MINOR: Use build-once test workflow by xborder · Pull Request #17 · xborder/arrow-java

xborder · 2026-06-15T11:19:34Z

No description provided.

…5.4.0 (apache#1185) Bumps [com.squareup.okhttp3:mockwebserver3-junit5](https://github.com/square/okhttp) from 5.3.2 to 5.4.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="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/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:mockwebserver3-junit5's changelog</a>.</em></p> <blockquote> <h2>Version 5.4.0</h2> <p><em>2026-06-08</em></p> <ul> <li>New: Add superpowers to interceptors. Interceptors can now override anything settable on <code>OkHttpClient.Builder</code>, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with custom <code>Call.Factory</code> wrappers.</li> <li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li> <li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional <code>okhttp-coroutines</code> artifact.</li> <li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li> <li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a> Prepare for release 5.4.0.</li> <li><a href="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/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a> Update eclipse.osgi to v3.24.200 (<a href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li> <li><a href="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/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a> Update bnd to v7.3.0 (<a href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li> <li><a href="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/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a> Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li> <li><a href="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/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a> Update dependency macos to v26 (<a href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li> <li><a href="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/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a> Update shadow.plugin to v9.4.2 (<a href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li> <li><a href="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/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a> Update spotless.plugin to v8.6.0 (<a href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li> <li><a href="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/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a> Update plugin com.diffplug.spotless to v8.6.0 (<a href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li> <li><a href="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/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a> Update spotless.plugin to v8.5.1 (<a href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li> <li><a href="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/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a> Apply gradle lint correctly (<a href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li> <li>Additional commits viewable in <a href="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/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.squareup.okhttp3:mockwebserver3-junit5&package-manager=maven&previous-version=5.3.2&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…che#1176) Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) from 0.8.14 to 0.8.15. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="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/jacoco/jacoco/releases">org.jacoco:jacoco-maven-plugin's releases</a>.</em></p> <blockquote> <h2>0.8.15</h2> <h2>New Features</h2> <ul> <li>JaCoCo now officially supports Java 26 (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2076">#2076</a>).</li> <li>Experimental support for Java 27 class files (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2004">#2004</a>).</li> <li>Compatibility methods generated by Kotlin compiler for functions defined in interfaces are filtered out during generation of report (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/1905">#1905</a>).</li> <li>Compatibility methods generated by Kotlin compiler for exposed boxed inline value classes (JvmExposeBoxed annotation) are filtered out during generation of report (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/1944">#1944</a>).</li> <li>Methods generated by the Kotlin compiler for functions with JvmStatic annotation are filtered out during generation of report (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2097">#2097</a>).</li> <li>Improved filtering of bytecode generated by Kotlin compiler for when expressions and statements with kotlin.String subject where first branch condition contains string with largest hash (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2098">#2098</a>).</li> <li>Part of bytecode that javac versions from 24 to 26 generate for switch statements and expressions with selector expression of type java.lang.String inside lambdas is filtered out during generation of report (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2023">#2023</a>).</li> <li>Improved performance of Kotlin files analysis by parsing SMAPs only once per class (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2114">#2114</a>).</li> <li>For better performance agent output methods tcpclient and tcpserver use BufferedOutputStream to write execution data to socket. Maven plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use BufferedInputStream to read execution data from socket. Third-party integrations should do the same to benefit from this change in agent (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2089">#2089</a>).</li> </ul> <h2>Fixed bugs</h2> <ul> <li>Fixed processing of Kotlin SMAP in synthetic classes (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/1985">#1985</a>).</li> <li>Multiple JaCoCo runtimes within one JVM writing to the same output file should not cause data corruption when running on JDK versions from 6 to 10 affected by <a href="https://bugs.openjdk.org/browse/JDK-8166253">JDK-8166253</a> (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2065">#2065</a>, <a href="https://redirect.github.com/jacoco/jacoco/issues/2074">#2074</a>).</li> <li>For better performance agent writes to output file via BufferedOutputStream, this fixes regression introduced in version 0.6.2 (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2073">#2073</a>).</li> <li>Fixed NullPointerException when JaCoCo agent is loaded by non system class loader, for example when loaded by JBoss Modules (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/1651">#1651</a>).</li> </ul> <h2>Non-functional Changes</h2> <ul> <li>JaCoCo now depends on ASM 9.10.1 (GitHub <a href="https://redirect.github.com/jacoco/jacoco/issues/2134">#2134</a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/jacoco/jacoco/commit/6c5260a192eaa535e4a519771d530781cbac9136"><code>6c5260a</code></a> Prepare release v0.8.15</li> <li><a href="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/jacoco/jacoco/commit/5c05141431a7f064a804a923fbae11271241f116"><code>5c05141</code></a> Transfer of execution data through socket should use buffered stream (<a href="https://redirect.github.com/jacoco/jacoco/issues/2089">#2089</a>)</li> <li><a href="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/jacoco/jacoco/commit/ab5efa9d63c06899b2aec1d4a6099fc856132a22"><code>ab5efa9</code></a> Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (<a href="https://redirect.github.com/jacoco/jacoco/issues/2148">#2148</a>)</li> <li><a href="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/jacoco/jacoco/commit/5f6ea38f20ff4583deb4ab976571c853231f97c2"><code>5f6ea38</code></a> Use Windows 2025 image in GitHub Actions (<a href="https://redirect.github.com/jacoco/jacoco/issues/2130">#2130</a>)</li> <li><a href="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/jacoco/jacoco/commit/35a8af2cfc168ce51f2a3ea2d55d65f31e61c513"><code>35a8af2</code></a> Use Renovate instead of Dependabot for updates of ASM (<a href="https://redirect.github.com/jacoco/jacoco/issues/2137">#2137</a>)</li> <li><a href="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/jacoco/jacoco/commit/85b8ddf530821f75b3b26f5f96d03252286b3ad6"><code>85b8ddf</code></a> Upgrade ASM to 9.10.1 (<a href="https://redirect.github.com/jacoco/jacoco/issues/2134">#2134</a>)</li> <li><a href="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/jacoco/jacoco/commit/2988647ac37c3ad35a77b51d01b10a916b85627b"><code>2988647</code></a> AgentModule should use ClassLoader of agent instead of SystemClassLoader (<a href="https://redirect.github.com/jacoco/jacoco/issues/1651">#1651</a>)</li> <li><a href="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/jacoco/jacoco/commit/75a4e31fed32f180fbe4593ad91ec5c176c0535b"><code>75a4e31</code></a> Add filter for Kotlin <code>@JvmExposeBoxed</code> (<a href="https://redirect.github.com/jacoco/jacoco/issues/1944">#1944</a>)</li> <li><a href="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/jacoco/jacoco/commit/691fa1d6a0dffa91f45daf0714f28bfdaa367fc0"><code>691fa1d</code></a> Use Renovate instead of Dependabot for updates of GitHub Actions (<a href="https://redirect.github.com/jacoco/jacoco/issues/2132">#2132</a>)</li> <li><a href="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/jacoco/jacoco/commit/3e18f17207bca0203b726ace460aa6be8d0f3dd4"><code>3e18f17</code></a> Require at least JDK 21 for build (<a href="https://redirect.github.com/jacoco/jacoco/issues/2128">#2128</a>)</li> <li>Additional commits viewable in <a href="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/jacoco/jacoco/compare/v0.8.14...v0.8.15">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

@threadsafe

Bumps [io.grpc:grpc-bom](https://github.com/grpc/grpc-java) from 1.81.0 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="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/grpc/grpc-java/releases">io.grpc:grpc-bom's releases</a>.</em></p> <blockquote> <h2>v1.82.1</h2> <ul> <li>protoc-gen-grpc-java: Fix missing osx-x86_64 binary (<a href="https://redirect.github.com/grpc/grpc-java/pull/12878">grpc/grpc-java#12878</a>). This fixes a regression in v1.82.0</li> </ul> <h2>v1.82.0</h2> <p>This release drops support for Bazel 7. It may still run, but we are no longer testing it. We are testing Bazel 8 and 9.</p> <p>We are anticipating requiring Netty 4.2 in the next release. Please file an issue if you still need Netty 4.1 support.</p> <h3>Behavior Changes</h3> <ul> <li>xds: Disable Priority LB child policy retention cache (<a href="https://redirect.github.com/grpc/grpc-java/issues/12806">#12806</a>). Previously, when a priority became inactive, its associated child load balancer was kept in a deactivated state for potential reuse. Now, inactive child balancers are immediately torn down and removed.</li> <li>xds: skip DiscoveryRequest for unsubscribed types on stream ready (<a href="https://redirect.github.com/grpc/grpc-java/issues/12782">#12782</a>). When the bootstrap declares more than one xDS server (e.g. a default server for LDS/CDS plus an authority-specific EDS-only server), grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server too. That server replies <code>UNIMPLEMENTED</code>, which tears down the stream and EDS data never arrives. This fix makes it skip DiscoveryRequests for resource types we don't actually subscribe to on a given server.</li> </ul> <h3>Improvements</h3> <ul> <li>Remove JSR-305 <code>@threadsafe</code> annotation and replace with JavaDoc (<a href="https://redirect.github.com/grpc/grpc-java/issues/12762">#12762</a>). Removes JSR-305 annotations but instead of replacing it with ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is done only in public non-final classes and interfaces. This allows Java applications that have moved away from javax to compile and avoids a bug in Immutables and Lombok (and possibly other annotation processors) from failing when JSR-305 is not present.</li> <li>core: Reduce per-stream idle memory on the server by 0.5 KB (b38df6c94). The main improvement here is not retaining the request Metadata for the life of the RPC. That means RPCs with larger request Metadata would see a larger benefit.</li> <li>core: Clarify missing content-type on HTTP error responses (<a href="https://redirect.github.com/grpc/grpc-java/issues/12720">#12720</a>). Adjusts the diagnostic for the missing rather than invalid content-type, in the Status description.</li> <li>core: throw IOException when ProxySelector returns null or empty list (<a href="https://redirect.github.com/grpc/grpc-java/issues/12793">#12793</a>). ProxySelector.select(URI) is required to return a non-null, non-empty list. Some implementations violate this, which previously caused an opaque crash in ProxyDetectorImpl. Now it detects this case explicitly and fails gracefully, naming the offending ProxySelector class to help with debugging.</li> <li>okhttp: enable TLS 1.3 by default for Android clients, retain TLS 1.2-only for desktop JVM (f43013161)</li> <li>xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is most noticeable when there are many endpoints returned by EDS, but the LB policy only uses a few of them, like pick_first.</li> <li>xds: pre-parse custom metric names in WRR load balancer (<a href="https://redirect.github.com/grpc/grpc-java/issues/12773">#12773</a>) (324fce715). This reduces the per-RPC overhead of the gRFC A114 support added in v1.81.0</li> <li>xds: Propagate status cause through XdsDepManager (13b4b9727). This preserves more information for failures communicating with the control plane.</li> <li>binder: Give clear error when message is larger than parcel (d92ca44a1)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>xds: Trust Manager fix for certain scenarios where SAN validation shouldn't use the SNI sent (<a href="https://redirect.github.com/grpc/grpc-java/issues/12775">#12775</a>) (bb153a83f).</li> <li>core: Cancel DelayedClientCall when application listener throws (<a href="https://redirect.github.com/grpc/grpc-java/issues/12761">#12761</a>). Align DelayedClientCall.DelayedListener with ClientCallImpl's existing behavior for listener exceptions. When the application listener throws from onHeaders/onMessage/onReady, catch the Throwable, cancel the call with CANCELLED (cause = the throwable), and swallow subsequent callbacks. Previously, a throw from the application listener escaped to the callExecutor's uncaught-exception handler. The real call was not cancelled and the transport kept delivering callbacks to an already broken listener</li> <li>core,opentelemetry: Fix server metric labels on early close (<a href="https://redirect.github.com/grpc/grpc-java/issues/12774">#12774</a>). Addresses the server-side OpenTelemetry metric labeling bug where a generated method can be recorded as grpc.method="other" if <code>streamClosed()</code> happens before <code>serverCallStarted()</code>.</li> <li>core: Fix pick_first NPE with <code>GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true</code> when accepting resolved addresses and in CONNECTING state (<a href="https://redirect.github.com/grpc/grpc-java/issues/12814">#12814</a>). It makes sure that whenever PickFirstLeafLoadBalancer transitions into CONNECTING the current address in the addressIndex has a corresponding subchannel. This prevents an NPE in acceptResolvedAddresses in some situations.</li> <li>okhttp: HPACK should fail on varint overflow (ec1099254). This should have no visible impact in normal use. It mostly just makes it easier to debug broken implementations</li> <li>xds: When using the file watcher certificate provider, reload cert/key even if only one of them changes (f4125c591)</li> <li>compiler: Avoid compile error on weird proto file names (f021befcd)</li> </ul> <h3>New Features</h3> <ul> <li>googleapis: support <code>?force-xds</code> query parameter in the <code>google-c2p</code> resolver (<a href="https://redirect.github.com/grpc/grpc-java/issues/12760">#12760</a>) (86fa86063). This disables environment checks and uses xDS unconditionally. Please note that this feature has not yet seen comprehensive testing.</li> </ul> <h3>Dependencies</h3> <ul> <li>Upgrade Netty to 4.1.133 (ada087b9d)</li> <li>bazel: Upgrade googleapis proto repo to commit 1dbb1a14 (ec0a9c976). This fixed a rules_go incompatibility issue with Bazel 9.1. But it also greatly reduced the overall transitive dependencies, as the C++ grpc repo is no longer a dependency</li> <li>bazel: Upgrade workflows to Bazel 8 (039ad7779) add Bazel 9.1.0 to our CI matrix (17be0d3d1)</li> <li>protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04 instead of 18.04 (8802dc35b5, da98b04b09)</li> </ul> <h3>Thanks to</h3> <p><a href="/becomeStar"><code>@becomeStar</code></a><br /> <a href="/bengtsson1-flir"><code>@bengtsson1-flir</code></a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/grpc/grpc-java/commit/7b5e9ff531a8706a562d04ed9570a4790ce8ec64"><code>7b5e9ff</code></a> Bump version to 1.82.1</li> <li><a href="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/grpc/grpc-java/commit/20768f1630394b10d90c8737263cd198a43b7052"><code>20768f1</code></a> Update README etc to reference 1.82.1</li> <li><a href="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/grpc/grpc-java/commit/5ab5eba718f2e278e1015a0b7544e8dcf68afbc0"><code>5ab5eba</code></a> kokoro: Remove extra / in architecture replacement</li> <li><a href="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/grpc/grpc-java/commit/6726caf64c6e3d3db1ebfb5e9924fc75b706ae52"><code>6726caf</code></a> buildscripts: add regional td config for psm-interop (v1.82.x backport) (<a href="https://redirect.github.com/grpc/grpc-java/issues/12864">#12864</a>)</li> <li><a href="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/grpc/grpc-java/commit/022256f3f9f3816192dd11909b20902ebffcc37d"><code>022256f</code></a> Bump version to 1.82.1-SNAPSHOT</li> <li><a href="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/grpc/grpc-java/commit/78fb51905574241fbb5bc0259f908ead78dae609"><code>78fb519</code></a> Bump version to 1.82.0</li> <li><a href="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/grpc/grpc-java/commit/b62b0fc700b379cd080093d79330c181fce93de6"><code>b62b0fc</code></a> Update README etc to reference 1.82.0</li> <li><a href="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/grpc/grpc-java/commit/8802dc35b5c4d17cc8a53986db4f98bec9a2e04f"><code>8802dc3</code></a> build: downgrade multiarch to Ubuntu 20.04 and consolidate images (<a href="https://redirect.github.com/grpc/grpc-java/issues/12830">#12830</a>)</li> <li><a href="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/grpc/grpc-java/commit/be300bd11d15bfe6d19bd50c40dfec44e9b127e6"><code>be300bd</code></a> kokoro: Avoid brew on Mac OS</li> <li><a href="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/grpc/grpc-java/commit/4111f6f33ab3198833da99391875d378a25229f4"><code>4111f6f</code></a> core: throw IOException when ProxySelector returns null or empty list (<a href="https://redirect.github.com/grpc/grpc-java/issues/12793">#12793</a>)</li> <li>Additional commits viewable in <a href="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/grpc/grpc-java/compare/v1.81.0...v1.82.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.grpc:grpc-bom&package-manager=maven&previous-version=1.81.0&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…pache#1186) Bumps [com.google.protobuf:protobuf-bom](https://github.com/protocolbuffers/protobuf) from 4.35.0 to 4.35.1. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="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/protocolbuffers/protobuf/commits">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…Capacity (apache#1119) ## What Two fixes in the compression codec: 1. **`AbstractCompressionCodec.compress()`: capture `writerIndex()` once** The previous code read `uncompressedBuffer.writerIndex()` at multiple sites — for the size comparison and again after `doCompress()` to populate the 8-byte uncompressed-length prefix. Capture the value once at the top of `compress()` and reuse it for the empty-buffer check, the size comparison, and the prefix, so all three consumers see the same value. 2. **`ZstdCompressionCodec.doCompress()`: `dstCapacity` overstated by 8 bytes** `Zstd.compressUnsafe(dst, dstSize, ...)` expects `dstSize` to be the available space from `dst`. The code offsets `dst` by 8 bytes past the prefix but passed `8 + maxSize` instead of `maxSize`. The `compressBound()` headroom hides this in practice, but the parameter was semantically wrong. Pass `maxSize`. ## Tests Covered by the existing round-trip tests (`testEmptyBuffer`, `testReadWriteStream`, `testReadWriteFile`, etc.). I was not able to construct a minimal reproducer for the original `declaredUncompressed=0` symptom on the unfixed code, so both fixes are conservative correctness improvements derived from code inspection rather than failing-then-green regression tests.

…sult (apache#1064) ## What's Changed A new field, `optional bool is_update = 4;`, was added to `message ActionCreatePreparedStatementResult`. When this field is sent by the server, its value indicates whether the proper network flow to execute the query that the driver should follow uses `CommandPreparedStatementQuery` or `CommandPreparedStatementUpdate`. For outdated servers that don't send the field, the driver maintains its current behavior of using `CommandPreparedStatementQuery` when the `dataset_schema` is not empty, thus ensuring the backward compatibility of the new driver with old servers. This change was created with AI assistance (Augment Code and Claude code). All lines were manually reviewed by a human. The output is not copyrightable subject matter. - Closes apache#1063 --------- Co-authored-by: David Li <li.davidm96@gmail.com>

…he#1184) Bumps [com.github.luben:zstd-jni](https://github.com/luben/zstd-jni) from 1.5.7-10 to 1.5.7-11. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="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/luben/zstd-jni/commits/v1.5.7-11">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.github.luben:zstd-jni&package-manager=maven&previous-version=1.5.7-10&new-version=1.5.7-11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps `logback.version` from 1.5.32 to 1.5.34. Updates `ch.qos.logback:logback-classic` from 1.5.32 to 1.5.34 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="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/qos-ch/logback/releases">ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.5.34</h2> <p><strong>2026-06-01 Release of logback version 1.5.34</strong></p> <p>• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves [issues <a href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>), reported by Naotsugu Kobayashi.</p> <p>• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by <a href="/york-shen">York Shen</a> and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.33</h2> <p><strong>2026-05-27 Release of logback version 1.5.33</strong></p> <p>• <code>PropertiesConfiguratorModelHandler</code> now registers properties file URLs to the <code>ConfigurationWatchList</code> when scan is enabled (via local scan="true" attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs. This problem was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p> <p>• When processing <code><conversionRule></code> elements and both <code>class</code> and <code>converterClass</code> attributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued. This change was requested in <a href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p> <p>• <code>HardenedModelInputStream</code> will no longer accept to deserialize all classes located under the "java.lang" and "java.util" packages but a limited number of explicitly authorized classes in those packages. This potential deserialization whitelist bypass vulnerability was reported by <a href="/york-shen">York Shen</a> and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p> <p>• SSL parameters for <code>SSLSocketAppender</code> now enable hostname verification by default. Moreover, the default protocol is now "TLSv1.2". This potential vulnerability was reported by York Shen.</p> <p>• When printing the status message field, <code>ViewStatusMessagesServletBase</code> now escapes special characters such as "&" as character entities. This potential vulnerability was reported by York Shen.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit 124e8b49b55ac34d08743a0646bd463410192647 associated with the tag v_1.5.33. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe"><code>e62272a</code></a> prepare release 1.5.34</li> <li><a href="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/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341"><code>1e9e926</code></a> add resolveProxyClassRejectsDynamicProxies unit test</li> <li><a href="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/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f"><code>2de5cbe</code></a> added StackTraceElementProxyTest, minor edits to AGENTS.md</li> <li><a href="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/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e"><code>0e9b927</code></a> in case StackTraceElement is null use a substitute, fixing issues/1040</li> <li><a href="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/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818"><code>f7a0654</code></a> prevent resolveProxyClass bypass</li> <li><a href="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/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0"><code>249b81f</code></a> docs are no longer distributed</li> <li><a href="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/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8"><code>1c3b26a</code></a> start work on 1.5.34-SNAPSHOT</li> <li><a href="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/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647"><code>124e8b4</code></a> prepare release 1.5.33</li> <li><a href="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/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3"><code>d8fd6f2</code></a> escapeTags in message field when printing status messages</li> <li><a href="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/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4"><code>95edbeb</code></a> hostnameVerification default to true in SSLParametersConfiguration, SSL.DEFAU...</li> <li>Additional commits viewable in <a href="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/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-core` from 1.5.32 to 1.5.34 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="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/qos-ch/logback/releases">ch.qos.logback:logback-core's releases</a>.</em></p> <blockquote> <h2>Logback 1.5.34</h2> <p><strong>2026-06-01 Release of logback version 1.5.34</strong></p> <p>• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves [issues <a href="https://redirect.github.com/qos-ch/logback/issues/1040">#1040</a>](<a href="https://redirect.github.com/qos-ch/logback/issues/1040">qos-ch/logback#1040</a>), reported by Naotsugu Kobayashi.</p> <p>• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by <a href="/york-shen">York Shen</a> and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-10532">CVE-2026-10532</a>.</p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.33</h2> <p><strong>2026-05-27 Release of logback version 1.5.33</strong></p> <p>• <code>PropertiesConfiguratorModelHandler</code> now registers properties file URLs to the <code>ConfigurationWatchList</code> when scan is enabled (via local scan="true" attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs. This problem was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1034">issues/1034</a>.</p> <p>• When processing <code><conversionRule></code> elements and both <code>class</code> and <code>converterClass</code> attributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued. This change was requested in <a href="https://redirect.github.com/qos-ch/logback/issues/1031">issues/1031</a>.</p> <p>• <code>HardenedModelInputStream</code> will no longer accept to deserialize all classes located under the "java.lang" and "java.util" packages but a limited number of explicitly authorized classes in those packages. This potential deserialization whitelist bypass vulnerability was reported by <a href="/york-shen">York Shen</a> and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-9828">CVE-2026-9828</a>.</p> <p>• SSL parameters for <code>SSLSocketAppender</code> now enable hostname verification by default. Moreover, the default protocol is now "TLSv1.2". This potential vulnerability was reported by York Shen.</p> <p>• When printing the status message field, <code>ViewStatusMessagesServletBase</code> now escapes special characters such as "&" as character entities. This potential vulnerability was reported by York Shen.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit 124e8b49b55ac34d08743a0646bd463410192647 associated with the tag v_1.5.33. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/qos-ch/logback/commit/e62272ac152469aec1ede056c3c7d0d7314e7bfe"><code>e62272a</code></a> prepare release 1.5.34</li> <li><a href="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/qos-ch/logback/commit/1e9e926db1529b729a0e2d29fdee151c2aea0341"><code>1e9e926</code></a> add resolveProxyClassRejectsDynamicProxies unit test</li> <li><a href="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/qos-ch/logback/commit/2de5cbe90b74fa284685304bc91321313b0d8e2f"><code>2de5cbe</code></a> added StackTraceElementProxyTest, minor edits to AGENTS.md</li> <li><a href="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/qos-ch/logback/commit/0e9b9278b5d3f0b573762cd7b5482ed65244418e"><code>0e9b927</code></a> in case StackTraceElement is null use a substitute, fixing issues/1040</li> <li><a href="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/qos-ch/logback/commit/f7a0654c2b7e8e1c461e3d9e483e82ef969b5818"><code>f7a0654</code></a> prevent resolveProxyClass bypass</li> <li><a href="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/qos-ch/logback/commit/249b81f3754f1fb58f8507f244a36c7a940854c0"><code>249b81f</code></a> docs are no longer distributed</li> <li><a href="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/qos-ch/logback/commit/1c3b26a839f05b6bc1769e5a028ef326c711cec8"><code>1c3b26a</code></a> start work on 1.5.34-SNAPSHOT</li> <li><a href="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/qos-ch/logback/commit/124e8b49b55ac34d08743a0646bd463410192647"><code>124e8b4</code></a> prepare release 1.5.33</li> <li><a href="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/qos-ch/logback/commit/d8fd6f25c7f12282871164911fe423c86e2ef8f3"><code>d8fd6f2</code></a> escapeTags in message field when printing status messages</li> <li><a href="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/qos-ch/logback/commit/95edbeb8dbf53494f36324aeb7bef1825aff6cc4"><code>95edbeb</code></a> hostnameVerification default to true in SSLParametersConfiguration, SSL.DEFAU...</li> <li>Additional commits viewable in <a href="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/qos-ch/logback/compare/v_1.5.32...v_1.5.34">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…set during vector append (apache#1180) ## What's Changed Fix VectorAppender data size computation for variable-width vectors with non-zero start offsets When appending a variable width offset vector in DataFusion comet I was receiving exceptions due to allocating too much memory. This is because Comet passes variable width arrays back to Java where the initial offset vector entry is greater than 0. Prior to this change, arrow-java determines how many bytes to copy by just looking at the last offset entry in the buffer, completely disregarding the value of the first. If first = 100 and last = 200, Java will still copy 200 bytes instead of 100. In this change we fix that. Closes apache#1179 --------- Co-authored-by: Jordan Epstein <jordan.epstein@imc.com>

…pache#1207) ## What's Changed `Lz4CompressionCodec.doDecompress` sizes the output buffer to the bytes it actually decompressed, but sets `writerIndex` to the length taken from the untrusted 8-byte prefix. A buffer whose prefix claims more than the real output leaves the returned `ArrowBuf` with a `writerIndex` past its capacity, and consumers then read off-heap memory beyond the allocation. This adds the actual-vs-claimed length check the ZSTD codec already does, so a mismatch throws instead of producing an over-long buffer. Closes apache#1206.

Feature branches rarely need their own CI runs: the code is already tested when a pull request is opened against a release branch. If the push trigger has no branch restriction and pull_request is also configured, every push to a branch with an open PR runs the workflow twice: once for the push and once for the PR synchronisation. Always give the push trigger an explicit list of branches: this stops branches created from a release branch from inheriting its workflow runs. see https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=430408443#GitHubActionsRecommendedPractices-Restrictthepushtriggertospecificbranches ## What's Changed Please fill in a description of the changes here. **This contains breaking changes.**  Closes #NNN. Note that I needed to recreate a PR as the previous one was closed apache#1202 (comment) Signed-off-by: Aurélien Pupier <apupier@ibm.com>

…pache#1215) Bumps [com.squareup.okhttp3:mockwebserver3](https://github.com/square/okhttp) from 5.3.2 to 5.4.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="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/square/okhttp/blob/master/CHANGELOG.md">com.squareup.okhttp3:mockwebserver3's changelog</a>.</em></p> <blockquote> <h2>Version 5.4.0</h2> <p><em>2026-06-08</em></p> <ul> <li>New: Add superpowers to interceptors. Interceptors can now override anything settable on <code>OkHttpClient.Builder</code>, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with custom <code>Call.Factory</code> wrappers.</li> <li>Fix: Limit each HTTP/2 response to 256 KiB of total headers.</li> <li>Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional <code>okhttp-coroutines</code> artifact.</li> <li>Upgrade: [GraalVM 25.0.3][graalvm_25].</li> <li>Upgrade: [Okio 3.17.0][okio_3_17_0].</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/square/okhttp/commit/61423f472da24e0ccc42b6a2c0863fb27932fea5"><code>61423f4</code></a> Prepare for release 5.4.0.</li> <li><a href="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/square/okhttp/commit/d7e6effcb6852ca848b5f497032546b98b0a6370"><code>d7e6eff</code></a> Update eclipse.osgi to v3.24.200 (<a href="https://redirect.github.com/square/okhttp/issues/9480">#9480</a>)</li> <li><a href="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/square/okhttp/commit/7a350986e3231a7b81cbfcc6e3c185327033422b"><code>7a35098</code></a> Update bnd to v7.3.0 (<a href="https://redirect.github.com/square/okhttp/issues/9475">#9475</a>)</li> <li><a href="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/square/okhttp/commit/0c5a45b1174b8f735cc251eb19faaed87b65d868"><code>0c5a45b</code></a> Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (<a href="https://redirect.github.com/square/okhttp/issues/9468">#9468</a>)</li> <li><a href="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/square/okhttp/commit/113ad17f70af6984a1a8b4d46024118e5409c44b"><code>113ad17</code></a> Update dependency macos to v26 (<a href="https://redirect.github.com/square/okhttp/issues/9457">#9457</a>)</li> <li><a href="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/square/okhttp/commit/84f601af03d047eef3f4b2f0ca6b6f72303dcea1"><code>84f601a</code></a> Update shadow.plugin to v9.4.2 (<a href="https://redirect.github.com/square/okhttp/issues/9466">#9466</a>)</li> <li><a href="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/square/okhttp/commit/7d463f4bcfca91e4466037f2c65c7c700545d64c"><code>7d463f4</code></a> Update spotless.plugin to v8.6.0 (<a href="https://redirect.github.com/square/okhttp/issues/9464">#9464</a>)</li> <li><a href="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/square/okhttp/commit/3bf00f52921a0727bd18997cd92112dd2e582ed7"><code>3bf00f5</code></a> Update plugin com.diffplug.spotless to v8.6.0 (<a href="https://redirect.github.com/square/okhttp/issues/9463">#9463</a>)</li> <li><a href="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/square/okhttp/commit/cfc45a3f146d2389797a3d51d405e9118bed56c9"><code>cfc45a3</code></a> Update spotless.plugin to v8.5.1 (<a href="https://redirect.github.com/square/okhttp/issues/9456">#9456</a>)</li> <li><a href="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/square/okhttp/commit/81c5006e336c1cb67870694e38707e2c1c44fb34"><code>81c5006</code></a> Apply gradle lint correctly (<a href="https://redirect.github.com/square/okhttp/issues/9459">#9459</a>)</li> <li>Additional commits viewable in <a href="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/square/okhttp/compare/parent-5.3.2...parent-5.4.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.squareup.okhttp3:mockwebserver3&package-manager=maven&previous-version=5.3.2&new-version=5.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

… 3.8.0 (apache#1214) Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.6.0 to 3.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="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/diffplug/spotless/releases">com.diffplug.spotless:spotless-maven-plugin's releases</a>.</em></p> <blockquote> <h2>Maven Plugin v3.8.0</h2> <h3>Added</h3> <ul> <li>Add support for custom string format for license header copyright year via <code>yearStringFormat()</code>. (<a href="https://redirect.github.com/diffplug/spotless/pull/2965">#2965</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><code><expandWildcardImports></code> no longer triggers a full transitive dependency resolution on every build. Dependency resolution is now deferred until the step actually runs, so projects that do not use <code><expandWildcardImports></code> (or that use version ranges) are no longer penalized. (<a href="https://redirect.github.com/diffplug/spotless/issues/2983">#2983</a>)</li> </ul> <h2>Maven Plugin v3.7.0</h2> <h3>Fixed</h3> <ul> <li>Parse standard git year output in LicenseHeaderStep. (<a href="https://redirect.github.com/diffplug/spotless/issues/2940">#2940</a>)</li> <li><code><toggleOffOn></code> no longer disables lint-only steps such as <code><forbidWildcardImports></code>. (<a href="https://redirect.github.com/diffplug/spotless/pull/2962">#2962</a>)</li> <li>Fix <code>StringIndexOutOfBoundsException</code> in scenarios where copyright year is surrounded by whitespace. (<a href="https://redirect.github.com/diffplug/spotless/pull/2973">#2973</a>)</li> </ul> <h3>Added</h3> <ul> <li>Add support for AsciiDoc formatting via <code>adocfmt</code>. (<a href="https://redirect.github.com/diffplug/spotless/pull/2960">#2960</a>)</li> <li><code><flexmark></code> step now supports arbitrary formatter options via <code><formatterOptions></code>. (<a href="https://redirect.github.com/diffplug/spotless/pull/2968">#2968</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="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/diffplug/spotless/blob/main/CHANGES.md">com.diffplug.spotless:spotless-maven-plugin's changelog</a>.</em></p> <blockquote> <h1>spotless-lib and spotless-lib-extra releases</h1> <p>If you are a Spotless user (as opposed to developer), then you are probably looking for:</p> <ul> <li><a href="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/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md">https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md</a></li> <li><a href="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/diffplug/spotless/blob/main/plugin-maven/CHANGES.md">https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md</a></li> </ul> <p>This document is intended for Spotless developers.</p> <p>We adhere to the <a href="https://keepachangelog.com/en/1.0.0/">keepachangelog</a> format (starting after version <code>1.27.0</code>).</p> <h2>[Unreleased]</h2> <h2>[4.8.0] - 2026-06-29</h2> <h3>Added</h3> <ul> <li>Add support for custom string format for license header copyright year via <code>yearStringFormat()</code>. (<a href="https://redirect.github.com/diffplug/spotless/pull/2965">#2965</a>)</li> </ul> <h2>[4.7.0] - 2026-06-16</h2> <h3>Added</h3> <ul> <li>Add support for AsciiDoc formatting via <code>adocfmt</code>. (<a href="https://redirect.github.com/diffplug/spotless/pull/2960">#2960</a>)</li> <li><code>flexmark</code> step now supports arbitrary formatter options via a <code>formatterOptions</code> map. (<a href="https://redirect.github.com/diffplug/spotless/pull/2968">#2968</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><code>FenceStep.preserveWithin</code> now forwards lints from nested steps while still suppressing lints inside preserved blocks. (<a href="https://redirect.github.com/diffplug/spotless/pull/2962">#2962</a>)</li> <li>Support <code>ktfmt</code> 0.63 and use its new builder API for formatting options to better avoid future breaking changes.</li> <li>Parse standard git year output in LicenseHeaderStep. (<a href="https://redirect.github.com/diffplug/spotless/issues/2940">#2940</a>)</li> <li>Fix <code>StringIndexOutOfBoundsException</code> in scenarios where copyright year is surrounded by whitespace. (<a href="https://redirect.github.com/diffplug/spotless/pull/2973">#2973</a>)</li> </ul> <h3>Changes</h3> <ul> <li>Bump default <code>greclipse</code> version to latest <code>4.35</code> -> <code>4.39</code>. (<a href="https://redirect.github.com/diffplug/spotless/pull/2924">#2924</a>)</li> </ul> <h2>[4.6.2] - 2026-05-27</h2> <h3>Fixed</h3> <ul> <li><code>P2Provisioner</code> now passes cache directory overrides directly to Solstice. (<a href="https://redirect.github.com/diffplug/spotless/pull/2944">#2944</a>)</li> <li><code>forbidWildcardImports</code> and <code>forbidModuleImports</code> now detect imports that have leading whitespace (indentation/tabs). (<a href="https://redirect.github.com/diffplug/spotless/pull/2939">#2939</a>)</li> <li><code>versionCatalog</code> step no longer splits long inline tables across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line inline tables. The <code>maxLineLength</code> option has been removed. (<a href="https://redirect.github.com/diffplug/spotless/issues/2948">#2948</a>)</li> </ul> <h3>Changes</h3> <ul> <li><code>EclipseJdtFormtterStep</code> now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (<a href="https://redirect.github.com/diffplug/spotless/pull/2942">#2942</a>)</li> <li><code>Formatter</code> no longer recomputes line-ending normalization (<code>LineEnding.toUnix</code>) a second time for every formatter step that changes content, removing redundant O(n) work from the core formatting loop. (<a href="https://redirect.github.com/diffplug/spotless/pull/2934">#2934</a>)</li> <li>expandWildcardImports support pom type dependency. (<a href="https://redirect.github.com/diffplug/spotless/issues/2839">#2839</a>)</li> </ul> <h2>[4.6.1] - 2026-05-15</h2> <h3>Fixed</h3> <ul> <li><code>LicenseHeaderStep</code> in <code>SET_FROM_GIT</code> year mode no longer invokes <code>git log</code> through <code>bash -c</code> / <code>cmd /c</code>, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.</li> </ul> <h2>[4.6.0] - 2026-05-14</h2> <h3>Added</h3> <ul> <li><code>scalafmt()</code> now reads the version from the <code>version</code> field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (<a href="https://redirect.github.com/diffplug/spotless/pull/2922">#2922</a>)</li> <li>Add <code>versionCatalog</code> step for formatting and sorting Gradle version catalog (<code>.toml</code>) files. (<a href="https://redirect.github.com/diffplug/spotless/issues/2916">#2916</a>)</li> <li>Add <code>javaparserVersion</code> option to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. (<a href="https://redirect.github.com/diffplug/spotless/pull/2903">#2903</a>)</li> </ul> <h3>Fixed</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/diffplug/spotless/commit/03d43ba2cdc81050e07b62646c08b22e39505368"><code>03d43ba</code></a> Published maven/3.8.0</li> <li><a href="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/diffplug/spotless/commit/8b80c1388017f9b390fd9681007ba58a8c5d77f7"><code>8b80c13</code></a> Published gradle/8.8.0</li> <li><a href="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/diffplug/spotless/commit/8ee6cf904ae77a4baec287132c69a63d4b5f4052"><code>8ee6cf9</code></a> Published lib/4.8.0</li> <li><a href="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/diffplug/spotless/commit/6c02c0bf3fa0914206b28b2e9abec5e2061273e4"><code>6c02c0b</code></a> Add missing changelog entry.</li> <li><a href="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/diffplug/spotless/commit/264f4cc904ad85149a90822c0835c17a615cee8e"><code>264f4cc</code></a> Add regression test for forbidWildcardImports inside toggleOffOn (<a href="https://redirect.github.com/diffplug/spotless/issues/2982">#2982</a>)</li> <li><a href="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/diffplug/spotless/commit/6abb06449354899642d716dfb3daf67a888bac9b"><code>6abb064</code></a> fix <a href="https://redirect.github.com/diffplug/spotless/issues/2983">#2983</a>, expandWildcardImports triggers a full transitive reso… (<a href="https://redirect.github.com/diffplug/spotless/issues/2984">#2984</a>)</li> <li><a href="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/diffplug/spotless/commit/f4536d41caebdda8201cdb126832ea96a75e5afe"><code>f4536d4</code></a> Update plugin spotbugs to v6.5.8 (<a href="https://redirect.github.com/diffplug/spotless/issues/2987">#2987</a>)</li> <li><a href="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/diffplug/spotless/commit/873454acbc24dd66a0d334f29b30d5dcb645cd0a"><code>873454a</code></a> Update plugin spotbugs to v6.5.8</li> <li><a href="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/diffplug/spotless/commit/000b8a8f9f0398f60aeafee4d2fbd90a6a61b7f1"><code>000b8a8</code></a> Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (<a href="https://redirect.github.com/diffplug/spotless/issues/2985">#2985</a>)</li> <li><a href="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/diffplug/spotless/commit/84ebcab6a588c0ae7ddb8d883f5f60947e488e0a"><code>84ebcab</code></a> Update dependency org.junit.jupiter:junit-jupiter to v6.1.1</li> <li>Additional commits viewable in <a href="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/diffplug/spotless/compare/maven/3.6.0...maven/3.8.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.diffplug.spotless:spotless-maven-plugin&package-manager=maven&previous-version=3.6.0&new-version=3.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…apache#1212) Bumps com.gradle:develocity-maven-extension from 2.4.1 to 2.5.0. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:develocity-maven-extension&package-manager=maven&previous-version=2.4.1&new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps `logback.version` from 1.5.34 to 1.5.37. Updates `ch.qos.logback:logback-classic` from 1.5.34 to 1.5.37 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="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/qos-ch/logback/releases">ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.5.37</h2> <p><strong>2026-06-26 Release of logback version 1.5.37</strong></p> <ol> <li>• Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an <a href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html">online migration service</a> or the <code><condition></code> element introduced in version 1.5.20. See the <a href="https://logback.qos.ch/manual/configuration.html#conditional">relevant documentation</a> for more details.</li> </ol> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.36</h2> <p><strong>2026-06-25 Release of logback version 1.5.36</strong></p> <p>• The 'condition' attribute in <code><if></code> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (<a href="mailto:yulate531@gmail.com.com">yulate531@gmail.com.com</a>) and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>. <strong>Please note that version 1.5.37 provides the full fix to this vulnerability.</strong></p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.35</h2> <p><strong>026-06-23 Release of logback version 1.5.35</strong></p> <p>• The 'condition' attribute in <code><if></code> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (<a href="mailto:icysun@qq.com">icysun@qq.com</a>) and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>. <strong>Please note that version 1.5.37 provides the full fix to this vulnerability.</strong></p> <p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. <code>ContextInitializer</code> now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.</p> <p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced <code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code> will need an alternative approach for console charset detection.</p> <p>• The logback-examples module is now included in artifacts published to Maven Central.</p> <p>• <code>JoranConfigurator.makeAnotherInstance()</code> and <code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code> are now protected, allowing derived configurators to override these methods.</p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048"><code>c1df7f5</code></a> prepare release 1.5.37</li> <li><a href="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/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5"><code>a189967</code></a> remove conditional based on janino</li> <li><a href="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/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446"><code>aaa9052</code></a> start work on 1.5.37-SNAPSHOT</li> <li><a href="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/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888"><code>9b94c37</code></a> prepare release 1.5.36</li> <li><a href="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/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb"><code>e6a8280</code></a> prevent attacks using disallowed references</li> <li><a href="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/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f"><code>24c4b63</code></a> start work on 1.5.36-SNAPSHOT</li> <li><a href="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/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7"><code>08bd159</code></a> preapre release 1.5.35</li> <li><a href="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/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0"><code>37d256b</code></a> indentation changes only</li> <li><a href="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/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3"><code>d3d7307</code></a> minor comment</li> <li><a href="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/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0"><code>fa0411a</code></a> radomize file location</li> <li>Additional commits viewable in <a href="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/qos-ch/logback/compare/v_1.5.34...v_1.5.37">compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-core` from 1.5.34 to 1.5.37 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="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/qos-ch/logback/releases">ch.qos.logback:logback-core's releases</a>.</em></p> <blockquote> <h2>Logback 1.5.37</h2> <p><strong>2026-06-26 Release of logback version 1.5.37</strong></p> <ol> <li>• Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an <a href="https://logback.qos.ch/translator/services/conditionalConfigMigrator.html">online migration service</a> or the <code><condition></code> element introduced in version 1.5.20. See the <a href="https://logback.qos.ch/manual/configuration.html#conditional">relevant documentation</a> for more details.</li> </ol> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.36</h2> <p><strong>2026-06-25 Release of logback version 1.5.36</strong></p> <p>• The 'condition' attribute in <code><if></code> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (<a href="mailto:yulate531@gmail.com.com">yulate531@gmail.com.com</a>) and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>. <strong>Please note that version 1.5.37 provides the full fix to this vulnerability.</strong></p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <h2>Logback 1.5.35</h2> <p><strong>026-06-23 Release of logback version 1.5.35</strong></p> <p>• The 'condition' attribute in <code><if></code> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (<a href="mailto:icysun@qq.com">icysun@qq.com</a>) and registered as <a href="https://www.cve.org/cverecord?id=CVE-2026-13006">CVE-2026-13006</a>. <strong>Please note that version 1.5.37 provides the full fix to this vulnerability.</strong></p> <p>• Added <code>ConfiguratorRank.AUTHENTICATING</code> (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. <code>ContextInitializer</code> now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.</p> <p>• <code>ConsoleCharsetPropertyDefiner</code> is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced <code>ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner</code> will need an alternative approach for console charset detection.</p> <p>• The logback-examples module is now included in artifacts published to Maven Central.</p> <p>• <code>JoranConfigurator.makeAnotherInstance()</code> and <code>DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()</code> are now protected, allowing derived configurators to override these methods.</p> <p>• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="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/qos-ch/logback/commit/c1df7f522e648eec7b4ef6a12c8758fec0f00048"><code>c1df7f5</code></a> prepare release 1.5.37</li> <li><a href="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/qos-ch/logback/commit/a1899674579c67711a4fff6bdc569f4bfb25ead5"><code>a189967</code></a> remove conditional based on janino</li> <li><a href="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/qos-ch/logback/commit/aaa905292dc24235a0cd7514c4815d0eeb6c0446"><code>aaa9052</code></a> start work on 1.5.37-SNAPSHOT</li> <li><a href="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/qos-ch/logback/commit/9b94c37562bf25a6a944146701d42ee6c4eee888"><code>9b94c37</code></a> prepare release 1.5.36</li> <li><a href="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/qos-ch/logback/commit/e6a8280ba2c61a448226bccbced70444aaa6e7eb"><code>e6a8280</code></a> prevent attacks using disallowed references</li> <li><a href="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/qos-ch/logback/commit/24c4b63f60e5bbfa591c20cf39f2ce50ff8cff4f"><code>24c4b63</code></a> start work on 1.5.36-SNAPSHOT</li> <li><a href="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/qos-ch/logback/commit/08bd1598d565d83444f72983935e7da4746783b7"><code>08bd159</code></a> preapre release 1.5.35</li> <li><a href="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/qos-ch/logback/commit/37d256b825fc62b4a3908fa29d8b4e34acf79ed0"><code>37d256b</code></a> indentation changes only</li> <li><a href="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/qos-ch/logback/commit/d3d73078afbb0691423f60a066d77503fdf05fc3"><code>d3d7307</code></a> minor comment</li> <li><a href="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/qos-ch/logback/commit/fa0411a9393282ba69396ce65f122d281c079ac0"><code>fa0411a</code></a> radomize file location</li> <li>Additional commits viewable in <a href="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/qos-ch/logback/compare/v_1.5.34...v_1.5.37">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: JB Onofré <jbonofre@apache.org>

## Summary This PR reduces wasted GitHub Actions time in the `Test` workflow by removing redundant rebuilds, improving caching, and skipping integration work when it is not relevant. ## What changed - Removed `clean` from `ci/scripts/test.sh` so the test phase reuses the classes compiled earlier in the job instead of deleting and recompiling them. - Narrowed the Maven/Docker cache key to POM changes, so source-only edits do not invalidate the dependency cache. - Enabled Maven dependency caching on the macOS and Windows test jobs. - Added `pull-requests: read` so the integration job can inspect changed files. Closes apache#1188 Note: The changes on this PR were highlighted and addressed with AI assistance

## What's Changed Move the `integration` job from `test.yml` into its own `integration.yml` workflow. The new workflow uses top-level `paths` filters, so integration tests run only when changes affect relevant code or build inputs. This should also help to reduce the amount of runner time. Topic initially triggered in the [mailing list](https://lists.apache.org/thread/drf0o5kzg1zfmok7gc09k8qz8hh9ymvh) Closes apache#1244

xborder added the chore label Jun 15, 2026

xborder force-pushed the ci-build-once-artifacts-phases-4-6 branch 2 times, most recently from b94ec96 to 75c97f2 Compare June 15, 2026 12:14

dependabot Bot and others added 27 commits June 26, 2026 18:01

MINOR: Use build-once test workflow

b915c5b

xborder added 6 commits July 28, 2026 09:30

Split CI build artifacts from test jobs

b3f8bfa

Refactor Java test script for prebuilt test handling

c10911e

Stabilize Maven cache keys in CI

ffb2c26

MINOR: Preserve Maven test lifecycle for prebuilt CI

2a0c06b

MINOR: Simplify Java test matrix

0f34c38

MINOR: Clarify prebuilt test step names

798f38a

xborder force-pushed the ci-build-once-artifacts-phases-4-6 branch from 226336f to 798f38a Compare July 28, 2026 08:44

Navigation Menu

MINOR: Use build-once test workflow - #17

MINOR: Use build-once test workflow#17
xborder wants to merge 33 commits into
ci-test-workflow-phases-1-3from
ci-build-once-artifacts-phases-4-6

xborder commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

xborder commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants