Merge branch 'main' into apicurio-registry-ui

Author: mcaveety

.pre-commit-config.yaml

@@ -43,4 +43,4 @@ repos:
       - id: check-merge-conflict
       - id: check-symlinks
       - id: detect-private-key
-        exclude: ^ruby-3\.0/0001-ruby-3\.0\.6-openssl-patch\.patch$
+        exclude: ^(ruby-3\.0/0001-ruby-3\.0\.6-openssl-patch\.patch|gitleaks\.yaml)$

actions-runner-controller.yaml

@@ -1,6 +1,6 @@
 package:
   name: actions-runner-controller
-  version: "0.12.0"
+  version: "0.12.1"
   epoch: 0
   description: Kubernetes controller for GitHub Actions self-hosted runners
   copyright:
@@ -18,7 +18,7 @@ pipeline:
     with:
       repository: https://github.com/actions/actions-runner-controller
       tag: gha-runner-scale-set-${{package.version}}
-      expected-commit: d9826e5244867626c7247ceb63e1a3a87e1a0331
+      expected-commit: ded39bede6da17f807d0b3430e9970d00216f156
 
   - uses: go/build
     with:

airflow-3.yaml

@@ -1,7 +1,7 @@
 package:
   name: airflow-3
   version: "3.0.2"
-  epoch: 1
+  epoch: 2
   description: Platform to programmatically author, schedule, and monitor workflows
   options:
     #  There is a dependency on libarrow.so although it
@@ -109,6 +109,9 @@ pipeline:
       # We need to add this additionally  because graphviz is an optional dependency https://github.com/apache/airflow/blob/d2c9563605ca6d3dc40ec0fc2fe6853c86641441/airflow-core/pyproject.toml#L157
       uv pip install --verbose --upgrade --prefix=${{targets.contextdir}}/opt/airflow graphviz
 
+      # CVE-2025-50181 CVE-2025-50182
+      uv pip install --verbose --upgrade --prefix=${{targets.contextdir}}/opt/airflow urllib3==2.5.0
+
   - name: "Build and install the additional provider packages"
     runs: |
       # By default, the airflow celery provider is not built, but running the upstream helm chart requires it

amazon-cloudwatch-agent-operator.yaml

@@ -1,6 +1,6 @@
 package:
   name: amazon-cloudwatch-agent-operator
-  version: "3.0.1"
+  version: "3.1.0"
   epoch: 1
   description: Software developed to manage the CloudWatch Agent on kubernetes.
   copyright:
@@ -9,10 +9,15 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 7e1557aa893413e8655dd9d383982eae94c815bf
+      expected-commit: 59b74c8cebf0166aa3db92bbc85ca5d2467f130d
       repository: https://github.com/aws/amazon-cloudwatch-agent-operator
       tag: v${{package.version}}
 
+  - uses: go/bump
+    with:
+      deps: |-
+        github.com/go-viper/mapstructure/v2@v2.3.0
+
   - uses: go/build
     with:
       output: manager

amazon-cloudwatch-agent.yaml

@@ -1,7 +1,7 @@
 package:
   name: amazon-cloudwatch-agent
   version: "1.300057.0"
-  epoch: 2
+  epoch: 3
   description: CloudWatch Agent enables you to collect and export host-level metrics and logs on instances running Linux or Windows server.
   copyright:
     - license: Apache-2.0
@@ -21,6 +21,11 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: de987cd83f7aa68932cf7f1870b8342a94a6cb4d
 
+  - uses: go/bump
+    with:
+      deps: |-
+        github.com/go-viper/mapstructure/v2@v2.3.0
+
   - uses: go/build
     with:
       packages: ./cmd/amazon-cloudwatch-agent

apache-arrow.yaml

@@ -1,7 +1,7 @@
 package:
   name: apache-arrow
   version: "20.0.0"
-  epoch: 2
+  epoch: 3
   description: "multi-language toolbox for accelerated data interchange and in-memory processing"
   copyright:
     - license: Apache-2.0
@@ -41,6 +41,7 @@ environment:
       - libprotoc
       - libzstd1
       - lz4-dev
+      - lz4-static
       - openssl-dev
       - protobuf
       - protobuf-dev

apache-orc.yaml

@@ -1,7 +1,7 @@
 package:
   name: apache-orc
   version: "2.1.2"
-  epoch: 0
+  epoch: 1
   description: "the smallest, fastest columnar storage for Hadoop workloads"
   copyright:
     - license: Apache-2.0
@@ -10,7 +10,7 @@ environment:
   contents:
     packages:
       - build-base
-      - cmake
+      - cmake-3
       - lz4-dev
       - protobuf-dev
       - samurai

apache-tika-3.1/pombump-deps.yaml

@@ -1,14 +1,14 @@
 package:
-  name: apache-tika-3.1
-  version: "3.1.0"
-  epoch: 3
+  name: apache-tika-3.2
+  version: "3.2.0"
+  epoch: 0
   description: The Apache Tika toolkit detects and extracts metadata and text from over a thousand different file types (such as PPT, XLS, and PDF).
   copyright:
     - license: Apache-2.0
   dependencies:
     runtime:
       - dash-binsh
-      - openjdk-17-default-jvm
+      - openjdk-21-default-jvm
     provides:
       - apache-tika=${{package.full-version}}
 
@@ -25,20 +25,22 @@ environment:
       - libfontconfig1
       - libjpeg-turbo
       - maven
-      - openjdk-17-default-jdk
+      - openjdk-21-default-jdk
 
 pipeline:
-  - uses: git-checkout
+  - uses: fetch
     with:
-      repository: https://github.com/apache/tika
-      tag: ${{package.version}}
-      expected-commit: 25619272d2f615df4ad87e27e7c8dec576f37627
+      uri: https://downloads.apache.org/tika/${{package.version}}/tika-${{package.version}}-src.zip
+      expected-sha512: 3882a1c1e4dc38de6491b1b9cf686ec703e958a38f4d09821c422ecacdbc0f5c8490c511c9d3875b8e8bfe79176a3febf37e62dcf3897ec3e1f413b99955f218
+      extract: false
 
-  - uses: auth/maven
+  - runs: |
+      unzip tika-${{package.version}}-src.zip
+      mv tika-${{package.version}}/* .
+      rm tika-${{package.version}}-src.zip
+      rmdir tika-${{package.version}}
 
-  - uses: maven/pombump
-    with:
-      properties-file: pombump-properties.yaml
+  - uses: auth/maven
 
   - runs: |
       mvn clean install -am -DskipTests -Dossindex.skip
@@ -55,18 +57,17 @@ subpackages:
 
 update:
   enabled: true
-  github:
-    identifier: apache/tika
-    use-tag: true
-    tag-filter: 3.1.
+  release-monitor:
+    identifier: 15703
+    version-filter-contains: 3.2.
 
 test:
   environment:
     contents:
       packages:
         - curl
         - ${{package.name}}-compat
-        - openjdk-17-default-jvm
+        - openjdk-21-default-jvm
   pipeline:
     - uses: test/daemon-check-output
       with: