Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: quantcast/arrow-java
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: apache/arrow-java
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: main
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 6 commits
  • 10 files changed
  • 3 contributors

Commits on Mar 30, 2026

  1. MINOR: Bump io.netty:netty-bom from 4.2.10.Final to 4.2.12.Final (apa… 

    …che#1091)

Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.10.Final to 4.2.12.Final.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netty/netty/releases">io.netty:netty-bom's
releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.12.Final</h2>
<h2>What's Changed</h2>
<ul>
<li>Revert &quot;Eliminate redundant bounds checks in CompositeByteBuf
accessors&quot; by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16550">netty/netty#16550</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netty/netty/compare/netty-4.2.11.Final...netty-4.2.12.Final">https://github.com/netty/netty/compare/netty-4.2.11.Final...netty-4.2.12.Final</a></p>
<h2>netty-4.2.11.Final</h2>
<h2>Security</h2>
<ul>
<li>CVE-2026-33871, <a
href="https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv">HTTP/2
CONTINUATION Frame Flood Denial of Service</a></li>
<li>CVE-2026-33870, <a
href="https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8">HTTP
Request Smuggling via Chunked Extension Quoted-String Parsing</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Update to latest JDK 26 EA release by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16230">netty/netty#16230</a></li>
<li>HTTP3: Allow to support non-standard HTTP3 settings by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16171">netty/netty#16171</a></li>
<li>Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry
loop by <a
href="https://github.com/adwsingh"><code>@​adwsingh</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16245">netty/netty#16245</a></li>
<li>Allocate one large segment and slice for each MsgHdrMemory by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16234">netty/netty#16234</a></li>
<li>Make RefCntOpenSslContext.deallocate more robust by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16253">netty/netty#16253</a></li>
<li>Epoll: Fix excessive CPU usage when Channel is only registered but
no… by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16250">netty/netty#16250</a></li>
<li>Update to gcc for arm 10.3-2021.07 by <a
href="https://github.com/m1ngyuan"><code>@​m1ngyuan</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16255">netty/netty#16255</a></li>
<li>Add acmeIdentifier extension support to pkitesting by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16256">netty/netty#16256</a></li>
<li>Update JDK versions to latest patch releases by <a
href="https://github.com/m1ngyuan"><code>@​m1ngyuan</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16254">netty/netty#16254</a></li>
<li>Avoid allocation in HttpObjectEncoder.addEncodedLengthHex method by
<a href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16241">netty/netty#16241</a></li>
<li>Automatic backporting workflow from 4.1 to 4.2 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16269">netty/netty#16269</a></li>
<li>Revert &quot;Automatic backporting workflow from 4.1 to 4.2&quot; by
<a href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in
<a
href="https://redirect.github.com/netty/netty/pull/16270">netty/netty#16270</a></li>
<li>HTTP2: Correctly account for padding when decompress by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16264">netty/netty#16264</a></li>
<li>Automatic backporting workflow from 4.1 to 4.2 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16271">netty/netty#16271</a></li>
<li>Automatic backporting workflow from 4.1 to 4.2 by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16273">netty/netty#16273</a></li>
<li>Backport PRs must be created with personal access tokens by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16276">netty/netty#16276</a></li>
<li>Expose QuicSslContextBuilder::sni by <a
href="https://github.com/ZeroErrors"><code>@​ZeroErrors</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16178">netty/netty#16178</a></li>
<li>Add more porting workflows by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16275">netty/netty#16275</a></li>
<li>Add more porting workflows by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16283">netty/netty#16283</a></li>
<li>Remove the unpooled allocator from test permutations by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16282">netty/netty#16282</a></li>
<li>Some polishing of the porting workflows by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16288">netty/netty#16288</a></li>
<li>Allow to set destination connection id when creating a client side
QuicheChannel by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16286">netty/netty#16286</a></li>
<li>Update to latest JDK26 EA build by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16295">netty/netty#16295</a></li>
<li>Add javadoc to clarify responsibility of the user when generating
the remote connection id by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16293">netty/netty#16293</a></li>
<li>Make the build run faster by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16290">netty/netty#16290</a></li>
<li>Fix IDE warnings in SslHandler by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16237">netty/netty#16237</a></li>
<li>Decrease Long allocations and map.put calls in
ReferenceCountedOpenSllEngine in handshake() method by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16242">netty/netty#16242</a></li>
<li>Support boringssl SSLCredential API by <a
href="https://github.com/jmcrawford45"><code>@​jmcrawford45</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/15919">netty/netty#15919</a></li>
<li>Fix high-order bit aliasing in HttpUtil.validateToken by <a
href="https://github.com/furkanvarol"><code>@​furkanvarol</code></a> in
<a
href="https://redirect.github.com/netty/netty/pull/16279">netty/netty#16279</a></li>
<li>Improve multi-byte access performance when UNALIGNED availability is
unknown by <a
href="https://github.com/Songdoeon"><code>@​Songdoeon</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16207">netty/netty#16207</a></li>
<li>Avoid unnecessary SSL.getVersion() call and string allocation in
ReferenceCountedOpenSslEngine by <a
href="https://github.com/doom369"><code>@​doom369</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16278">netty/netty#16278</a></li>
<li>Support more branch freedom for auto-porting by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16300">netty/netty#16300</a></li>
<li>fix: the precedence of + is higher than &gt;&gt; by <a
href="https://github.com/cuiweixie"><code>@​cuiweixie</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16312">netty/netty#16312</a></li>
<li>AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater
than byteBuf.maxCapacity() by <a
href="https://github.com/laosijikaichele"><code>@​laosijikaichele</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/16309">netty/netty#16309</a></li>
<li>Fix flaky PooledByteBufAllocatorTest by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16313">netty/netty#16313</a></li>
<li>Fix pooled arena accounting tests by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16321">netty/netty#16321</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netty/netty/commit/67ce541e4692853e24fc506466960db35bb64914"><code>67ce541</code></a>
[maven-release-plugin] prepare release netty-4.2.12.Final</li>
<li><a
href="https://github.com/netty/netty/commit/7074624644b79f4e97081bd58a58ed135962b8c2"><code>7074624</code></a>
Revert &quot;Eliminate redundant bounds checks in CompositeByteBuf
accessors&quot; (<a
href="https://redirect.github.com/netty/netty/issues/16">#16</a>...</li>
<li><a
href="https://github.com/netty/netty/commit/c3b0a43442dbf84e3eb161d5f252623f832f1579"><code>c3b0a43</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://github.com/netty/netty/commit/c94a8180e749f694fb76963dd494bae17c31aff6"><code>c94a818</code></a>
[maven-release-plugin] prepare release netty-4.2.11.Final</li>
<li><a
href="https://github.com/netty/netty/commit/3b76df185678353733aa21702d6be16130d188a0"><code>3b76df1</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/netty/netty/commit/aae944a19eb036993fc47c4b40639476f519deaf"><code>aae944a</code></a>
Auto-port 4.2: Limit the number of Continuation frames per HTTP2 Headers
(<a
href="https://redirect.github.com/netty/netty/issues/16">#16</a>...</li>
<li><a
href="https://github.com/netty/netty/commit/60014996491c41d91c26f80bca096610f34fc858"><code>6001499</code></a>
Eliminate redundant bounds checks in CompositeByteBuf accessors (<a
href="https://redirect.github.com/netty/netty/issues/16525">#16525</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/a7fbb6f84625ef29733a1506ed3520e3c21d5247"><code>a7fbb6f</code></a>
JdkZlibDecoder: accumulate decompressed output before firing channelRead
(<a
href="https://redirect.github.com/netty/netty/issues/16">#16</a>...</li>
<li><a
href="https://github.com/netty/netty/commit/7937553d8f49e17b064f57b1414907aed8e3be3d"><code>7937553</code></a>
Enforce io.netty.maxDirectMemory accounting on all Java versions (<a
href="https://redirect.github.com/netty/netty/issues/16489">#16489</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/893ea2ea6c35c9e1812e5d331530b88d8690022b"><code>893ea2e</code></a>
Allocate less in QueryStringDecoder.addParam for typical use case (<a
href="https://redirect.github.com/netty/netty/issues/16527">#16527</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netty/netty/compare/netty-4.2.10.Final...netty-4.2.12.Final">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.netty:netty-bom&package-manager=maven&previous-version=4.2.10.Final&new-version=4.2.12.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Mar 30, 2026
    Configuration menu
    Copy the full SHA
    168a969 View commit details
    Browse the repository at this point in the history

  2. MINOR: Bump com.nimbusds:oauth2-oidc-sdk from 11.34 to 11.37 (apache#… 

    …1096)

Bumps
[com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions)
from 11.34 to 11.37.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt">com.nimbusds:oauth2-oidc-sdk's
changelog</a>.</em></p>
<blockquote>
<p>version 1.0 (2012-05-29)
* First official release with authorisation endpoint, token endpoint,
check
ID endpoint and UserInfo endpoint support.
* JSON Web Tokens (JWTs) support through the Nimbus-JWT library.
* Language Tags (RFC 5646) support through the Nimbus-LangTag library.
* JSON support through the JSON Smart library.</p>
<p>version 2.0 (2013-05-13)
* Intermediary development release with Maven build, published to
Maven Central.</p>
<p>version 2.1 (2013-06-06)
* Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect
Standard draft 21, OpenID Connect Discovery draft 17 and OpenID
Connect Registration draft 19.
* Major refactoring of the APIs for greater simplicity.
* Adds JUnit tests.</p>
<p>version 2.2 (2013-06-18)
* Refactors dynamic OpenID Connect client registration.
* Adds partial support of the OAuth 2.0 Dynamic Client Registration
Protocol (draft-ietf-oauth-dyn-reg-12).
* Optimises parsing of request parameters consisting of one or more
tokens (scope, response type, etc).</p>
<p>version 2.3 (2013-06-19)
* Renames OAuth 2.0 dynamic client registration package.
* Adds ClientInformation.getClientMetadata() method.
* Adds OIDCClientInformation class.</p>
<p>version 2.4 (2013-06-20)
* Adds static OIDCClientInformation.parse(JSONObject) method.</p>
<p>version 2.5 (2013-06-22)
* Adds support OAuth 2.0 dynamic client update.
* Adds OpenID Connect dynamic client registration classes.</p>
<p>version 2.6 (2013-06-25)
* Enforces order of preference of ACR values in OpenID Connect client
metadata, as required by the specification.
* Documentation and performance improvements.</p>
<p>version 2.7 (2013-06-26)
* Switches Identifier generation to java.security.SecureRandom.</p>
<p>version 2.8 (2013-06-30)
* Fixes serialisation and assignment bugs in ClientMetadata.
* Switches Secret generation to java.security.SecureRandom.</p>
<p>version 2.9 (2013-09-17)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/d98de1ab39f699e39903967775abc242fc064e78"><code>d98de1a</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/2ea716f29401515a656c73bef9d66d5860270b2f"><code>2ea716f</code></a>
Shortens InvalidClientException messages</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/ed5773c5a3383a4c5af5f8484aad2864dc1b79c6"><code>ed5773c</code></a>
TokenRevocationRequest receives custom form parameters support</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/e133559f00d1469a5da284cfdbb30d4d0102e3be"><code>e133559</code></a>
Updates tests for shortened InvalidClientException messages</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/fe43e1f129febee53c0a15178b08b6e835bcd460"><code>fe43e1f</code></a>
[maven-release-plugin] prepare release 11.35</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/73224c9422c0ebb3c1a3b5387aac2d529d8bef5b"><code>73224c9</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/f3f728613feb023640801faf33873d55f6c2ec98"><code>f3f7286</code></a>
Adds static JSONObjectUtils.getNonNegativeLong methods</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/d6899e0554d630956dd09e3d2ba1236ee66d2bd6"><code>d6899e0</code></a>
Cleans up JSONObjectUtils.getEnum(net.minidev.json.JSONObject,
java.lang.Stri...</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/9b05d23a876550842e75c1abff08795ac825b9a0"><code>9b05d23</code></a>
Adds non-negative checks when parsing Date instances from Unix
timestamps (is...</li>
<li><a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/commits/592d8f4e82e7815966258c114b66834b9b4c9e6c"><code>592d8f4</code></a>
Adds &quot;acr&quot; and &quot;auth_time&quot; parameter (RFC 9470)
support to TokenIntrospection...</li>
<li>Additional commits viewable in <a
href="https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.37..11.34">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.nimbusds:oauth2-oidc-sdk&package-manager=maven&previous-version=11.34&new-version=11.37)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Mar 30, 2026
    Configuration menu
    Copy the full SHA
    89fa995 View commit details
    Browse the repository at this point in the history

  3. MINOR: Bump com.gradle:develocity-maven-extension from 2.3.4 to 2.4.0 (… 

    …apache#1095)

Bumps com.gradle:develocity-maven-extension from 2.3.4 to 2.4.0.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.gradle:develocity-maven-extension&package-manager=maven&previous-version=2.3.4&new-version=2.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Mar 30, 2026
    Configuration menu
    Copy the full SHA
    4297733 View commit details
    Browse the repository at this point in the history

  4. MINOR: Bump com.google.api.grpc:proto-google-common-protos from 2.66.… 

    …0 to 2.67.0 (apache#1092)

Bumps
[com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java)
from 2.66.0 to 2.67.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/sdk-platform-java/releases">com.google.api.grpc:proto-google-common-protos's
releases</a>.</em></p>
<blockquote>
<h2>v2.67.0</h2>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.1...v2.67.0">2.67.0</a>
(2026-02-18)</h2>
<h3>Features</h3>
<ul>
<li><strong>observability:</strong> introduce minimal tracing
implementation (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4105">#4105</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/e4e5e893e7a62bd12528e7d448dc2789f71946eb">e4e5e89</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgrade Google-Auth-Library to v1.43.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4114">#4114</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/825298b6bf225bb8536ecab9d788f82f3f8eec4d">825298b</a>)</li>
<li>Upgrade grpc to 1.76.3 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4106">#4106</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/c6555f5f0cd85683db76394271e1f57989cac7d0">c6555f5</a>)</li>
</ul>
<h2>v2.66.1</h2>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.0...v2.66.1">2.66.1</a>
(2026-02-04)</h2>
<h3>Documentation</h3>
<ul>
<li>[common-protos] update reference documentation for
<code>SelectionInput.DROPDOWN</code> to include dynamic data sources and
autosuggestion (<a
href="https://github.com/googleapis/sdk-platform-java/commit/9960262cf248400836c04063e6a701bec2aca1ba">9960262</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/sdk-platform-java/blob/main/CHANGELOG.md">com.google.api.grpc:proto-google-common-protos's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.1...v2.67.0">2.67.0</a>
(2026-02-18)</h2>
<h3>Features</h3>
<ul>
<li><strong>observability:</strong> introduce minimal tracing
implementation (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4105">#4105</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/e4e5e893e7a62bd12528e7d448dc2789f71946eb">e4e5e89</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li>Upgrade Google-Auth-Library to v1.43.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4114">#4114</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/825298b6bf225bb8536ecab9d788f82f3f8eec4d">825298b</a>)</li>
<li>Upgrade grpc to 1.76.3 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4106">#4106</a>)
(<a
href="https://github.com/googleapis/sdk-platform-java/commit/c6555f5f0cd85683db76394271e1f57989cac7d0">c6555f5</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.0...v2.66.1">2.66.1</a>
(2026-02-04)</h2>
<h3>Documentation</h3>
<ul>
<li>[common-protos] update reference documentation for
<code>SelectionInput.DROPDOWN</code> to include dynamic data sources and
autosuggestion (<a
href="https://github.com/googleapis/sdk-platform-java/commit/9960262cf248400836c04063e6a701bec2aca1ba">9960262</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/50d2af33e055075693b8ee14cc8a2da107320144"><code>50d2af3</code></a>
chore(main): release 2.67.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4107">#4107</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/ffb6b02f9711d247204fce57d98d5f0fb974bf39"><code>ffb6b02</code></a>
chore(deps): update upper bound dependencies file (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4112">#4112</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/825298b6bf225bb8536ecab9d788f82f3f8eec4d"><code>825298b</code></a>
deps: Upgrade Google-Auth-Library to v1.43.0 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4114">#4114</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/3fa1ca3ffa0e4d103e2812bd5c29547b7e4d6410"><code>3fa1ca3</code></a>
chore: update googleapis commit at Thu Feb 5 03:00:22 UTC 2026 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4104">#4104</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/e4e5e893e7a62bd12528e7d448dc2789f71946eb"><code>e4e5e89</code></a>
feat(observability): introduce minimal tracing implementation (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4105">#4105</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/c6555f5f0cd85683db76394271e1f57989cac7d0"><code>c6555f5</code></a>
deps: Upgrade grpc to 1.76.3 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4106">#4106</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/117c390d24a734aafb0f994ded30a054c6eed901"><code>117c390</code></a>
chore(main): release 2.66.2-SNAPSHOT (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4102">#4102</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/ff33367579969c7ce65dd84a505f8d91b8ba67fd"><code>ff33367</code></a>
tests: Upgrade logback to 1.5.25 in tests (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4103">#4103</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/a4d8c44b60f3285244afbff7ef2cbfe032947688"><code>a4d8c44</code></a>
tests: Remove 3.25.8 from protobuf compatibility testing (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4101">#4101</a>)</li>
<li><a
href="https://github.com/googleapis/sdk-platform-java/commit/3b280a3d65bc45368536e715a4fa6c04ddbfff66"><code>3b280a3</code></a>
chore(main): release 2.66.1 (<a
href="https://redirect.github.com/googleapis/sdk-platform-java/issues/4100">#4100</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/sdk-platform-java/compare/v2.66.0...v2.67.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.google.api.grpc:proto-google-common-protos&package-manager=maven&previous-version=2.66.0&new-version=2.67.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Mar 30, 2026
    Configuration menu
    Copy the full SHA
    447372c View commit details
    Browse the repository at this point in the history

  5. MINOR: Bump org.apache:apache from 33 to 37 (apache#1033) 

    Bumps [org.apache:apache](https://github.com/apache/maven-apache-parent)
from 33 to 37.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/maven-apache-parent/releases">org.apache:apache's
releases</a>.</em></p>
<blockquote>
<h2>Apache Parent POM version 37</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li>Disable parallel PUT on release (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/566">#566</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
</ul>
<h2>Apache Parent POM version 36</h2>
<!-- raw HTML omitted -->
<h2>:boom: Breaking changes</h2>
<ul>
<li>Update minimum maven version to match current stable version (3.6.3
-&gt; 3.9) (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/533">#533</a>)
<a
href="https://github.com/DomGarguilo"><code>@​DomGarguilo</code></a></li>
<li>Introduce javaVersion property for maven.compiler.* configuration
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/551">#551</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li>Switch JDK &gt;= 9 to only use maven.compiler.release (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/543">#543</a>)
<a href="https://github.com/gnodet"><code>@​gnodet</code></a></li>
</ul>
<h2>🚀 New features and improvements</h2>
<ul>
<li>Update minimum maven version to match current stable version (3.6.3
-&gt; 3.9) (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/533">#533</a>)
<a
href="https://github.com/DomGarguilo"><code>@​DomGarguilo</code></a></li>
<li>Introduce javaVersion property for maven.compiler.* configuration
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/551">#551</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li>Switch JDK &gt;= 9 to only use maven.compiler.release (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/543">#543</a>)
<a href="https://github.com/gnodet"><code>@​gnodet</code></a></li>
<li>Add default specification and implementation for javadoc and source
manifest entries (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/548">#548</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
</ul>
<h2>📝 Documentation updates</h2>
<ul>
<li>Clarify how to use Apache Snapshot repository (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/558">#558</a>)
<a href="https://github.com/kwin"><code>@​kwin</code></a></li>
<li>activate Fluido skin's anchorJs (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/553">#553</a>)
<a href="https://github.com/hboutemy"><code>@​hboutemy</code></a></li>
</ul>
<h2>👻 Maintenance</h2>
<ul>
<li>Avoid - WARNING: Use of the three-letter time zone ID ... on JDK 25
for RAT plugin (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/562">#562</a>)
<a
href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li>feat: enable prevent branch protection rules (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/535">#535</a>)
<a href="https://github.com/sebtiem"><code>@​sebtiem</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>Bump org.apache.maven.plugins:maven-release-plugin from 3.3.0 to
3.3.1 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/565">#565</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-release-plugin from 3.2.0 to
3.3.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/559">#559</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to
3.4.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/557">#557</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to
3.8.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/556">#556</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-war-plugin from 3.5.0 to 3.5.1
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/555">#555</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-resources-plugin from 3.3.1 to
3.4.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/554">#554</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/552">#552</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Upgrade maven-release-plugin to version 3.2.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/549">#549</a>)
<a href="https://github.com/kwin"><code>@​kwin</code></a></li>
<li>Bump org.apache.maven.plugins:maven-dependency-plugin from 3.8.1 to
3.9.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/542">#542</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-war-plugin from 3.4.0 to 3.5.0
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/546">#546</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump version.maven-plugin-tools from 3.15.1 to 3.15.2 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/547">#547</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-antrun-plugin from 3.1.0 to
3.2.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/545">#545</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.1 to
3.6.2 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/541">#541</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-scm-plugin from 2.1.0 to 2.2.1
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/540">#540</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-ear-plugin from 3.3.0 to 3.4.0
(<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/527">#527</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.3 to
3.12.0 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/538">#538</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.0 to
3.14.1 (<a
href="https://redirect.github.com/apache/maven-apache-parent/pull/539">#539</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/apache/maven-apache-parent/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache:apache&package-manager=maven&previous-version=33&new-version=37)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
    @dependabot
    dependabot[bot] authored Mar 30, 2026
    Configuration menu
    Copy the full SHA
    0703021 View commit details
    Browse the repository at this point in the history

  6. MINOR: Bump com.diffplug.spotless:spotless-maven-plugin from 2.44.4 t… 

    …o 3.4.0 (apache#1088)

Bumps
[com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless)
from 2.44.4 to 3.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/diffplug/spotless/releases">com.diffplug.spotless:spotless-maven-plugin's
releases</a>.</em></p>
<blockquote>
<h2>Maven Plugin v3.4.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>tableTest</code> format type for standalone
<code>.table</code> files. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2880">#2880</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Bump default <code>tabletest-formatter</code> version
<code>1.0.1</code> -&gt; <code>1.1.1</code>, now works with Java 17+.
(<a
href="https://redirect.github.com/diffplug/spotless/pull/2880">#2880</a>)</li>
</ul>
<h2>Lib v3.3.1</h2>
<h3>Fixed</h3>
<ul>
<li><code>GitPrePushHookInstaller</code> didn't work on windows, now
fixed. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2562">#2562</a>)</li>
</ul>
<h2>Lib v3.3.0</h2>
<h3>Added</h3>
<ul>
<li>Allow specifying path to Biome JSON config file directly in
<code>biome</code> step. Requires biome 2.x. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2548">#2548</a>)</li>
<li><code>GitPrePushHookInstaller</code>, a reusable library component
for installing a Git <code>pre-push</code> hook that runs formatter
checks. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2553">#2553</a>)</li>
<li>Allow setting Eclipse XML config from a string, not only from files
(<a
href="https://redirect.github.com/diffplug/spotless/pull/2361">#2361</a>)</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Bump default <code>gson</code> version to latest <code>2.11.0</code>
-&gt; <code>2.13.1</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2414">#2414</a>)</li>
<li>Bump default <code>jackson</code> version to latest
<code>2.18.1</code> -&gt; <code>2.19.2</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2558">#2558</a>)</li>
<li>Bump default <code>gherkin-utils</code> version to latest
<code>9.0.0</code> -&gt; <code>9.2.0</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2408">#2408</a>)</li>
<li>Bump default <code>cleanthat</code> version to latest
<code>2.22</code> -&gt; <code>2.23</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2556">#2556</a>)</li>
</ul>
<h2>Maven Plugin v3.3.0</h2>
<h3>Added</h3>
<ul>
<li>Add <code>tabletest-formatter</code> support for Java and Kotlin.
(<a
href="https://redirect.github.com/diffplug/spotless/pull/2860">#2860</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix the ability to specify a wildcard version (<code>*</code>) for
external formatter executables, which did not work. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2848">#2848</a>)</li>
<li>[fix] <code>ConcurrentModificationException</code> in
<code>expandWildcardImports</code> (<a
href="https://redirect.github.com/diffplug/spotless/issues/2830">#2830</a>)</li>
</ul>
<h2>Maven Plugin v3.2.1</h2>
<h3>Fixed</h3>
<ul>
<li><code>removeSemicolons()</code> should not be applied to multiline
strings in groovy <a
href="https://redirect.github.com/diffplug/spotless/issues/2780">#2780</a>
(<a
href="https://redirect.github.com/diffplug/spotless/issues/2792">#2792</a>)</li>
</ul>
<h2>Lib v3.2.0</h2>
<h3>Added</h3>
<ul>
<li>Support for <code>idea</code> (<a
href="https://redirect.github.com/diffplug/spotless/pull/2020">#2020</a>,
<a
href="https://redirect.github.com/diffplug/spotless/pull/2535">#2535</a>)</li>
<li>Add support for removing wildcard imports via
<code>removeWildcardImports</code> step. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2517">#2517</a>)</li>
<li>scalafmt: enforce version consistency between the version configured
in Spotless and the version declared in Scalafmt config file (<a
href="https://redirect.github.com/diffplug/spotless/issues/2460">#2460</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>SortPom</code> disable expandEmptyElements, to avoid empty
body warnings. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2520">#2520</a>)</li>
<li>Fix biome formatter for new major release 2.x of biome (<a
href="https://redirect.github.com/diffplug/spotless/pull/2537">#2537</a>)</li>
<li>Make sure npm-based formatters use the correct
<code>node_modules</code> directory when running in parallel. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2542">#2542</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Bump internal dependencies for npm-based formatters (<a
href="https://redirect.github.com/diffplug/spotless/pull/2542">#2542</a>)</li>
</ul>
<h2>Maven Plugin v3.2.0</h2>
<h3>Added</h3>
<ul>
<li>Add the ability to specify a wildcard version (<code>*</code>) for
external formatter executables. (<a
href="https://redirect.github.com/diffplug/spotless/issues/2757">#2757</a>)</li>
</ul>
<h3>Changes</h3>
<ul>
<li>Dramatic (~100x) performance improvement when using git
<code>ratchetFrom</code>. (<a
href="https://redirect.github.com/diffplug/spotless/pull/2805">#2805</a>)</li>
</ul>
<h3>Fixed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/diffplug/spotless/commit/708a1b0e6383ad2dd34cf3def185bb085a786789"><code>708a1b0</code></a>
Published maven/3.4.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/1cc0163c25b52824cd57b56cdcb8c4cb0c7b4795"><code>1cc0163</code></a>
Published gradle/8.4.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/a4cd808f6092c6ed9371205de4af5285beea9533"><code>a4cd808</code></a>
Published lib/4.5.0</li>
<li><a
href="https://github.com/diffplug/spotless/commit/9066bf6ede907e913fbe30259de0763f1b0b55ea"><code>9066bf6</code></a>
Add links to the changelog.</li>
<li><a
href="https://github.com/diffplug/spotless/commit/db8dc1cc8e83b18ef357a0e660f03556fd792247"><code>db8dc1c</code></a>
Fix for illegal mutation issue with <code>predeclareDeps</code> (<a
href="https://redirect.github.com/diffplug/spotless/issues/2892">#2892</a>)</li>
<li><a
href="https://github.com/diffplug/spotless/commit/0eb98a9574304e362f0ca6ddbfb71617de46df75"><code>0eb98a9</code></a>
chore: Updated gradle plugin change</li>
<li><a
href="https://github.com/diffplug/spotless/commit/3f7f12e649b1085a7937b8730e6a7689a52ca6da"><code>3f7f12e</code></a>
chore: Removes check for predeclare as it's not needed anymore</li>
<li><a
href="https://github.com/diffplug/spotless/commit/55c0c5c081b83ad35e92911718e3069a64467c2a"><code>55c0c5c</code></a>
fix: IsolatedProjectTest.predeclaredIsUnsupported() is now actually
supported...</li>
<li><a
href="https://github.com/diffplug/spotless/commit/47489afd92aa79f56372bd53e82d09a44f606a32"><code>47489af</code></a>
fix: avoid IllegalMutationException when root project uses
predeclareDeps() w...</li>
<li><a
href="https://github.com/diffplug/spotless/commit/4010e8b42c32b8dfac31a988c6820b6b0ef499bd"><code>4010e8b</code></a>
test: Introduce a test harnessing predeclared deps</li>
<li>Additional commits viewable in <a
href="https://github.com/diffplug/spotless/compare/maven/2.44.4...maven/3.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.diffplug.spotless:spotless-maven-plugin&package-manager=maven&previous-version=2.44.4&new-version=3.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JB Onofré <jbonofre@apache.org>
Co-authored-by: JB Onofré <jb.onofre@dremio.com>
    @dependabot @jbonofre
    3 people authored Mar 30, 2026
    Configuration menu
    Copy the full SHA
    e54681b View commit details
    Browse the repository at this point in the history
Loading