tree": "2150148ab77185103e3cc9f4fbf98bfbc1899726",
      "parents": [
        "7d302ebe69241a4c6089773a04f2a2a839203597"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon May 04 10:02:23 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon May 04 10:02:23 2026 -0700"
      },
      "message": "ORC-2158: Add 7-day cooldown to Dependabot maven updates\n\n### What changes were proposed in this pull request?\n\nThis PR adds a 7-day `cooldown` to Dependabot for the Maven ecosystem.\n\n```yaml\ncooldown:\n  default-days: 7\n```\n\n### Why are the changes needed?\n\nTo skip newly released versions until 7 days have passed, reducing the risk of importing early-release regressions and supply-chain attacks (e.g., compromised or malicious releases that are typically yanked or flagged within days of publication).\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7 (1M context)\n\nCloses #2614 from dongjoon-hyun/ORC-2158.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "7d302ebe69241a4c6089773a04f2a2a839203597",
      "tree": "e7e4ee61f999ec6126d4cfa24fa002a8ea8987de",
      "parents": [
        "69f56897acc7c7ecda86d495fc9081a877dda039"
      ],
      "author": {
        "name": "lisizhuo.lsz",
        "email": "lisizhuo.lsz@alibaba-inc.com",
        "time": "Thu Apr 30 00:18:47 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu Apr 30 00:18:47 2026 +0800"
      },
      "message": "ORC-2151: [C++] Move the timestamp compensation before timezone conversion to prevent incorrect DST offset lookup\n\n### What changes were proposed in this pull request?\nMoving the compensation to before the timezone conversion, we ensure that getVariant() always receives the corrected wall-clock time, producing the correct DST offset and an accurate final result.\n\n### Why are the changes needed?\nPreviously, the -1 second compensation for pre-1970 timestamps was applied after the writer-to-reader timezone adjustment. This means writerTimezone.getVariant(writerTime) was called with an uncorrected writerTime that could be 1 second larger than the true value. If this 1-second discrepancy happens to cross a DST (Daylight Saving Time) boundary, the timezone lookup would return an incorrect GMT offset, causing the final timestamp result to be off by the entire DST shift (typically 1 hour) rather than just 1 second.\n\n### Was this patch authored or co-authored using generative AI tooling?\nNo\n\nCloses #2609 from lszskye/fix_ts.\n\nAuthored-by: lisizhuo.lsz \u003clisizhuo.lsz@alibaba-inc.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "69f56897acc7c7ecda86d495fc9081a877dda039",
      "tree": "02bd4f7ddcf32138122d8f37caa8c3e109a381f9",
      "parents": [
        "58a1218ef101396572df595a290b8f3e2a4fbbdc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Apr 28 18:39:06 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Tue Apr 28 18:39:06 2026 +0800"
      },
      "message": "ORC-2157: Upgrade `gson` to 2.14.0\n\nBumps [com.google.code.gson:gson](https://github.com/google/gson) from 2.13.2 to 2.14.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/google/gson/releases\"\u003ecom.google.code.gson:gson\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eGson 2.14.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eAdd type adapters for \u003ccode\u003ejava.time\u003c/code\u003e classes by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2948\"\u003egoogle/gson#2948\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eWhen the \u003ccode\u003ejava.time\u003c/code\u003e API is available, Gson automatically can read and write instances of classes like \u003ccode\u003eInstant\u003c/code\u003e and \u003ccode\u003eDuration\u003c/code\u003e. The format it uses essentially freezes the JSON representation that \u003ccode\u003eReflectiveTypeAdapterFactory\u003c/code\u003e established by default, based on the private fields of \u003ccode\u003ejava.time\u003c/code\u003e classes. That\u0027s not a great representation, but it is understandable. Changing it to anything else would break compatibility with systems that are expecting the current format.\u003c/p\u003e\n\u003cp\u003eWith this change, Gson no longer tries to access private fields of these classes using reflection. So it is no longer necessary to run with \u003ccode\u003e--add-opens\u003c/code\u003e for these classes on recent JDKs.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRemove \u003ccode\u003ecom.google.gson.graph\u003c/code\u003e by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2990\"\u003egoogle/gson#2990\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThis package was not part of any released artifact and depended on Gson internals in potentially problematic ways.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eValidate that strings being parsed as integers consist of ASCII characters by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2995\"\u003egoogle/gson#2995\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003ePreviously, strings could contain non-ASCII Unicode digits and still be parsed as integers. That\u0027s inconsistent with how JSON numbers are treated.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix duplicate key detection when first value is null by \u003ca href\u003d\"https://github.com/andrewstellman\"\u003e\u003ccode\u003e​andrewstellman\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3006\"\u003egoogle/gson#3006\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis could potentially break code that was relying on the incorrect behaviour. For example, this JSON string was previously accepted but will no longer be: \u003ccode\u003e{\u0026quot;foo\u0026quot;: null, \u0026quot;foo\u0026quot;: bar}\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRemove \u003ccode\u003eSerializable\u003c/code\u003e from internal \u003ccode\u003eType\u003c/code\u003e implementation classes. by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3011\"\u003egoogle/gson#3011\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThe nested classes \u003ccode\u003eParameterizedTypeImpl\u003c/code\u003e, \u003ccode\u003eGenericArrayTypeImpl\u003c/code\u003e, and \u003ccode\u003eWildcardTypeImpl\u003c/code\u003e in \u003ccode\u003eGsonTypes\u003c/code\u003e are implementations of the corresponding types (without \u003ccode\u003eImpl\u003c/code\u003e) in \u003ccode\u003ejava.lang.reflect\u003c/code\u003e. For some reason, they were serializable, even though the \u003ccode\u003ejava.lang.reflect\u003c/code\u003e implementations are not. Having unnecessarily serializable classes could \u003cem\u003econceivably\u003c/em\u003e have been a security problem if they were part of a larger exploit using serialization. (We do not consider this a likely scenario and do not suggest that you need to update Gson just to get this change.)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003eLegacyProtoTypeAdapterFactory\u003c/code\u003e. by \u003ca href\u003d\"https://github.com/eamonnmcmanus\"\u003e\u003ccode\u003e​eamonnmcmanus\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3014\"\u003egoogle/gson#3014\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis is not part of any released artifact, but may be of use when trying to fix code that is currently accessing the internals of protobuf classes via reflection.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eMake AppendableWriter do flush and close if delegation object supports by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2925\"\u003egoogle/gson#2925\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eOther less visible changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd default capacity to EnumTypeAdapter maps by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2959\"\u003egoogle/gson#2959\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: move derived adapters from Gson to TypeAdapters by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2951\"\u003egoogle/gson#2951\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOptimize \u003ccode\u003enew Gson()\u003c/code\u003e by \u003ca href\u003d\"https://github.com/MukjepScarlet\"\u003e\u003ccode\u003e​MukjepScarlet\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2864\"\u003egoogle/gson#2864\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/ThirdGoddess\"\u003e\u003ccode\u003e​ThirdGoddess\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2944\"\u003egoogle/gson#2944\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lmj798\"\u003e\u003ccode\u003e​lmj798\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/2988\"\u003egoogle/gson#2988\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Eng-YasminKotb\"\u003e\u003ccode\u003e​Eng-YasminKotb\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3005\"\u003egoogle/gson#3005\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/andrewstellman\"\u003e\u003ccode\u003e​andrewstellman\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href\u003d\"https://redirect.github.com/google/gson/pull/3006\"\u003egoogle/gson#3006\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0\"\u003ehttps://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/3ff35d6269894901ab8006258395aafc4b9765cd\"\u003e\u003ccode\u003e3ff35d6\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release gson-parent-2.14.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/a3024fde2a5c12b9a9a0b6b914ae4899aa574d81\"\u003e\u003ccode\u003ea3024fd\u003c/code\u003e\u003c/a\u003e Bump the maven group with 13 updates (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3002\"\u003e#3002\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/5689ffe44952ca6ed44c595886b9043286311b23\"\u003e\u003ccode\u003e5689ffe\u003c/code\u003e\u003c/a\u003e Bump the github-actions group across 1 directory with 3 updates (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3018\"\u003e#3018\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/48db33cbf93af6b2f5b117dfdfd826de47f7229c\"\u003e\u003ccode\u003e48db33c\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003eLegacyProtoTypeAdapterFactory\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3014\"\u003e#3014\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/53d703ee76ca3e951fa4a727307c1f28dbcaf3aa\"\u003e\u003ccode\u003e53d703e\u003c/code\u003e\u003c/a\u003e Update outdated comment regarding serializable types (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3012\"\u003e#3012\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/0189b727761f31596d1a27b7c60b42478dc9f331\"\u003e\u003ccode\u003e0189b72\u003c/code\u003e\u003c/a\u003e Remove \u003ccode\u003eSerializable\u003c/code\u003e from internal \u003ccode\u003eType\u003c/code\u003e implementation classes. (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3011\"\u003e#3011\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/f4d371d29c04066dbe7fdb31f642831f9c7f40cd\"\u003e\u003ccode\u003ef4d371d\u003c/code\u003e\u003c/a\u003e Fix duplicate key detection when first value is null (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3006\"\u003e#3006\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/27d9ba1eeeeb156540cf5397504a4f9f256e911f\"\u003e\u003ccode\u003e27d9ba1\u003c/code\u003e\u003c/a\u003e Fix typo in README (JPMS dependencies section) (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/3005\"\u003e#3005\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/1fa9b7a0a994b006b3be00e2df9de778e71e6807\"\u003e\u003ccode\u003e1fa9b7a\u003c/code\u003e\u003c/a\u003e Validate that strings being parsed as integers consist of ASCII characters (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/google/gson/commit/b7d59549188867deb42e46073fb38735a5beda1c\"\u003e\u003ccode\u003eb7d5954\u003c/code\u003e\u003c/a\u003e Add iterator fail-fast tests for LinkedTreeMap.clear() (\u003ca href\u003d\"https://redirect.github.com/google/gson/issues/2992\"\u003e#2992\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.google.code.gson:gson\u0026package-manager\u003dmaven\u0026previous-version\u003d2.13.2\u0026new-version\u003d2.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2610 from dependabot[bot]/dependabot/maven/java/com.google.code.gson-gson-2.14.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "58a1218ef101396572df595a290b8f3e2a4fbbdc",
      "tree": "f8fd637d129227807092b89234f9f96caed5795f",
      "parents": [
        "61fd15507ab1002b051937e2ff0c9f8aee5d0360"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Apr 28 18:35:52 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Tue Apr 28 18:35:52 2026 +0800"
      },
      "message": "ORC-2156: Upgrade `brotli4j` to 1.23.0\n\nBumps [com.aayushatharva.brotli4j:brotli4j](https://github.com/hyperxpro/Brotli4j) from 1.22.0 to 1.23.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/releases\"\u003ecom.aayushatharva.brotli4j:brotli4j\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eBrotli4j v1.23.0 Release\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the actions group with 2 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/250\"\u003ehyperxpro/Brotli4j#250\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump io.netty:netty-buffer from 4.2.10.Final to 4.2.12.Final in the dependencies group by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/249\"\u003ehyperxpro/Brotli4j#249\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd per-pull output cap to decoder by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/251\"\u003ehyperxpro/Brotli4j#251\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare release and bump version to 1.23.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/252\"\u003ehyperxpro/Brotli4j#252\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.22.0...v1.23.0\"\u003ehttps://github.com/hyperxpro/Brotli4j/compare/v1.22.0...v1.23.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/205afeafd65d1e1c83f88a059e150687a1117426\"\u003e\u003ccode\u003e205afea\u003c/code\u003e\u003c/a\u003e Prepare release and bump version to 1.23.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/252\"\u003e#252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/3af3b973376a27923e0cdd94b7ac8aa53f301301\"\u003e\u003ccode\u003e3af3b97\u003c/code\u003e\u003c/a\u003e Add per-pull output cap to decoder (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/251\"\u003e#251\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/c860ffa60668ec5b5d8f0b3d378cc25c1d03ecd8\"\u003e\u003ccode\u003ec860ffa\u003c/code\u003e\u003c/a\u003e Bump io.netty:netty-buffer from 4.2.10.Final to 4.2.12.Final in the dependenc...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/ed4a3d7f2c017b4a2c2cbd6166ad61eac577c6a3\"\u003e\u003ccode\u003eed4a3d7\u003c/code\u003e\u003c/a\u003e Bump the actions group with 2 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/250\"\u003e#250\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.22.0...v1.23.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.aayushatharva.brotli4j:brotli4j\u0026package-manager\u003dmaven\u0026previous-version\u003d1.22.0\u0026new-version\u003d1.23.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2611 from dependabot[bot]/dependabot/maven/java/com.aayushatharva.brotli4j-brotli4j-1.23.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "61fd15507ab1002b051937e2ff0c9f8aee5d0360",
      "tree": "5c1ddde9af836ff50ba5d8d2c4d721f23a03d7a7",
      "parents": [
        "f352c856b773b99d986f1afe5d6d988d00c8a84f"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:17:01 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:17:01 2026 -0700"
      },
      "message": "ORC-2155: Upgrade `spotbugs-maven-plugin` to 4.9.8.3\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `spotbugs-maven-plugin` to 4.9.8.3.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes.\n- https://github.com/spotbugs/spotbugs-maven-plugin/releases/tag/spotbugs-maven-plugin-4.9.8.3\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7\n\nCloses #2608 from dongjoon-hyun/ORC-2155.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f352c856b773b99d986f1afe5d6d988d00c8a84f",
      "tree": "efef2a0a7ca8eb9fface5a057f0571a5ba7aabb2",
      "parents": [
        "f573536286f26b739b1b2b95334957b1d1179ecf"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:16:25 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:16:25 2026 -0700"
      },
      "message": "ORC-2154: Upgrade Guava to 33.6.0-jre\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade Guava to 33.6.0-jre.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes and improvements from the upstream Guava project.\n\n- https://github.com/google/guava/releases/tag/v33.6.0\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7\n\nCloses #2607 from dongjoon-hyun/ORC-2154.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f573536286f26b739b1b2b95334957b1d1179ecf",
      "tree": "5a11310dc5f9423b37ba1cc9293dd2ccb006b5e4",
      "parents": [
        "845eefaa2e7589fff58bd431fb315781dc3f1a67"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:15:42 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 14:15:42 2026 -0700"
      },
      "message": "ORC-2153: Upgrade `bcpkix-jdk18on` to 1.84\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `bcpkix-jdk18on` to 1.84.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes.\n- https://www.bouncycastle.org/download/bouncy-castle-java/#releasenotes\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7\n\nCloses #2606 from dongjoon-hyun/ORC-2153.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "845eefaa2e7589fff58bd431fb315781dc3f1a67",
      "tree": "b29a5f8b5e320e2d488089b48dbaaf1bf9245bc3",
      "parents": [
        "45435f1693df145fadf663d93682cd09f5fffccb"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 13:08:55 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 21 13:08:55 2026 -0700"
      },
      "message": "ORC-2152: Upgrade Maven to 3.9.15\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade Maven to 3.9.15.\n\n### Why are the changes needed?\n\nTo bring the latest bug fixes.\n- https://maven.apache.org/docs/3.9.15/release-notes.html\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.7 (1M context)\n\nCloses #2605 from dongjoon-hyun/ORC-2152.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "45435f1693df145fadf663d93682cd09f5fffccb",
      "tree": "be095b7d7fafb7ad54d873858808efe9912e6540",
      "parents": [
        "1ba55eaa7c2306a663a01289b81ce1e7007ea6c5"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Apr 15 13:38:44 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Apr 15 13:38:44 2026 -0700"
      },
      "message": "ORC-2150: Upgrade ZLIB to 1.3.2\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades the C++ ZLIB dependency from 1.3.1 to 1.3.2.\n\n### Why are the changes needed?\n\nTo keep the dependency up to date with the latest stable release.\n- https://www.zlib.net/ChangeLog.txt\n\n```\nChanges in 1.3.2 (17 Feb 2026)\n- Continued rewrite of CMake build [Vollstrecker]\n- Various portability improvements\n- Various github workflow additions and improvements\n- Check for negative lengths in crc32_combine functions\n- Copy only the initialized window contents in inflateCopy\n- Prevent the use of insecure functions without an explicit request\n- Add compressBound_z and deflateBound_z functions for large values\n- Use atomics to build inflate fixed tables once\n- Add definition of ZLIB_INSECURE to build tests with c89 and c94\n- Add --undefined option to ./configure for UBSan checker\n- Copy only the initialized deflate state in deflateCopy\n- Zero inflate state on allocation\n- Remove untgz from contrib\n- Add _z versions of the compress and uncompress functions\n- Vectorize the CRC-32 calculation on the s390x\n- Set bit 11 of the zip header flags in minizip if UTF-8\n- Update OS/400 support\n- Add a test to configure to check for a working compiler\n- Check for invalid NULL pointer inputs to zlib operations\n- Add --mandir to ./configure to specify manual directory\n- Add LICENSE.Info-Zip to contrib/minizip\n- Remove vstudio projects in lieu of cmake-generated projects\n- Replace strcpy() with memcpy() in contrib/minizip\n```\n\n### How was this patch tested?\n\nExisting tests.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code\n\nCloses #2602 from dongjoon-hyun/ORC-2150.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1ba55eaa7c2306a663a01289b81ce1e7007ea6c5",
      "tree": "a8892121b2026d015dee8f7a9b042f50d6739c74",
      "parents": [
        "f3f8fb74cb0e723ce099956dbebd28f9bc552988"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Apr 10 10:14:56 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Apr 10 10:14:56 2026 -0700"
      },
      "message": "ORC-2148: Upgrade `lz4-java` to 1.11.0\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `at.yawk.lz4:lz4-java` to 1.11.0.\n\n### Why are the changes needed?\n\nTo keep up with the latest version of `lz4-java`.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Opus 4.6\n\nCloses #2600 from dongjoon-hyun/ORC-2148.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f3f8fb74cb0e723ce099956dbebd28f9bc552988",
      "tree": "c78e3c6850ab1b5f42926df53ca90bef46de0724",
      "parents": [
        "2d6bd1e0a03705825d8c22edf98d1c0c4e3726f7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Apr 07 12:37:43 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Apr 07 12:37:43 2026 -0700"
      },
      "message": "ORC-2147: Upgrade Hadoop to 3.5.0\n\nBumps `hadoop.version` from 3.4.3 to 3.5.0.\nUpdates `org.apache.hadoop:hadoop-client-api` from 3.4.3 to 3.5.0\n\nUpdates `org.apache.hadoop:hadoop-client-runtime` from 3.4.3 to 3.5.0\n\nUpdates `org.apache.hadoop:hadoop-yarn-common` from 3.4.3 to 3.5.0\n\nUpdates `org.apache.hadoop:hadoop-mapreduce-client-core` from 3.4.3 to 3.5.0\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2599 from dependabot[bot]/dependabot/maven/java/hadoop.version-3.5.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "2d6bd1e0a03705825d8c22edf98d1c0c4e3726f7",
      "tree": "60b133739ea9bb9e534cfd8458367b0273695113",
      "parents": [
        "016b076998cbe08fdbbb6841d971accd863a9894"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 30 16:17:17 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 30 16:17:17 2026 -0700"
      },
      "message": "ORC-2146: Upgrade `brotli4j` to 1.22.0\n\nBumps [com.aayushatharva.brotli4j:brotli4j](https://github.com/hyperxpro/Brotli4j) from 1.20.0 to 1.22.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/releases\"\u003ecom.aayushatharva.brotli4j:brotli4j\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eBrotli4j v1.22.0 Release\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd native binary validation script by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/247\"\u003ehyperxpro/Brotli4j#247\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare release and bump version to 1.22.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/248\"\u003ehyperxpro/Brotli4j#248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eImportant Fix:\u003c/h2\u003e\n\u003cp\u003ev1.21.0 was released with missing native binaries for OSX aarch64 and OSX amd64; See \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/246\"\u003ehyperxpro/Brotli4j#246\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.21.0...v1.22.0\"\u003ehttps://github.com/hyperxpro/Brotli4j/compare/v1.21.0...v1.22.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eBrotli4j v1.21.0 Release\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CI workflow for Maven Central release by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/228\"\u003ehyperxpro/Brotli4j#228\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group with 5 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/229\"\u003ehyperxpro/Brotli4j#229\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump CMake to 3.5 min by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/238\"\u003ehyperxpro/Brotli4j#238\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 4 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/237\"\u003ehyperxpro/Brotli4j#237\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd hardwood project link to README by \u003ca href\u003d\"https://github.com/sullis\"\u003e\u003ccode\u003e​sullis\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/240\"\u003ehyperxpro/Brotli4j#240\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group with 2 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/241\"\u003ehyperxpro/Brotli4j#241\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSync with Brotli 1.2.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/242\"\u003ehyperxpro/Brotli4j#242\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the dependencies group across 1 directory with 12 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/235\"\u003ehyperxpro/Brotli4j#235\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 in the actions group by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/244\"\u003ehyperxpro/Brotli4j#244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the dependencies group with 3 updates by \u003ca href\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/243\"\u003ehyperxpro/Brotli4j#243\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRelease v1.21.0 by \u003ca href\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/pull/245\"\u003ehyperxpro/Brotli4j#245\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.20.0...v1.21.0\"\u003ehttps://github.com/hyperxpro/Brotli4j/compare/v1.20.0...v1.21.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/0dd11c1ac24b2b29a985cc6ff203e501cd7eea35\"\u003e\u003ccode\u003e0dd11c1\u003c/code\u003e\u003c/a\u003e Prepare release and bump version to 1.22.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/248\"\u003e#248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/91bc58b70cc3cb7fee1cb4a58c34cdd6bbd667c0\"\u003e\u003ccode\u003e91bc58b\u003c/code\u003e\u003c/a\u003e Add native binary validation script (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/247\"\u003e#247\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/4dce45f14df4e70999c2e722014d86090dedf8f3\"\u003e\u003ccode\u003e4dce45f\u003c/code\u003e\u003c/a\u003e Release v1.21.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/245\"\u003e#245\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/7d81bc37357e1ac1a68565a8f6459b5f04eb3351\"\u003e\u003ccode\u003e7d81bc3\u003c/code\u003e\u003c/a\u003e Bump the dependencies group with 3 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/243\"\u003e#243\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/7ecf24973ca6eca75231a658935b7827da66172e\"\u003e\u003ccode\u003e7ecf249\u003c/code\u003e\u003c/a\u003e Bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 in the actions group (...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/606013e4624e7a02c8450c0ed4e42c3ae75cfebf\"\u003e\u003ccode\u003e606013e\u003c/code\u003e\u003c/a\u003e Bump the dependencies group across 1 directory with 12 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/235\"\u003e#235\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/c462c361f3179809cb204c629958162a26e47e09\"\u003e\u003ccode\u003ec462c36\u003c/code\u003e\u003c/a\u003e Sync with Brotli 1.2.0 (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/242\"\u003e#242\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/9a27043baf5cffd0620924ada5a0006d72ccaa1c\"\u003e\u003ccode\u003e9a27043\u003c/code\u003e\u003c/a\u003e Bump the actions group with 2 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/241\"\u003e#241\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/4e1e36f57d253911df82ff25e66f010da5abe72b\"\u003e\u003ccode\u003e4e1e36f\u003c/code\u003e\u003c/a\u003e Add hardwood project link to README (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/240\"\u003e#240\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/commit/d65b3d2529c533b16cea08dd7c367cffa1594767\"\u003e\u003ccode\u003ed65b3d2\u003c/code\u003e\u003c/a\u003e Bump the actions group across 1 directory with 4 updates (\u003ca href\u003d\"https://redirect.github.com/hyperxpro/Brotli4j/issues/237\"\u003e#237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/hyperxpro/Brotli4j/compare/v1.20.0...v1.22.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.aayushatharva.brotli4j:brotli4j\u0026package-manager\u003dmaven\u0026previous-version\u003d1.20.0\u0026new-version\u003d1.22.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2597 from dependabot[bot]/dependabot/maven/java/com.aayushatharva.brotli4j-brotli4j-1.22.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "016b076998cbe08fdbbb6841d971accd863a9894",
      "tree": "44107cde703be6aa988824879c8bb6a7cc48f325",
      "parents": [
        "1d51a8bd093d7d0932f0006b2044c6d092ec960c"
      ],
      "author": {
        "name": "yongqian",
        "email": "yongqian@trip.com",
        "time": "Wed Mar 25 14:43:21 2026 +0800"
      },
      "committer": {
        "name": "Shaoyun Chen",
        "email": "csy@apache.org",
        "time": "Wed Mar 25 14:43:21 2026 +0800"
      },
      "message": "ORC-2131: Set default of orc.stripe.size.check.ratio and orc.dictionary.max.size.bytes to 0\n\n### What changes were proposed in this pull request?\n\nSet default of `orc.stripe.size.check.ratio` and `orc.dictionary.max.size.bytes` to 0\n\n### Why are the changes needed?\n\nAfter enabling the optimizations related to orc.stripe.size.check.ratio and orc.dictionary.max.size.bytes, we observed that ORC files written with the current defaults are about 10%–20% larger than before. For example, datasets that were previously ~1.0–1.1 TB grow to ~1.2 TB with the current defaults, causing noticeable storage cost increase.\n\n### How was this patch tested?\nLocal test\n\nWith orc.dictionary.max.size.bytes\u003d16777216 or orc.stripe.size.check.ratio\u003d2.0, the written ORC data grows to 1.2 TB (data inflation).\n\n```shell\n           1         6665      1300347279057 hdfs://ns/user/hive/warehouse/tmp_sandbox_xxx.db/tmp_test_123_2/d\u003d2026-03-15\n```\n\nWith orc.dictionary.max.size.bytes\u003d0 and orc.stripe.size.check.ratio\u003d0.0, the data size remains at the expected 1.0 TB.\n```shell\n           1         6665      1143347882367 hdfs://ns/user/hive/warehouse/tmp_sandbox_xxx.db/tmp_test_123_1/d\u003d2026-03-15\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNo\n\nCloses #2580 from QianyongY/features/ORC-2131.\n\nAuthored-by: yongqian \u003cyongqian@trip.com\u003e\nSigned-off-by: Shaoyun Chen \u003ccsy@apache.org\u003e\n"
    },
    {
      "commit": "1d51a8bd093d7d0932f0006b2044c6d092ec960c",
      "tree": "6a635fc37173551908ee2369338921075ee53b8d",
      "parents": [
        "9b170ed8ff3b691277324ed9bef0726634d40aae"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 22:49:08 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 22:49:08 2026 -0700"
      },
      "message": "ORC-2145: Add `CLAUDE.md` for `Claude Code`\n\n### What changes were proposed in this pull request?\n\nThis PR adds a `CLAUDE.md` file at the repository root that references `AGENTS.md` using the `AGENTS.md` import directive, enabling Claude Code to automatically load the AI agent guidelines.\n\n### Why are the changes needed?\n\n`AGENTS.md` already contains comprehensive guidelines for AI coding assistants. By adding a `CLAUDE.md` that imports it, Claude Code sessions will automatically load these guidelines without duplicating content. This keeps `AGENTS.md` as the single source of truth.\n\n### How was this patch tested?\n\nThis is a documentation-only change. Verified the file was created correctly with the expected content.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2595 from dongjoon-hyun/ORC-2145.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "9b170ed8ff3b691277324ed9bef0726634d40aae",
      "tree": "e729f75574e5207b2d20d4096d38fd95f1f7ab3f",
      "parents": [
        "440fa1b6a0df7e1dd771ee9adcf87f9d1c3a5fb0"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 21:58:49 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 24 21:58:49 2026 -0700"
      },
      "message": "ORC-2144: Upgrade `byte-buddy` to 1.18.7\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `byte-buddy` and `byte-buddy-agent` to 1.18.7.\n\n### Why are the changes needed?\n\nTo keep the test dependency up to date with the latest bug fixes and improvements.\n- https://github.com/raphw/byte-buddy/releases/tag/byte-buddy-1.18.7\n- https://github.com/raphw/byte-buddy/releases/tag/byte-buddy-1.18.5\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-4-opus)\n\nCloses #2594 from dongjoon-hyun/ORC-2144.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "440fa1b6a0df7e1dd771ee9adcf87f9d1c3a5fb0",
      "tree": "8b40ff8cafc287b4b696a53a1247eb061ca9103d",
      "parents": [
        "f22a2d69c1c60a2a6090e45c1d75ef64aafedc60"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:33:27 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:33:27 2026 -0700"
      },
      "message": "ORC-2142: Upgrade `maven-surefire-plugin` to 3.5.5\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `maven-surefire-plugin` to 3.5.5.\n\n### Why are the changes needed?\n\nTo keep the dependency up to date with the latest release\n- https://github.com/apache/maven-surefire/releases/tag/surefire-3.5.5 (2026-02-18)\n- https://github.com/apache/maven-surefire/releases/tag/maven-surefire-3.5.4\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2592 from dongjoon-hyun/dongjoon/youthful-darwin.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "f22a2d69c1c60a2a6090e45c1d75ef64aafedc60",
      "tree": "85a53ee1889427173c9144be01247af75e95c5d5",
      "parents": [
        "3ebeed865fa7e4bac59e0bf6f8cb6c71236170f6"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:32:36 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 15:32:36 2026 -0700"
      },
      "message": "ORC-2141: Upgrade `spotbugs` to 4.9.8\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `spotbugs` to 4.9.8.\n\n### Why are the changes needed?\n\nTo bring the dependency up to date with the latest release.\n\n### How was this patch tested?\n\nPass the existing CI.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2591 from dongjoon-hyun/dongjoon/condescending-ellis.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "3ebeed865fa7e4bac59e0bf6f8cb6c71236170f6",
      "tree": "5e50ef853c3123049faf4799b937d95df824f80d",
      "parents": [
        "acb12adcad2e044d956b46bfff4e4604f2490c09"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:48:09 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:48:09 2026 -0700"
      },
      "message": "ORC-2143: Add `AGENTS.md` for AI coding assistants\n\n### What changes were proposed in this pull request?\nThis PR introduces an `AGENTS.md` file at the root of the repository. `AGENTS.md` is a dedicated documentation file intended to guide AI coding assistants (such as GitHub Copilot, Cursor, Gemini, etc.) when they are used by contributors.\n\nIt provides AI agents with essential project context, including:\n- The separation of C++ (`c++/`) and Java (`java/`) modules\n- Accurate build and testing commands (CMake / Maven wrap)\n- Issue tracking conventions (requiring JIRA `ORC-XXXX`, `dev/create_orc_jira.py`)\n- Recommended local multi-environment testing strategy [docker/run-all.sh] and personal fork GitHub Actions tests.\n\n### Why are the changes needed?\nAs more developers use AI-assisted tools for coding, these tools often lack repository-specific context, leading to incorrect assumptions (e.g., suggesting raw `mvn` instead of `./mvnw`, or standard CMake instead of `make test-out`). This guideline will significantly improve the quality, accuracy, and compliance of the code and commands generated by AI agents for both new and existing contributors.\n\n### How was this patch tested?\n\nManual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`.\n\nCloses #2593 from dongjoon-hyun/ORC-2143.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "acb12adcad2e044d956b46bfff4e4604f2490c09",
      "tree": "b0a7aab956e49c81e0fcfcbc0144832e7fa49eb5",
      "parents": [
        "ccce00ad850435d158b3b51ab40b3e6a9e5acba0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 23 14:04:45 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:04:45 2026 -0700"
      },
      "message": "ORC-2140: Upgrade `spotless-maven-plugin` to 3.4.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.3.0 to 3.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eMaven Plugin v3.4.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003etableTest\u003c/code\u003e format type for standalone \u003ccode\u003e.table\u003c/code\u003e files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003etabletest-formatter\u003c/code\u003e version \u003ccode\u003e1.0.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e1.1.1\u003c/code\u003e, now works with Java 17+. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eLib v3.3.1\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eGitPrePushHookInstaller\u003c/code\u003e didn\u0027t work on windows, now fixed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2562\"\u003e#2562\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003espotless-lib and spotless-lib-extra releases\u003c/h1\u003e\n\u003cp\u003eIf you are a Spotless user (as opposed to developer), then you are probably looking for:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\"\u003ehttps://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis document is intended for Spotless developers.\u003c/p\u003e\n\u003cp\u003eWe adhere to the \u003ca href\u003d\"https://keepachangelog.com/en/1.0.0/\"\u003ekeepachangelog\u003c/a\u003e format (starting after version \u003ccode\u003e1.27.0\u003c/code\u003e).\u003c/p\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[4.5.0] - 2026-03-18\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003etableTest\u003c/code\u003e format type for standalone \u003ccode\u003e.table\u003c/code\u003e files. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003etabletest-formatter\u003c/code\u003e version \u003ccode\u003e1.0.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e1.1.1\u003c/code\u003e, now works with Java 17+. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2880\"\u003e#2880\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.4.0] - 2026-03-02\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003etabletest-formatter\u003c/code\u003e support for Java and Kotlin. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2860\"\u003e#2860\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix the ability to specify a wildcard version (\u003ccode\u003e*\u003c/code\u003e) for external formatter executables, which did not work. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2848\"\u003e#2848\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[fix] \u003ccode\u003eConcurrentModificationException\u003c/code\u003e in \u003ccode\u003eexpandWildcardImports\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2830\"\u003e#2830\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.3.0] - 2026-01-27\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eP2Provisioner\u003c/code\u003e interface in lib-extra to enable build-tool-specific caching strategies for Eclipse P2 dependencies, fixing OutOfMemoryError in large multi-project builds. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2788\"\u003e#2788\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eremoveSemicolons()\u003c/code\u003e should not be applied to multiline strings in groovy \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2780\"\u003e#2780\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2792\"\u003e#2792\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.2.0] - 2026-01-22\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a \u003ccode\u003eexpandWildcardImports\u003c/code\u003e API for java (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2594\"\u003e#2679\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd the ability to specify a wildcard version (\u003ccode\u003e*\u003c/code\u003e) for external formatter executables. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2757\"\u003e#2757\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePrevent race conditions when multiple npm-based formatters launch the server process simultaneously while sharing the same \u003ccode\u003enode_modules\u003c/code\u003e directory. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2786\"\u003e#2786\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGit ratchet no longer throws an error with Git worktrees. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2779\"\u003e#2779\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003ektfmt\u003c/code\u003e version to latest \u003ccode\u003e0.59\u003c/code\u003e -\u0026gt; \u003ccode\u003e0.61\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2804\"\u003e2804\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ektlint\u003c/code\u003e version to latest \u003ccode\u003e1.7.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e1.8.0\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2763\"\u003e2763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egherkin-utils\u003c/code\u003e version to latest \u003ccode\u003e9.2.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e10.0.0\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2619\"\u003e#2619\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[4.1.0] - 2025-11-18\u003c/h2\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003ektfmt\u003c/code\u003e version to latest \u003ccode\u003e0.58\u003c/code\u003e -\u0026gt; \u003ccode\u003e0.59\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2681\"\u003e#2681\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejackson\u003c/code\u003e version to latest \u003ccode\u003e2.20.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.20.1\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2730\"\u003e#2730\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ecleanthat\u003c/code\u003e version to latest \u003ccode\u003e2.23\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.24\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2620\"\u003e#2620\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/708a1b0e6383ad2dd34cf3def185bb085a786789\"\u003e\u003ccode\u003e708a1b0\u003c/code\u003e\u003c/a\u003e Published maven/3.4.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/1cc0163c25b52824cd57b56cdcb8c4cb0c7b4795\"\u003e\u003ccode\u003e1cc0163\u003c/code\u003e\u003c/a\u003e Published gradle/8.4.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a4cd808f6092c6ed9371205de4af5285beea9533\"\u003e\u003ccode\u003ea4cd808\u003c/code\u003e\u003c/a\u003e Published lib/4.5.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/9066bf6ede907e913fbe30259de0763f1b0b55ea\"\u003e\u003ccode\u003e9066bf6\u003c/code\u003e\u003c/a\u003e Add links to the changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/db8dc1cc8e83b18ef357a0e660f03556fd792247\"\u003e\u003ccode\u003edb8dc1c\u003c/code\u003e\u003c/a\u003e Fix for illegal mutation issue with \u003ccode\u003epredeclareDeps\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2892\"\u003e#2892\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/0eb98a9574304e362f0ca6ddbfb71617de46df75\"\u003e\u003ccode\u003e0eb98a9\u003c/code\u003e\u003c/a\u003e chore: Updated gradle plugin change\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/3f7f12e649b1085a7937b8730e6a7689a52ca6da\"\u003e\u003ccode\u003e3f7f12e\u003c/code\u003e\u003c/a\u003e chore: Removes check for predeclare as it\u0027s not needed anymore\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/55c0c5c081b83ad35e92911718e3069a64467c2a\"\u003e\u003ccode\u003e55c0c5c\u003c/code\u003e\u003c/a\u003e fix: IsolatedProjectTest.predeclaredIsUnsupported() is now actually supported...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/47489afd92aa79f56372bd53e82d09a44f606a32\"\u003e\u003ccode\u003e47489af\u003c/code\u003e\u003c/a\u003e fix: avoid IllegalMutationException when root project uses predeclareDeps() w...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/4010e8b42c32b8dfac31a988c6820b6b0ef499bd\"\u003e\u003ccode\u003e4010e8b\u003c/code\u003e\u003c/a\u003e test: Introduce a test harnessing predeclared deps\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/lib/3.3.0...maven/3.4.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.3.0\u0026new-version\u003d3.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2589 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.4.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "ccce00ad850435d158b3b51ab40b3e6a9e5acba0",
      "tree": "e795b9c1dc0947111257c6eb49f2fd81d6fdd8ad",
      "parents": [
        "ef96e73073bf57b803a72090c879d6915629b0d9"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:01:37 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 14:01:37 2026 -0700"
      },
      "message": "ORC-2139: Improve `create_orc_jira.py` to provide no-commit feature\n\n### What changes were proposed in this pull request?\n\nAdd `-n`/`--no-commit` option to `dev/create_orc_jira.py` to skip the commit step after branch creation.\n\n### Why are the changes needed?\n\nWhen there are no changes to commit, `git commit -a` fails. This option allows users to create a JIRA issue and branch without forcing a commit.\n\n### How was this patch tested?\n\nManual testing with `--help` to verify the new option is displayed, and with `-n` flag to confirm the commit step is skipped.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2590 from dongjoon-hyun/ORC-2139.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "ef96e73073bf57b803a72090c879d6915629b0d9",
      "tree": "c779407ad137aa42e2da353b4c4f9b54f24b67a6",
      "parents": [
        "1d5387e56b2b6cd48e73bf8176903888bbd262ca"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 23 13:45:00 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 23 13:45:00 2026 -0700"
      },
      "message": "ORC-2138: Upgrade `jackson` to 2.21.2\n\nBumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.1 to 2.21.2.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/10e12a55b0a1d0caaa82b8b41101e8ecd39ed976\"\u003e\u003ccode\u003e10e12a5\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release jackson-bom-2.21.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/d75490376b71e112c18fbe4d5f43a984bb2b2d6d\"\u003e\u003ccode\u003ed754903\u003c/code\u003e\u003c/a\u003e Prep for 2.21.2 release\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/63e1b3bb3e115e40580cd8c57263955d4fcbee24\"\u003e\u003ccode\u003e63e1b3b\u003c/code\u003e\u003c/a\u003e Post-release dep version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/commit/716ab0d1d95d45d07e9f00f5b8a889f500375981\"\u003e\u003ccode\u003e716ab0d\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare for next development iteration\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href\u003d\"https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.1...jackson-bom-2.21.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.fasterxml.jackson:jackson-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d2.21.1\u0026new-version\u003d2.21.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2588 from dependabot[bot]/dependabot/maven/java/com.fasterxml.jackson-jackson-bom-2.21.2.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "1d5387e56b2b6cd48e73bf8176903888bbd262ca",
      "tree": "246f4f4076ffa5dfb90ea44b5642008a223ed092",
      "parents": [
        "25d32b7a71505cabff68a37f93e99dcfee1a67e9"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 02:19:18 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 02:19:18 2026 -0700"
      },
      "message": "ORC-2137: Upgrade `kryo-shaded` to 4.0.3\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `kryo-shaded` from 4.0.2 to 4.0.3.\n\n### Why are the changes needed?\n\nTo bring in the latest patch release of `kryo-shaded`.\n\n- https://github.com/EsotericSoftware/kryo/compare/kryo-parent-4.0.2...kryo-parent-4.0.3\n  - https://github.com/EsotericSoftware/kryo/issues/651\n  - https://github.com/EsotericSoftware/kryo/issues/850\n  - https://github.com/EsotericSoftware/kryo/issues/978\n\nIn addition, Apache Spark 4.0+ has been using `4.0.3`.\n- apache/spark#50586\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2587 from dongjoon-hyun/ORC-2137.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "25d32b7a71505cabff68a37f93e99dcfee1a67e9",
      "tree": "cc6c42d6d57cdbaaae8b60e9f4aa3c8d0070ba8b",
      "parents": [
        "b2dc0f8d20f512d3b8b6fed40bf1f4cf627cb98f"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 00:39:15 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Sat Mar 21 00:39:15 2026 -0700"
      },
      "message": "ORC-2135: Upgrade `mockito` to 5.23.0\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `mockito` to 5.23.0 to bring Java 25 related bug fix.\n\n### Why are the changes needed?\n\nTo keep the test dependency up to date with the latest bug fixes.\n- https://github.com/mockito/mockito/releases/tag/v5.23.0\n- https://github.com/mockito/mockito/releases/tag/v5.22.0\n  - https://github.com/mockito/mockito/issues/3778\n  - https://github.com/mockito/mockito/pull/3785\n\n### How was this patch tested?\n\nPass the CIs with the existing tests.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2585 from dongjoon-hyun/ORC-2135.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "b2dc0f8d20f512d3b8b6fed40bf1f4cf627cb98f",
      "tree": "92957df9b4059c07bfdb18b80ba40b0acc4fb96f",
      "parents": [
        "c23ed58a943a3f443c5541db9a6b450076791285"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 23:31:28 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 23:31:28 2026 -0700"
      },
      "message": "ORC-2134: Remove `microsoft/setup-msbuild` from GitHub Actions jobs\n\n### What changes were proposed in this pull request?\n\nRemove `microsoft/setup-msbuild` from GitHub Actions jobs.\n\n### Why are the changes needed?\n\nCurrently, the CI is broken because `microsoft/setup-msbuild` is no longer allowed by ASF Infra patterns.\n- https://github.com/apache/orc/actions/runs/23372953082\n\u003e microsoft/setup-msbuildv1.1 is not allowed in apache/orc because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: ...\n\nTechnically, the `windows-2025` runner already includes MSBuild in PATH, so the `microsoft/setup-msbuildv1.1` step is unnecessary.\n\n### How was this patch tested?\n\nPassed the existing GitHub Actions.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2584 from dongjoon-hyun/ORC-2134.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "c23ed58a943a3f443c5541db9a6b450076791285",
      "tree": "1452790b2f7c0898242420cedbce0c24d27fab6b",
      "parents": [
        "ebd9e98704c897190efc2293dd3626ed235873ea"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 22:28:30 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Fri Mar 20 22:28:30 2026 -0700"
      },
      "message": "ORC-2133: Remove `Super-Linter` from GitHub Actions jobs\n\n### What changes were proposed in this pull request?\n\nRemove `Super-Linter` from GitHub Actions jobs.\n\n### Why are the changes needed?\n\n`Super-Linter` is no longer allowed by ASF Infra patterns.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2582 from dongjoon-hyun/ORC-2133.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "ebd9e98704c897190efc2293dd3626ed235873ea",
      "tree": "154fa3b692e712c7d5813207600db1a19ba6ebc6",
      "parents": [
        "ed2a47ed322c9c960ba16e0f2fc518b2b8723ff0"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 17 11:31:24 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 17 11:31:24 2026 -0700"
      },
      "message": "ORC-2132: Use Java 26 instead of 26-ea\n\n### What changes were proposed in this pull request?\n\nThis PR replaces `26-ea` (early access) with the GA release `26` for the Java version used in the `build_and_test.yml` GitHub Actions workflow.\n\n### Why are the changes needed?\n\nJava 26 has been released as GA, so we should use the stable release instead of the early-access version.\n\n### How was this patch tested?\n\nPass the GitHub Actions workflow with the updated Java version.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2581 from dongjoon-hyun/ORC-2132.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "ed2a47ed322c9c960ba16e0f2fc518b2b8723ff0",
      "tree": "eaec40b776cbd014c1dbe4731ec4a6108ff7e9d1",
      "parents": [
        "439d4e9611f220e1f87dbb8fc600036fd0cc5dfd"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 16 13:31:10 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 16 13:31:10 2026 -0700"
      },
      "message": "ORC-2130: Upgrade Maven to 3.9.14\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `Maven` to 3.9.14.\n\n### Why are the changes needed?\n\nTo use the latest Maven version which fixes only one known issue.\n- https://maven.apache.org/docs/3.9.14/release-notes.html\n  - https://github.com/apache/maven/issues/11762\n- https://github.com/apache/maven/releases/tag/maven-3.9.14\n\n### How was this patch tested?\n\nPass the existing CI.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (claude-opus-4-6)\n\nCloses #2579 from dongjoon-hyun/ORC-2130.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "439d4e9611f220e1f87dbb8fc600036fd0cc5dfd",
      "tree": "a6b63dc53e33f33df3f4842eb158c8051f118356",
      "parents": [
        "dff5e92d304c83557f0ee92c578c9d55c04c6e0e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 16 11:58:35 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 16 11:58:35 2026 -0700"
      },
      "message": "ORC-2129: Upgrade `extra-enforcer-rules` to 1.12.0\n\nBumps [org.codehaus.mojo:extra-enforcer-rules](https://github.com/mojohaus/extra-enforcer-rules) from 1.11.0 to 1.12.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/releases\"\u003eorg.codehaus.mojo:extra-enforcer-rules\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.12.0\u003c/h2\u003e\n\u003ch2\u003e🚀 New features and improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRecognize newer and future JDK versions (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/350\"\u003e#350\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMove EnforceManagedDepsRule from \u003ca href\u003d\"https://github.com/jdcasey/enforce-managed-deps-rule\"\u003ehttps://github.com/jdcasey/enforce-managed-deps-rule\u003c/a\u003e (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/338\"\u003e#338\u003c/a\u003e) \u003ca href\u003d\"https://github.com/akuhtz\"\u003e\u003ccode\u003e​akuhtz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📝 Documentation updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDocument POM inheritance for banDuplicateClasses using combine.children (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/341\"\u003e#341\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/copilot-swe-agent\"\u003ecopilot-swe-agent[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUse TempDir in setup method in ClassFileTest (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/348\"\u003e#348\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eJUnit 5 best practices (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/343\"\u003e#343\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 95 to 96 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/352\"\u003e#352\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.tomcat:tomcat-catalina from 9.0.112 to 9.0.113 in /src/it/mojo-1682 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/351\"\u003e#351\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.tomcat:tomcat-catalina from 9.0.110 to 9.0.112 in /src/it/mojo-1682 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/349\"\u003e#349\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.20.0 to 1.21.0 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/347\"\u003e#347\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mojo-parent from 94 to 95 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/346\"\u003e#346\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump commons-codec:commons-codec from 1.19.0 to 1.20.0 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/345\"\u003e#345\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.tomcat:tomcat-catalina from 9.0.107 to 9.0.110 in /src/it/mojo-1682 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/pull/340\"\u003e#340\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/4684a445dad0ef1c700528b667e95c6391838b6f\"\u003e\u003ccode\u003e4684a44\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release 1.12.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/0e2baf74fc1776c6a99c7ae4d532213130f9f594\"\u003e\u003ccode\u003e0e2baf7\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.mojo:mojo-parent from 95 to 96 (\u003ca href\u003d\"https://redirect.github.com/mojohaus/extra-enforcer-rules/issues/352\"\u003e#352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/d5f20f136abf13d695ebfa31799a9267bc1a35b2\"\u003e\u003ccode\u003ed5f20f1\u003c/code\u003e\u003c/a\u003e Recognize newer and future JDK versions\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/8c0034434c44faf7f605133c422b26481cbcc6ff\"\u003e\u003ccode\u003e8c00344\u003c/code\u003e\u003c/a\u003e Bump org.apache.tomcat:tomcat-catalina in /src/it/mojo-1682\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/53ca18d17f80545b218fc6c757f9513ca84c87cc\"\u003e\u003ccode\u003e53ca18d\u003c/code\u003e\u003c/a\u003e Bump org.apache.tomcat:tomcat-catalina in /src/it/mojo-1682\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/37bd9b82a8a6dcc6fb94a3c75d94a44787f2a35a\"\u003e\u003ccode\u003e37bd9b8\u003c/code\u003e\u003c/a\u003e Move EnforceManagedDepsRule from \u003ca href\u003d\"https://github.com/jdcasey/enforce-managed-d\"\u003ehttps://github.com/jdcasey/enforce-managed-d\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/44abff9b52f67f48c749040097e1ce2f2314a15e\"\u003e\u003ccode\u003e44abff9\u003c/code\u003e\u003c/a\u003e Use TempDir in setup method in ClassFileTest\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/38108a9fffafb4baf9e878142529df02bb916352\"\u003e\u003ccode\u003e38108a9\u003c/code\u003e\u003c/a\u003e Bump commons-codec:commons-codec from 1.20.0 to 1.21.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/04adfadab06b0a7532ca542bd36599441c203c83\"\u003e\u003ccode\u003e04adfad\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.mojo:mojo-parent from 94 to 95\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/commit/8c3bde4fde4d5daf20aa119f3c5e404f687a432a\"\u003e\u003ccode\u003e8c3bde4\u003c/code\u003e\u003c/a\u003e Bump commons-codec:commons-codec from 1.19.0 to 1.20.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/mojohaus/extra-enforcer-rules/compare/1.11.0...1.12.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.codehaus.mojo:extra-enforcer-rules\u0026package-manager\u003dmaven\u0026previous-version\u003d1.11.0\u0026new-version\u003d1.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2578 from dependabot[bot]/dependabot/maven/java/org.codehaus.mojo-extra-enforcer-rules-1.12.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "dff5e92d304c83557f0ee92c578c9d55c04c6e0e",
      "tree": "0f9a108124fcc4cc08c4b95c857730ea31d15452",
      "parents": [
        "3eaa9e610d511585aa5a88948f693cdd90b4802e"
      ],
      "author": {
        "name": "daidai",
        "email": "changyuwei@selectdb.com",
        "time": "Thu Mar 12 17:51:58 2026 +0800"
      },
      "committer": {
        "name": "Gang Wu",
        "email": "ustcwg@gmail.com",
        "time": "Thu Mar 12 17:51:58 2026 +0800"
      },
      "message": "ORC-2123: [C++] Fix heap-use-after-free in ORC SearchArgument rewriteLeaves\n\n### What changes were proposed in this pull request?\n\nThis PR aims to fix heap-use-after-free in ORC SearchArgument rewriteLeaves.\n\n### Why are the changes needed?\n\nthis is a heap-use-after-free bug.\n\n```\n\u003d\u003d1649778\u003d\u003dERROR: AddressSanitizer: heap-use-after-free on address 0x7d0addc552f8 at pc 0x5561f1da808c bp 0x79e18a173b40 sp 0x79e18a173b38\nREAD of size 8 at 0x7d0addc552f8 thread T621 (rs_normal [work)\n    #0 0x5561f1da808b in std::__shared_count\u003c(__gnu_cxx::_Lock_policy)2\u003e::__shared_count(std::__shared_count\u003c(__gnu_cxx::_Lock_policy)2\u003e const\u0026) /mnt/disk2/tengjianping/local/ldb_toolchain/bin/../lib/gcc/x86_64-pc-linux-gnu/15/include/g++-v15/bits/shared_ptr_base.h:1073:19\n    #1 0x55622c94b9ce in std::__shared_ptr\u003corc::ExpressionTree, (__gnu_cxx::_Lock_policy)2\u003e::__shared_ptr(std::__shared_ptr\u003corc::ExpressionTree, (__gnu_cxx::_Lock_policy)2\u003e const\u0026) (/mnt/disk2/tengjianping/doris-master/output/be/lib/doris_be+0x8b6e99ce)\n    #2 0x55622c94849c in std::shared_ptr\u003corc::ExpressionTree\u003e::shared_ptr(std::shared_ptr\u003corc::ExpressionTree\u003e const\u0026) (/mnt/disk2/tengjianping/doris-master/output/be/lib/doris_be+0x8b6e649c)\n    #3 0x55622c94d976 in std::__detail::_Hash_node\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e, false\u003e* std::__detail::_Hashtable_alloc\u003cstd::allocator\u003cstd::__detail::_Hash_node\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e, false\u003e\u003e\u003e::_M_allocate_node\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e const\u0026\u003e(std::shared_ptr\u003corc::ExpressionTree\u003e const\u0026) (/mnt/disk2/tengjianping/doris-master/output/be/lib/doris_be+0x8b6eb976)\n    #4 0x55622c94d7cb in std::pair\u003cstd::__detail::_Node_iterator\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e, true, false\u003e, bool\u003e std::_Hashtable\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e, std::shared_ptr\u003corc::ExpressionTree\u003e, std::allocator\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::__detail::_Identity, std::equal_to\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::hash\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits\u003cfalse, true, true\u003e\u003e::_M_emplace_uniq\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e const\u0026\u003e(std::shared_ptr\u003corc::ExpressionTree\u003e const\u0026) (/mnt/disk2/tengjianping/doris-master/output/be/lib/doris_be+0x8b6eb7cb)\n    #5 0x55622c94d62c in std::_Hashtable\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e, std::shared_ptr\u003corc::ExpressionTree\u003e, std::allocator\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::__detail::_Identity, std::equal_to\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::hash\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits\u003cfalse, true, true\u003e\u003e::insert(std::shared_ptr\u003corc::ExpressionTree\u003e const\u0026) (/mnt/disk2/tengjianping/doris-master/output/be/lib/doris_be+0x8b6eb62c)\n    #6 0x55622c94d3dc in std::unordered_set\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e, std::hash\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::equal_to\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e, std::allocator\u003cstd::shared_ptr\u003corc::ExpressionTree\u003e\u003e\u003e::insert(std::shared_ptr\u003corc::ExpressionTree\u003e const\u0026) (/mnt/disk2/tengjianping/doris-master/output/be/lib/doris_be+0x8b6eb3dc)\n    #7 0x55622c947db0 in orc::rewriteLeaves(std::shared_ptr\u003corc::ExpressionTree\u003e, unsigned long*) SearchArgument.cc\n    #8 0x55622c947809 in orc::SearchArgumentBuilderImpl::build() (/mnt/disk2/tengjianping/doris-master/output/be/lib/doris_be+0x8b6e5809)\n```\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nNO\n\nCloses #2572 from hubgeter/fix_orc_core.\n\nAuthored-by: daidai \u003cchangyuwei@selectdb.com\u003e\nSigned-off-by: Gang Wu \u003custcwg@gmail.com\u003e\n"
    },
    {
      "commit": "3eaa9e610d511585aa5a88948f693cdd90b4802e",
      "tree": "16c9fbe96c8419a0c56569edce5d473e8a5b812c",
      "parents": [
        "41642e3a1bdb71d9d6c6b057cab4cc73ae37e54b"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 10 09:13:07 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Tue Mar 10 09:13:07 2026 -0700"
      },
      "message": "ORC-2128: Add `since` Javadoc tags to all public `orc-core` class/interface/enum\n\n### What changes were proposed in this pull request?\n\nThis PR adds `since` Javadoc tags to all public classes, interfaces, and enums in `orc-core` module. The version for each `since` tag was determined from git history by finding the earliest release tag (`rel/release-*`) containing the commit that first introduced each file.\n\n- Skipped third-party vendored code under `org.threeten.extra.chrono`\n- Skipped package-private classes\n\n### Why are the changes needed?\n\nThe `since` Javadoc tag is a standard practice for documenting API versioning in Java libraries. Currently, only 3 out of 162+ public types in `orc-core` have `since` tags. Adding these tags improves API documentation and helps users understand which version introduced each class.\n\n### How was this patch tested?\n\nPass the CIs and manual review.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2577 from dongjoon-hyun/ORC-2128.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "41642e3a1bdb71d9d6c6b057cab4cc73ae37e54b",
      "tree": "347c3accf7cfe99db5d53ad0a351093712d3e6ca",
      "parents": [
        "4458fe8251841d75e00a52e175194789545f9dd7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 09 10:55:51 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 09 10:55:51 2026 -0700"
      },
      "message": "ORC-2127: Upgrade `spotless-maven-plugin` to 3.3.0\n\nBumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.2.1 to 3.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/releases\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eLib v3.3.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow specifying path to Biome JSON config file directly in \u003ccode\u003ebiome\u003c/code\u003e step. Requires biome 2.x. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2548\"\u003e#2548\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eGitPrePushHookInstaller\u003c/code\u003e, a reusable library component for installing a Git \u003ccode\u003epre-push\u003c/code\u003e hook that runs formatter checks. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2553\"\u003e#2553\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAllow setting Eclipse XML config from a string, not only from files (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2361\"\u003e#2361\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003egson\u003c/code\u003e version to latest \u003ccode\u003e2.11.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.13.1\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2414\"\u003e#2414\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejackson\u003c/code\u003e version to latest \u003ccode\u003e2.18.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.19.2\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2558\"\u003e#2558\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egherkin-utils\u003c/code\u003e version to latest \u003ccode\u003e9.0.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e9.2.0\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2408\"\u003e#2408\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ecleanthat\u003c/code\u003e version to latest \u003ccode\u003e2.22\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.23\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2556\"\u003e#2556\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMaven Plugin v3.3.0\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003etabletest-formatter\u003c/code\u003e support for Java and Kotlin. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2860\"\u003e#2860\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix the ability to specify a wildcard version (\u003ccode\u003e*\u003c/code\u003e) for external formatter executables, which did not work. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2848\"\u003e#2848\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[fix] \u003ccode\u003eConcurrentModificationException\u003c/code\u003e in \u003ccode\u003eexpandWildcardImports\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2830\"\u003e#2830\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/diffplug/spotless/blob/main/CHANGES.md\"\u003ecom.diffplug.spotless:spotless-maven-plugin\u0027s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[3.3.0] - 2025-07-20\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow specifying path to Biome JSON config file directly in \u003ccode\u003ebiome\u003c/code\u003e step. Requires biome 2.x. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2548\"\u003e#2548\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eGitPrePushHookInstaller\u003c/code\u003e, a reusable library component for installing a Git \u003ccode\u003epre-push\u003c/code\u003e hook that runs formatter checks. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2553\"\u003e#2553\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAllow setting Eclipse XML config from a string, not only from files (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2361\"\u003e#2361\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003egson\u003c/code\u003e version to latest \u003ccode\u003e2.11.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.13.1\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2414\"\u003e#2414\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ejackson\u003c/code\u003e version to latest \u003ccode\u003e2.18.1\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.19.2\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2558\"\u003e#2558\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egherkin-utils\u003c/code\u003e version to latest \u003ccode\u003e9.0.0\u003c/code\u003e -\u0026gt; \u003ccode\u003e9.2.0\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2408\"\u003e#2408\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003ecleanthat\u003c/code\u003e version to latest \u003ccode\u003e2.22\u003c/code\u003e -\u0026gt; \u003ccode\u003e2.23\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2556\"\u003e#2556\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[3.2.0] - 2025-07-07\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for \u003ccode\u003eidea\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2020\"\u003e#2020\u003c/a\u003e, \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2535\"\u003e#2535\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd support for removing wildcard imports via \u003ccode\u003eremoveWildcardImports\u003c/code\u003e step. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2517\"\u003e#2517\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003escalafmt: enforce version consistency between the version configured in Spotless and the version declared in Scalafmt config file (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2460\"\u003e#2460\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eSortPom\u003c/code\u003e disable expandEmptyElements, to avoid empty body warnings. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2520\"\u003e#2520\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix biome formatter for new major release 2.x of biome (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2537\"\u003e#2537\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMake sure npm-based formatters use the correct \u003ccode\u003enode_modules\u003c/code\u003e directory when running in parallel. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2542\"\u003e#2542\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump internal dependencies for npm-based formatters (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2542\"\u003e#2542\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[3.1.2] - 2025-05-27\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eUnsupportedOperationException\u003c/code\u003e in the Gradle plugin when using \u003ccode\u003etargetExcludeContent[Pattern]\u003c/code\u003e (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2487\"\u003e#2487\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003epgp key had expired, this and future releases will be signed by new key (\u003ca href\u003d\"https://github.com/diffplug/spotless/discussions/2464\"\u003edetails\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump default \u003ccode\u003eeclipse\u003c/code\u003e version to latest \u003ccode\u003e4.34\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.35\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2458\"\u003e#2458\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump default \u003ccode\u003egreclipse\u003c/code\u003e version to latest \u003ccode\u003e4.32\u003c/code\u003e -\u0026gt; \u003ccode\u003e4.35\u003c/code\u003e. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2458\"\u003e#2458\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[3.1.1] - 2025-04-07\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUse palantir-java-format 2.57.0 on Java 21. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2447\"\u003e#2447\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRe-try \u003ccode\u003enpm install\u003c/code\u003e with \u003ccode\u003e--prefer-online\u003c/code\u003e after \u003ccode\u003eERESOLVE\u003c/code\u003e error. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2448\"\u003e#2448\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAllow multiple npm-based formatters having the same module dependencies, to share a \u003ccode\u003enode_modules\u003c/code\u003e dir without race conditions. \u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2462\"\u003e#2462\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[3.1.0] - 2025-02-20\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for\u003ccode\u003eclang-format\u003c/code\u003e on maven-plugin (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2406\"\u003e#2406\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAllow overriding classLoader for all \u003ccode\u003eJarState\u003c/code\u003es to enable spotless-cli (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/pull/2427\"\u003e#2427\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[3.0.2] - 2025-01-14\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNode.JS-based tasks now work with the configuration cache (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2372\"\u003e#2372\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eEclipse-based tasks can now handle parallel configuration (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2389\"\u003e#2389\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[3.0.1] - 2025-01-07\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDeployment was missing part of the CDT formatter, now fixed. (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2384\"\u003e#2384\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/015df60ea813ebf4d17f90d2e983248179501d5f\"\u003e\u003ccode\u003e015df60\u003c/code\u003e\u003c/a\u003e Published lib/3.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/a7ea25221da3714069ebce4d5f35e75c5eb72778\"\u003e\u003ccode\u003ea7ea252\u003c/code\u003e\u003c/a\u003e feat: supply eclipse formatter settings as XML content (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2361\"\u003e#2361\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/0d0192d39933831eb799e5bf830acc92caf86425\"\u003e\u003ccode\u003e0d0192d\u003c/code\u003e\u003c/a\u003e Use try-with-resources to make sure we don\u0027t have dangling streams.\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b12ff7c47f7afb65217f5b1d917c10e221b61f58\"\u003e\u003ccode\u003eb12ff7c\u003c/code\u003e\u003c/a\u003e More changelog fixup.\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/b26c800afef0fb61561f85f6ff27b33705004953\"\u003e\u003ccode\u003eb26c800\u003c/code\u003e\u003c/a\u003e Update changelogs.\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/979825135a2b89aff154c713ba7305004b58ae78\"\u003e\u003ccode\u003e9798251\u003c/code\u003e\u003c/a\u003e Merge branch \u0027main\u0027 into feature/eclipse-config-without-file-xml\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/af4018349c31520d739fef28712acd970a3fd29e\"\u003e\u003ccode\u003eaf40183\u003c/code\u003e\u003c/a\u003e add git pre push hook (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2553\"\u003e#2553\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/cee700945d4c5aa50af52d5739fb68de53f7753f\"\u003e\u003ccode\u003ecee7009\u003c/code\u003e\u003c/a\u003e fix(deps): update jackson monorepo to v2.19.2 (\u003ca href\u003d\"https://redirect.github.com/diffplug/spotless/issues/2558\"\u003e#2558\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/2dadeb609c02b26930a30086a277a14d0d0466b7\"\u003e\u003ccode\u003e2dadeb6\u003c/code\u003e\u003c/a\u003e uninstall fix\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/diffplug/spotless/commit/259ec38f714178310e8625945ed74b83cb9a99ea\"\u003e\u003ccode\u003e259ec38\u003c/code\u003e\u003c/a\u003e Modify git-hook docs, with an eye towards a future where there is both a pre-...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/diffplug/spotless/compare/maven/3.2.1...lib/3.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcom.diffplug.spotless:spotless-maven-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.2.1\u0026new-version\u003d3.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2573 from dependabot[bot]/dependabot/maven/java/com.diffplug.spotless-spotless-maven-plugin-3.3.0.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "4458fe8251841d75e00a52e175194789545f9dd7",
      "tree": "dc04e45447f23ec450130583f13a881ae95e4dee",
      "parents": [
        "51bf4321f7c0e47c8b062796699ed924cad84a0a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Mar 09 10:55:06 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 09 10:55:06 2026 -0700"
      },
      "message": "ORC-2126: Upgrade `maven-shade-plugin` to 3.6.2\n\nBumps [org.apache.maven.plugins:maven-shade-plugin](https://github.com/apache/maven-shade-plugin) from 3.6.1 to 3.6.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/releases\"\u003eorg.apache.maven.plugins:maven-shade-plugin\u0027s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.6.2\u003c/h2\u003e\n\u003ch2\u003e🐛 Bug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBug: Extra JARs and Artifacts were not subjected to filtering (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/785\"\u003e#785\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cstamas\"\u003e\u003ccode\u003e​cstamas\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e👻 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDrop excessive dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/786\"\u003e#786\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cstamas\"\u003e\u003ccode\u003e​cstamas\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: remove junit3 reference (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/762\"\u003e#762\u003c/a\u003e) \u003ca href\u003d\"https://github.com/sparsick\"\u003e\u003ccode\u003e​sparsick\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExclude Java 25 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/773\"\u003e#773\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slachiewicz\"\u003e\u003ccode\u003e​slachiewicz\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate site descriptor, use site configuration from parent (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/755\"\u003e#755\u003c/a\u003e) \u003ca href\u003d\"https://github.com/slawekjaranowski\"\u003e\u003ccode\u003e​slawekjaranowski\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📦 Dependency updates\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDrop unneeded dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/788\"\u003e#788\u003c/a\u003e) \u003ca href\u003d\"https://github.com/cstamas\"\u003e\u003ccode\u003e​cstamas\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate to parent POM v 47 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/781\"\u003e#781\u003c/a\u003e) \u003ca href\u003d\"https://github.com/Bukama\"\u003e\u003ccode\u003e​Bukama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/782\"\u003e#782\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.mojo:mrm-maven-plugin from 1.7.0 to 1.7.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/780\"\u003e#780\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.4.0 to 3.5.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/778\"\u003e#778\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump asmVersion from 9.9 to 9.9.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/774\"\u003e#774\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate invoker plugin to 3.9.1 to Support Java 25 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/769\"\u003e#769\u003c/a\u003e) \u003ca href\u003d\"https://github.com/Bukama\"\u003e\u003ccode\u003e​Bukama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump asmVersion from 9.8 to 9.9 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/761\"\u003e#761\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.xmlunit:xmlunit-legacy from 2.10.3 to 2.11.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/763\"\u003e#763\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-tools:maven-plugin-annotations from 3.15.1 to 3.15.2 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/764\"\u003e#764\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.3.0 to 3.4.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/768\"\u003e#768\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump org.codehaus.plexus:plexus-utils from 3.5.1 to 3.6.0 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/pull/758\"\u003e#758\u003c/a\u003e) \u003ca href\u003d\"https://github.com/apps/dependabot\"\u003edependabot[bot]\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/ad8de59b38b373a7a601209bc3e2e192805ad7cd\"\u003e\u003ccode\u003ead8de59\u003c/code\u003e\u003c/a\u003e [maven-release-plugin] prepare release maven-shade-plugin-3.6.2\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/8eb19dce1f587a6f67f3ab00254925e1a437afbb\"\u003e\u003ccode\u003e8eb19dc\u003c/code\u003e\u003c/a\u003e Drop unneeded dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/788\"\u003e#788\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/397b2cd7a6315cc9f0ce14b87d6a9108edee25b1\"\u003e\u003ccode\u003e397b2cd\u003c/code\u003e\u003c/a\u003e Drop excessive dependencies (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/786\"\u003e#786\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/eca6398fd26db22a8f94da99682251ab85a758d8\"\u003e\u003ccode\u003eeca6398\u003c/code\u003e\u003c/a\u003e Bug: Extra JARs and Artifacts were not subjected to filtering (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/785\"\u003e#785\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/7edce171e15fccee898a69d264bdfdbe21229952\"\u003e\u003ccode\u003e7edce17\u003c/code\u003e\u003c/a\u003e Update to parent POM v 47 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/781\"\u003e#781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/3171a34b15528336c5e7baaf74d18a9140076973\"\u003e\u003ccode\u003e3171a34\u003c/code\u003e\u003c/a\u003e Mockito improvements (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/783\"\u003e#783\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/678844bd0330fef60f29c5b9d9476867c82c0699\"\u003e\u003ccode\u003e678844b\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/782\"\u003e#782\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/73ec909916f71e018508b4d39e78d939578ee9fa\"\u003e\u003ccode\u003e73ec909\u003c/code\u003e\u003c/a\u003e Bump org.codehaus.mojo:mrm-maven-plugin from 1.7.0 to 1.7.1 (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/780\"\u003e#780\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/5f7a87719217bae4b18cf9d29d326e2b064edd4a\"\u003e\u003ccode\u003e5f7a877\u003c/code\u003e\u003c/a\u003e Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/778\"\u003e#778\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/commit/73c52477a0e1b67eee420ec207a8f50c1d3e99f0\"\u003e\u003ccode\u003e73c5247\u003c/code\u003e\u003c/a\u003e chore: remove junit3 reference (\u003ca href\u003d\"https://redirect.github.com/apache/maven-shade-plugin/issues/762\"\u003e#762\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href\u003d\"https://github.com/apache/maven-shade-plugin/compare/maven-shade-plugin-3.6.1...maven-shade-plugin-3.6.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dorg.apache.maven.plugins:maven-shade-plugin\u0026package-manager\u003dmaven\u0026previous-version\u003d3.6.1\u0026new-version\u003d3.6.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `dependabot rebase` will rebase this PR\n- `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\u003c/details\u003e\n\nCloses #2574 from dependabot[bot]/dependabot/maven/java/org.apache.maven.plugins-maven-shade-plugin-3.6.2.\n\nAuthored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "51bf4321f7c0e47c8b062796699ed924cad84a0a",
      "tree": "ee27ade044ff3dba28dab17218780befa63d5527",
      "parents": [
        "40f3ad4c6a7be74eac5bc63e189c93f3bc3ac938"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 09 10:54:17 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 09 10:54:17 2026 -0700"
      },
      "message": "ORC-2125: Add `.claude` to `.gitignore`\n\n### What changes were proposed in this pull request?\n\nThis PR adds `.claude/` to `.gitignore`.\n\n### Why are the changes needed?\n\n`Anthropic` has a promotion for open source projects. I hope we can help the developers. [Claude Code](https://claude.ai/claude-code) creates a `.claude/` directory for project-level configuration and context. This directory should not be tracked in version control.\n\n- https://claude.com/contact-sales/claude-for-oss\n\n\u003e Open-source maintainers and contributors keep the ecosystem running. The Claude for Open Source Program is our way of saying thank you for all your hard work, with 6 months of free Claude Max 20x.\n\u003e - Maintainers: You’re a primary maintainer or core team member of a public repo with 5,000+ GitHub stars or 1M+ monthly NPM downloads. You\u0027ve made‍ commits, releases, or PR reviews within the last 3 months.\n\n### How was this patch tested?\n\nManual verification that `.claude/` directory is ignored by git.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2576 from dongjoon-hyun/ORC-2125.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "40f3ad4c6a7be74eac5bc63e189c93f3bc3ac938",
      "tree": "1a51e0afd6a863b91acb238f7778a4f94c145db6",
      "parents": [
        "0a1de4851150e2763843d1bb084ca699ee5d7c0d"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 09 10:53:07 2026 -0700"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 09 10:53:07 2026 -0700"
      },
      "message": "ORC-2124: Upgrade Maven to 3.9.13\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades `Apache Maven` to 3.9.13.\n\n### Why are the changes needed?\n\nTo keep the Maven version up to date with the latest stable release.\n\n**Maven Core**\n- Plugin prerequisites check now properly supports ranges when Java 8 (1.8) is specified\n- Fixed Plexus Security Dispatcher JSR330 migration warnings on Java 26+ due to field injection into `final` fields\n- Updated plugin versions in default bindings\n\n**Resolver 1.9.27**\n- Reverted HTTP PUT parallelization from 1.9.25 due to issues with many Maven Repository Managers struggling with concurrent requests\n- HTTP 410 (Gone) status is now treated as 404 (Not Found) in artifact resolution\n- Fixed proxy support in Apache HTTP transport\n- Fixed locally cached artifacts escaping Remote Repository Filter (RRF)\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Claude Opus 4.6)\n\nCloses #2575 from dongjoon-hyun/ORC-2124.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "0a1de4851150e2763843d1bb084ca699ee5d7c0d",
      "tree": "dba83c8713c50784dfeb884ef9df395128167798",
      "parents": [
        "8167cbc94e89037ff62ec224f0cc9a2f8f33e244"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Mar 04 22:33:56 2026 -0800"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Mar 04 22:33:56 2026 -0800"
      },
      "message": "Add news for 2.3.0\n"
    },
    {
      "commit": "8167cbc94e89037ff62ec224f0cc9a2f8f33e244",
      "tree": "246ffe4e52a5f46b9ce098a5307dd2d44c132efe",
      "parents": [
        "26b74e6dc64f9fa9cd925d22439e82126b14b02f"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Mar 04 12:57:28 2026 -0800"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Mar 04 12:57:28 2026 -0800"
      },
      "message": "ORC-2122: Upgrade `spark.jackson.version` to 2.21.1 in bench module\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `spark.jackson.version` to 2.21.1 in bench module.\n\n### Why are the changes needed?\n\nFrom 2.21, we need to use BOM.\n\nhttps://cowtowncoder.medium.com/jackson-2-21-released-ce0b6582ae67\n\nTo use the latest version like Apache Spark.\n- apache/spark#52668 (Apache Spark 4.1.0)\n- apache/spark#53886 (Apache Spark 4.2.0-preview2)\n- apache/spark#54626\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`.\n\nCloses #2570 from dongjoon-hyun/ORC-2122.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "26b74e6dc64f9fa9cd925d22439e82126b14b02f",
      "tree": "3a7dfc74512f0525972d1456b312c608d8ef6cf6",
      "parents": [
        "05bb715f5672101ffba4e8bbb495099b73bfa03a"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Mar 04 11:17:25 2026 -0800"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Mar 04 11:17:25 2026 -0800"
      },
      "message": "ORC-2121: Add `ubi10` to docker tests and GitHub Actions job\n\n### What changes were proposed in this pull request?\nThis PR adds support for `ubi10` (Red Hat Universal Base Image 10) with `Java 25` to the ORC Docker test environment. Specifically, it includes the following changes:\n- Adds a new Dockerfile for `ubi10` based on `registry.access.redhat.com/ubi10/ubi`.\n- Updates `docker/os-list.txt` to include `ubi10`.\n- Extends the GitHub Actions `docker` job matrix in `.github/workflows/build_and_test.yml` to test `ubi10`.\n- Updates the documentation in `site/_docs/building.md` to list `UBI 10` as a supported OS.\n\n### Why are the changes needed?\nTo ensure Apache ORC can be successfully built and tested on the `ubi10` platform. This expands the CI test matrix and provides an official Docker environment for Red Hat Enterprise Linux 10-compatible systems.\n\n### How was this patch tested?\nThis patch is tested by the newly added GitHub Actions `docker` job matrix `ubi10`. The CI builds the `ubi10` Docker image and runs the standard ORC compile and test suites (Java and C++) inside the container.\n\n\u003cimg width\u003d\"565\" height\u003d\"53\" alt\u003d\"Screenshot 2026-03-04 at 11 16 54\" src\u003d\"https://github.com/user-attachments/assets/5bddf1d5-9bc3-40f7-b4d6-e0e4da72eda0\" /\u003e\n\n### Was this patch authored or co-authored using generative AI tooling?\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`\n\nCloses #2569 from dongjoon-hyun/ORC-2121.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "05bb715f5672101ffba4e8bbb495099b73bfa03a",
      "tree": "9ccc803d463cbc1ecaf72c16f651e1c208e75cb6",
      "parents": [
        "495c5b364aa7763bc36d08c2ca4c41e5db968d0b"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 02 19:59:42 2026 -0800"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Mon Mar 02 19:59:42 2026 -0800"
      },
      "message": "ORC-2120: Upgrade `lz4-java` to 0.10.4\n\n### What changes were proposed in this pull request?\n\nThis PR aims to upgrade `lz4-java` to 0.10.4.\n\n### Why are the changes needed?\n\nTo use the latest bug fixed version for LZ4Codec.\n\n- https://github.com/yawkat/lz4-java/releases/tag/v1.10.4\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`.\n\nCloses #2568 from dongjoon-hyun/ORC-2120.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "495c5b364aa7763bc36d08c2ca4c41e5db968d0b",
      "tree": "7e02c3b921e320a08359a1734a2e5da4b1768caf",
      "parents": [
        "0035014d3f771b1932970365e809d45caa509575"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Feb 26 22:13:42 2026 -0800"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Feb 26 22:13:42 2026 -0800"
      },
      "message": "ORC-2118: Use `ubuntu-slim` for GitHub Actions `license-check` job\n\n### What changes were proposed in this pull request?\n\nThis PR aims to use `ubuntu-slim` for GitHub Actions `license-check` job\n\n### Why are the changes needed?\n\n`ubuntu-slim` is a new cost-efficient runner to fit small jobs like `license-check`. We had better use this to save ASF infra usage (if possible)\n- https://github.blog/changelog/2025-10-28-1-vcpu-linux-runner-now-available-in-github-actions-in-public-preview/\n- https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md\n\n| Feature | `ubuntu-slim` | `ubuntu-latest` |\n| :--- | :---: | :---: |\n| **Cost (per minute)** | **$0.002** | **$0.012** |\n| **Cost for 1,000 mins** | **$2.00** | **$12.00** |\n| **CPU** | 1 vCPU | 4 vCPU |\n| **Memory (RAM)** | 5 GB | 16 GB |\n| **Storage (SSD)** | 14 GB | 14 GB |\n| **Maximum Runtime** | **15 Minutes** | 6 Hours |\n| **Isolation Type** | Container-based (L2) | Dedicated VM |\n\n### How was this patch tested?\n\nPass the CIs.\n\n- https://github.com/apache/orc/actions/runs/22474009738/job/65097036746?pr\u003d2566\n\n\u003cimg width\u003d\"369\" height\u003d\"226\" alt\u003d\"Screenshot 2026-02-26 at 21 32 08\" src\u003d\"https://github.com/user-attachments/assets/9ed38fef-7e92-4fc8-bd11-ed923c9fd5f3\" /\u003e\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`\n\nCloses #2566 from dongjoon-hyun/ORC-2118.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "0035014d3f771b1932970365e809d45caa509575",
      "tree": "96c4e6d8d37f0e8ddf71bd3166415183aa524ed5",
      "parents": [
        "14985e5a63911cd42d18cbc7a1d0ef17f551bde9"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Feb 26 22:12:39 2026 -0800"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Thu Feb 26 22:12:39 2026 -0800"
      },
      "message": "ORC-2117: Add `Java 26-ea` to GitHub Action `build` job\n\n### What changes were proposed in this pull request?\n\nThis PR aims to add `Java 26-ea` to GitHub Action `build` job.\n\n### Why are the changes needed?\n\nThis is a known issue of Java 25 which is tracked by ORC-2116.\n- https://bugs.openjdk.org/browse/JDK-8377811 (Expected on April 2026 via Java 25.0.3)\n- https://bugs.openjdk.org/browse/JDK-8370807 (Expected on March 17, 2026)\n\nNew Java 26 test coverage will help us.\n\n### How was this patch tested?\n\nPass the CIs.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`\n\nCloses #2565 from dongjoon-hyun/ORC-2117.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    },
    {
      "commit": "14985e5a63911cd42d18cbc7a1d0ef17f551bde9",
      "tree": "ab926cbd7850701314e804be99e7e90f9baad4d2",
      "parents": [
        "cb15ed53ae7871c5f1a34efb87222b74faaf107c"
      ],
      "author": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Feb 25 13:50:32 2026 -0800"
      },
      "committer": {
        "name": "Dongjoon Hyun",
        "email": "dongjoon@apache.org",
        "time": "Wed Feb 25 13:50:32 2026 -0800"
      },
      "message": "ORC-2115: Improve `create_orc_jira.py` to support the component parameter\n\n### What changes were proposed in this pull request?\n\nThis PR aims to improve `create_orc_jira.py` to support the component parameter.\n\n### Why are the changes needed?\n\nTo help a developer to create JIRA issues more easily.\n\n### How was this patch tested?\n\nManually.\n\n```\n$ dev/create_orc_jira.py -c \u0027Java\u0027 \u0027Improve `create_orc_jira.py` to support the component parameter\u0027\nCreating JIRA issue with title: Improve `create_orc_jira.py` to support the component parameter\nCreated JIRA issue: ORC-2115\ngit checkout -b ORC-2115\nSwitched to a new branch \u0027ORC-2115\u0027\nCreated and checked out branch: ORC-2115\n[\u0027git\u0027, \u0027commit\u0027, \u0027-a\u0027, \u0027-m\u0027, \u0027ORC-2115: Improve `create_orc_jira.py` to support the component parameter\u0027]\nCreated a commit with message: ORC-2115: Improve `create_orc_jira.py` to support the component parameter\n```\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: `Gemini 3.1 Pro (High)` on `Antigravity`\n\nCloses #2563 from dongjoon-hyun/ORC-2115.\n\nAuthored-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\nSigned-off-by: Dongjoon Hyun \u003cdongjoon@apache.org\u003e\n"
    }
  ],
  "next": "cb15ed53ae7871c5f1a34efb87222b74faaf107c"
}