main: Update dependency io.micrometer:micrometer-bom to v1.13.4

.github/renovate.json5

@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [
+    "config:base",
+    // Required to not pin dependencies to _exact_ versions (pip)
+    ":preserveSemverRanges",
+    "group:monorepos",
+    "helpers:pinGitHubActionDigests",
+    ":semanticPrefixFixDepsChoreOthers",
+    ":dependencyDashboard",
+  ],
+
+  // Added for posterity how to let Renovate manage version-branches
+  baseBranches: ["main", "/^release\\/.*/"],
+  additionalBranchPrefix: "{{baseBranch}}/",
+  commitMessagePrefix: "{{baseBranch}}: ",
+
+  pip_requirements: {
+    // fileMatch default: (^|/)([\\w-]*)requirements\\.(txt|pip)$
+    "fileMatch": ["(^|/)([\\w-]*)requirements.*\\.txt$"],
+  },
+
+  packageRules: [
+    {
+      matchManagers: ["github-actions"],
+      matchUpdateTypes: ["major", "minor", "patch", "digest"],
+      automerge: true,
+      platformAutomerge: true,
+    },
+
+    // Check for updates, merge automatically
+    {
+      matchManagers: [
+        "gradle", "gradle-wrapper",
+        "pip_requirements", "pip_setup", "poetry", "setup-cfg",
+        "dockerfile", "devcontainer", "docker-compose"],
+      matchUpdateTypes: ["minor", "patch"],
+      automerge: true,
+      platformAutomerge: true,
+    },
+
+    // Check for major updates, but do not merge automatically
+    {
+      matchManagers: [
+        "gradle", "gradle-wrapper",
+        "pip_requirements", "pip_setup", "poetry", "setup-cfg",
+        "dockerfile", "devcontainer", "docker-compose"],
+      matchUpdateTypes: ["major"],
+      automerge: false,
+    },
+
+    // Reduce awssdk update frequency noise (awssdk has daily releases)
+    {
+      matchManagers: ["gradle"],
+      matchPackagePrefixes: ["software.amazon.awssdk"],
+      extends: ["schedule:weekly"],
+    },
+
+    // Turn off major & minor version updates on version-branches
+    {
+      matchBaseBranches: ["/^release/.*/"],
+      matchUpdateTypes: ["major", "minor"],
+      enabled: false
+    },
+  ],
+
+  // Max 50 PRs in total, 5 per hour
+  prConcurrentLimit: 50,
+  prHourlyLimit: 5,
+}

.github/workflows/check-md-link.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@master
-    - uses: gaurav-nelson/github-action-markdown-link-check@v1
+    - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
       with:
         config-file: '.github/workflows/check-md-link-config.json'
         folder-path: '., docs, regtests, regtests/client/python/docs, regtests/client/python'

.github/workflows/gradle.yml

@@ -40,9 +40,9 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@2dfa2011c5b2a0f1489bf9e433881c92c1631f88 # v4
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -63,7 +63,7 @@ jobs:
         run: ./gradlew test
 
       - name: Archive test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
         if: always()
         with:
           name: upload-test-artifacts

.github/workflows/regtest.yml

@@ -32,7 +32,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: fix permissions
         run: mkdir -p regtests/output && chmod 777 regtests/output && chmod 777 regtests/t_*/ref/*
       - name: Regression Test

.github/workflows/stale.yml

@@ -22,7 +22,7 @@ jobs:
   stale:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e
+      - uses: actions/stale@3f3b0175e8c66fb49b9a6d5a0cd1f8436d4c3ab6
         with:
           days-before-close: 5
           days-before-stale: 30

gradle/baselibs.versions.toml

@@ -20,5 +20,5 @@
 [libraries]
 errorprone = { module = "net.ltgt.gradle:gradle-errorprone-plugin", version = "4.0.1" }
 idea-ext = { module = "gradle.plugin.org.jetbrains.gradle.plugin.idea-ext:gradle-idea-ext", version = "1.1.8" }
-license-report = { module = "com.github.jk1:gradle-license-report", version = "2.8" }
+license-report = { module = "com.github.jk1:gradle-license-report", version = "2.9" }
 spotless = { module = "com.diffplug.spotless:spotless-plugin-gradle", version = "6.25.0" }

gradle/libs.versions.toml

@@ -21,7 +21,7 @@
 hadoop = "3.4.0"
 iceberg = "1.5.0"
 dropwizard = "4.0.8"
-slf4j = "2.0.13"
+slf4j = "2.0.16"
 swagger = "1.6.14"
 
 [bundles]
@@ -34,15 +34,15 @@ swagger = "1.6.14"
 #
 assertj-core = { module = "org.assertj:assertj-core", version = "3.26.3" }
 auth0-jwt = { module = "com.auth0:java-jwt", version = "4.4.0" }
-awssdk-bom = { module = "software.amazon.awssdk:bom", version = "2.26.31" }
+awssdk-bom = { module = "software.amazon.awssdk:bom", version = "2.27.21" }
 azuresdk-bom = { module = "com.azure:azure-sdk-bom", version = "1.2.27" }
 bouncycastle-bcprov = { module = "org.bouncycastle:bcprov-jdk18on", version = "1.78.1" }
 caffeine = { module = "com.github.ben-manes.caffeine:caffeine", version = "3.1.8" }
 commons-codec1 = { module = "commons-codec:commons-codec", version = "1.17.1" }
 commons-lang3 = { module = "org.apache.commons:commons-lang3", version = "3.17.0" }
 dropwizard-bom = { module = "io.dropwizard:dropwizard-bom", version.ref = "dropwizard" }
 eclipselink = { module = "org.eclipse.persistence:eclipselink", version = "4.0.4" }
-errorprone = { module = "com.google.errorprone:error_prone_core", version = "2.29.2" }
+errorprone = { module = "com.google.errorprone:error_prone_core", version = "2.32.0" }
 google-cloud-storage-bom = { module = "com.google.cloud:google-cloud-storage-bom", version = "2.42.0" }
 guava = { module = "com.google.guava:guava", version = "33.3.0-jre" }
 h2 = { module = "com.h2database:h2", version = "2.3.232" }
@@ -53,27 +53,27 @@ iceberg-bom = { module = "org.apache.iceberg:iceberg-bom", version.ref = "iceber
 jackson-bom = { module = "com.fasterxml.jackson:jackson-bom", version = "2.17.2" }
 jakarta-annotation-api = { module = "jakarta.annotation:jakarta.annotation-api", version = "3.0.0" }
 jakarta-validation-api = { module = "jakarta.validation:jakarta.validation-api", version = "3.1.0" }
-jakarta-persistence-api = { module = "jakarta.persistence:jakarta.persistence-api", version = "3.1.0" }
+jakarta-persistence-api = { module = "jakarta.persistence:jakarta.persistence-api", version = "3.2.0" }
 javax-annotation-api = { module = "javax.annotation:javax.annotation-api", version = "1.3.2" }
 javax-inject = { module = "javax.inject:javax.inject", version = "1" }
 jetbrains-annotations = { module = "org.jetbrains:annotations", version = "24.1.0" }
-junit-bom = { module = "org.junit:junit-bom", version = "5.10.3" }
-logback-core = { module = "ch.qos.logback:logback-core", version = "1.4.14" }
-micrometer-bom = { module = "io.micrometer:micrometer-bom", version = "1.13.2" }
-mockito-core = { module = "org.mockito:mockito-core", version = "5.11.0" }
-opentelemetry-bom = { module = "io.opentelemetry:opentelemetry-bom", version = "1.38.0" }
+junit-bom = { module = "org.junit:junit-bom", version = "5.11.0" }
+logback-core = { module = "ch.qos.logback:logback-core", version = "1.5.8" }
+micrometer-bom = { module = "io.micrometer:micrometer-bom", version = "1.13.4" }
+mockito-core = { module = "org.mockito:mockito-core", version = "5.13.0" }
+opentelemetry-bom = { module = "io.opentelemetry:opentelemetry-bom", version = "1.42.1" }
 opentelemetry-semconv = { module = "io.opentelemetry.semconv:opentelemetry-semconv", version = "1.25.0-alpha" }
-prometheus-metrics-exporter-servlet-jakarta = { module = "io.prometheus:prometheus-metrics-exporter-servlet-jakarta", version = "1.3.0" }
-s3mock-testcontainers = { module = "com.adobe.testing:s3mock-testcontainers", version = "3.9.1" }
+prometheus-metrics-exporter-servlet-jakarta = { module = "io.prometheus:prometheus-metrics-exporter-servlet-jakarta", version = "1.3.1" }
+s3mock-testcontainers = { module = "com.adobe.testing:s3mock-testcontainers", version = "3.10.0" }
 slf4j-api = { module = "org.slf4j:slf4j-api", version.ref = "slf4j" }
-spotbugs-annotations = { module = "com.github.spotbugs:spotbugs-annotations", version = "4.8.5" }
+spotbugs-annotations = { module = "com.github.spotbugs:spotbugs-annotations", version = "4.8.6" }
 swagger-annotations = { module = "io.swagger:swagger-annotations", version.ref = "swagger" }
 swagger-jaxrs = { module = "io.swagger:swagger-jaxrs", version.ref = "swagger" }
-testcontainers-bom = { module = "org.testcontainers:testcontainers-bom", version = "1.20.0" }
+testcontainers-bom = { module = "org.testcontainers:testcontainers-bom", version = "1.20.1" }
 threeten-extra = { module = "org.threeten:threeten-extra", version = "1.8.0" }
 
 [plugins]
-openapi-generator = { id = "org.openapi.generator", version = "7.6.0" }
+openapi-generator = { id = "org.openapi.generator", version = "7.8.0" }
 rat = { id = "org.nosphere.apache.rat", version = "0.8.1" }
 spotless = { id = "com.diffplug.spotless", version = "6.25.0" }
-shadow = { id = "com.gradleup.shadow", version = "8.3.0" }
+shadow = { id = "com.gradleup.shadow", version = "8.3.1" }

gradle/wrapper/gradle-wrapper.properties

@@ -20,8 +20,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 # See https://gradle.org/release-checksums/ for valid checksums
-distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionSha256Sum=1541fa36599e12857140465f3c91a97409b4512501c26f9631fb113e392c5bd1
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

polaris-core/build.gradle.kts

@@ -31,7 +31,7 @@ dependencies {
   implementation("org.apache.iceberg:iceberg-api")
   implementation("org.apache.iceberg:iceberg-core")
   constraints {
-    implementation("io.airlift:aircompressor:0.27") { because("Vulnerability detected in 0.25") }
+    implementation("io.airlift:aircompressor:2.0.2") { because("Vulnerability detected in 0.25") }
   }
   // TODO - this is only here for the Discoverable interface
   // We should use a different mechanism to discover the plugin implementations
@@ -58,19 +58,19 @@ dependencies {
     exclude("org.apache.zookeeper", "zookeeper")
   }
   constraints {
-    implementation("org.xerial.snappy:snappy-java:1.1.10.4") {
+    implementation("org.xerial.snappy:snappy-java:1.1.10.7") {
       because("Vulnerability detected in 1.1.8.2")
     }
     implementation("org.codehaus.jettison:jettison:1.5.4") {
       because("Vulnerability detected in 1.1")
     }
-    implementation("org.apache.commons:commons-configuration2:2.10.1") {
+    implementation("org.apache.commons:commons-configuration2:2.11.0") {
       because("Vulnerability detected in 2.8.0")
     }
-    implementation("org.apache.commons:commons-compress:1.26.0") {
+    implementation("org.apache.commons:commons-compress:1.27.1") {
       because("Vulnerability detected in 1.21")
     }
-    implementation("com.nimbusds:nimbus-jose-jwt:9.37.2") {
+    implementation("com.nimbusds:nimbus-jose-jwt:9.41.1") {
       because("Vulnerability detected in 9.8.1")
     }
   }
@@ -94,10 +94,10 @@ dependencies {
   implementation("com.azure:azure-identity")
   implementation("com.azure:azure-storage-file-datalake")
   constraints {
-    implementation("io.netty:netty-codec-http2:4.1.100") {
+    implementation("io.netty:netty-codec-http2:4.1.113.Final") {
       because("Vulnerability detected in 4.1.72")
     }
-    implementation("io.projectreactor.netty:reactor-netty-http:1.1.13") {
+    implementation("io.projectreactor.netty:reactor-netty-http:1.1.22") {
       because("Vulnerability detected in 1.0.45")
     }
   }

polaris-service/build.gradle.kts

@@ -93,7 +93,7 @@ dependencies {
 
   testImplementation("org.apache.iceberg:iceberg-spark-3.5_2.12")
   testImplementation("org.apache.iceberg:iceberg-spark-extensions-3.5_2.12")
-  testImplementation("org.apache.spark:spark-sql_2.12:3.5.1") {
+  testImplementation("org.apache.spark:spark-sql_2.12:3.5.2") {
     // exclude log4j dependencies
     exclude("org.apache.logging.log4j", "log4j-slf4j2-impl")
     exclude("org.apache.logging.log4j", "log4j-api")

regtests/Dockerfile

@@ -17,7 +17,7 @@
 # under the License.
 #
 
-FROM docker.io/apache/spark:3.5.1-python3
+FROM docker.io/apache/spark:3.5.2-python3
 ARG POLARIS_HOST=polaris
 ENV POLARIS_HOST=$POLARIS_HOST
 ENV SPARK_HOME=/opt/spark

regtests/client/python/.github/workflows/python.yml

@@ -35,9 +35,9 @@ jobs:
         python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies

regtests/client/python/.gitlab-ci.yml

@@ -34,16 +34,16 @@ stages:
 
 pytest-3.7:
   extends: .pytest
-  image: python:3.7-alpine
+  image: python:3.12-alpine
 pytest-3.8:
   extends: .pytest
-  image: python:3.8-alpine
+  image: python:3.12-alpine
 pytest-3.9:
   extends: .pytest
-  image: python:3.9-alpine
+  image: python:3.12-alpine
 pytest-3.10:
   extends: .pytest
-  image: python:3.10-alpine
+  image: python:3.12-alpine
 pytest-3.11:
   extends: .pytest
-  image: python:3.11-alpine
+  image: python:3.12-alpine