Update from upstream

.baseline/checkstyle/checkstyle.xml

@@ -88,6 +88,12 @@
         <property name="format" value="Preconditions\.checkArgument\([^;]+%d[^;]+\);"/>
         <property name="message" value="Preconditions.checkArgument does not support %d. use %s instead"/>
     </module>
+    <module name="RegexpMultiline">
+        <property name="fileExtensions" value="java"/>
+        <property name="matchAcrossLines" value="true"/>
+        <property name="format" value="Preconditions\.checkState\([^;]+%d[^;]+\);"/>
+        <property name="message" value="Preconditions.checkState does not support %d. use %s instead"/>
+    </module>
     <module name="RegexpMultiline">
         <property name="format" value="^\s*import\s+static\s+(?!\Qorg.assertj.core.api.Assertions.\E).*\.assertThatThrownBy;"/>
         <property name="message" value="assertThatThrownBy() should be statically imported from org.assertj.core.api.Assertions"/>

.github/ISSUE_TEMPLATE/iceberg_bug_report.yml

@@ -34,7 +34,9 @@ body:
       description: What Apache Iceberg version are you using?
       multiple: false
       options:
-        - "1.10.1 (latest release)"
+        - "1.11.0 (latest release)"
+        - "1.10.2"
+        - "1.10.1"
         - "1.10.0"
         - "1.9.2"
         - "1.9.1"

.github/workflows/api-binary-compatibility.yml

@@ -60,6 +60,9 @@ jobs:
           distribution: zulu
           java-version: 17
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Read-only: small job; restore opportunistically from other jobs' caches but never write.
+          cache-read-only: true
       - run: |
           echo "Using the old version tag, as per git describe, of $(git describe)";
       - run: ./gradlew revapi --rerun-tasks

.github/workflows/codeql.yml

@@ -46,11 +46,11 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+      uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
       with:
         languages: actions
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+      uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
       with:
         category: "/language:actions"

.github/workflows/cve-scan.yml

@@ -0,0 +1,172 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+name: "CVE Scan"
+on:
+  push:
+    branches:
+    - 'main'
+    - '0.*'
+    - '1.*'
+    - '2.*'
+    tags:
+    - 'apache-iceberg-**'
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+
+  # ------------------------------------------------------------------
+  # Trivy CVE scan — scans bundled jars for known vulnerabilities.
+  #
+  # Behaviour:
+  #   - On PRs: the scan blocks CI if CVEs are found (exit-code 1).
+  #     SARIF upload is skipped because GitHub's Security tab only
+  #     accepts results from default/protected branches.
+  #   - On push to main/release branches: the scan is informational
+  #     (exit-code 0) and results are uploaded as SARIF to the GitHub
+  #     Security tab for ongoing tracking.
+  # ------------------------------------------------------------------
+  cve-scan:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - distribution: kafka-connect-runtime
+          build-task: >-
+            -DkafkaVersions=3
+            :iceberg-kafka-connect:iceberg-kafka-connect-runtime:distZip
+          scan-path: kafka-connect/kafka-connect-runtime/build/distributions
+          unpack: true
+        - distribution: aws-bundle
+          build-task: :iceberg-aws-bundle:shadowJar
+          scan-path: aws-bundle/build/libs
+          unpack: false
+        - distribution: azure-bundle
+          build-task: :iceberg-azure-bundle:shadowJar
+          scan-path: azure-bundle/build/libs
+          unpack: false
+        - distribution: gcp-bundle
+          build-task: :iceberg-gcp-bundle:shadowJar
+          scan-path: gcp-bundle/build/libs
+          unpack: false
+        - distribution: spark-runtime-3.5_2.12
+          build-task: >-
+            -DsparkVersions=3.5
+            :iceberg-spark:iceberg-spark-runtime-3.5_2.12:shadowJar
+          scan-path: spark/v3.5/spark-runtime/build/libs
+          unpack: false
+        - distribution: spark-runtime-4.0_2.13
+          build-task: >-
+            -DsparkVersions=4.0
+            :iceberg-spark:iceberg-spark-runtime-4.0_2.13:shadowJar
+          scan-path: spark/v4.0/spark-runtime/build/libs
+          unpack: false
+        - distribution: spark-runtime-4.1_2.13
+          build-task: >-
+            -DsparkVersions=4.1
+            :iceberg-spark:iceberg-spark-runtime-4.1_2.13:shadowJar
+          scan-path: spark/v4.1/spark-runtime/build/libs
+          unpack: false
+        - distribution: flink-runtime-1.20
+          build-task: >-
+            -DflinkVersions=1.20
+            :iceberg-flink:iceberg-flink-runtime-1.20:shadowJar
+          scan-path: flink/v1.20/flink-runtime/build/libs
+          unpack: false
+        - distribution: flink-runtime-2.0
+          build-task: >-
+            -DflinkVersions=2.0
+            :iceberg-flink:iceberg-flink-runtime-2.0:shadowJar
+          scan-path: flink/v2.0/flink-runtime/build/libs
+          unpack: false
+        - distribution: flink-runtime-2.1
+          build-task: >-
+            -DflinkVersions=2.1
+            :iceberg-flink:iceberg-flink-runtime-2.1:shadowJar
+          scan-path: flink/v2.1/flink-runtime/build/libs
+          unpack: false
+        - distribution: open-api-test-fixtures-runtime
+          build-task: :iceberg-open-api:shadowJar
+          scan-path: open-api/build/libs
+          unpack: false
+    name: ${{ matrix.distribution }}
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      with:
+        distribution: zulu
+        java-version: 21
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: small job; restore opportunistically from other jobs' caches but never write.
+        cache-read-only: true
+    - name: Build ${{ matrix.distribution }}
+      run: |
+        ./gradlew -DsparkVersions= -DflinkVersions= \
+          ${{ matrix.build-task }} \
+          -Pquick=true -x test -x javadoc
+    - name: Prepare scan directory
+      run: |
+        mkdir -p /tmp/cve-scan
+        if [ "${{ matrix.unpack }}" = "true" ]; then
+          unzip ${{ matrix.scan-path }}/*.zip -d /tmp/cve-scan
+        else
+          cp ${{ matrix.scan-path }}/iceberg-${{ matrix.distribution }}-*.jar /tmp/cve-scan/
+        fi
+    - name: Run Trivy vulnerability scan
+      uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1.0.2
+      with:
+        scan-type: 'rootfs'
+        scan-ref: '/tmp/cve-scan'
+        scanners: 'vuln'
+        severity: 'HIGH,CRITICAL'
+        limit-severities-for-sarif: true
+        trivyignores: ${{ matrix.trivyignores || '' }}
+        # Block PRs on CVE findings; on main/release branches report without failing
+        exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }}
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+    - name: Print Trivy scan results
+      if: always()
+      run: |
+        if [ -f trivy-results.sarif ]; then
+          echo "## Trivy CVE Scan Results — ${{ matrix.distribution }}"
+          jq -r '.runs[].results[] | "- \(.ruleId): \(.message.text)"' trivy-results.sarif 2>/dev/null || echo "No findings or unable to parse SARIF."
+        else
+          echo "No SARIF file found — scan may have failed to install."
+        fi
+    - name: Upload Trivy results to GitHub Security tab
+      if: always() && github.event_name == 'push'
+      uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+      with:
+        sarif_file: 'trivy-results.sarif'
+        category: ${{ matrix.distribution }}

.github/workflows/delta-conversion-ci.yml

@@ -37,9 +37,11 @@ on:
       - '.github/workflows/java-ci.yml'
       - '.github/workflows/jmh-benchmarks-ci.yml'
       - '.github/workflows/kafka-connect-ci.yml'
+      - '.github/workflows/cve-scan.yml'
       - '.github/workflows/labeler.yml'
       - '.github/workflows/license-check.yml'
       - '.github/workflows/open-api.yml'
+      - '.github/workflows/pr-title-check.yml'
       - '.github/workflows/publish-snapshot.yml'
       - '.github/workflows/recurring-jmh-benchmarks.yml'
       - '.github/workflows/site-ci.yml'
@@ -88,6 +90,9 @@ jobs:
           distribution: zulu
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Read-only: java-ci's build-checks (17) is the global canonical writer.
+          cache-read-only: true
       - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
       - run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.12 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -114,6 +119,9 @@ jobs:
           distribution: zulu
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Read-only: java-ci's build-checks (17) is the global canonical writer.
+          cache-read-only: true
       - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
       - run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.13 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/flink-ci.yml

@@ -37,9 +37,11 @@ on:
     - '.github/workflows/java-ci.yml'
     - '.github/workflows/jmh-benchmarks-ci.yml'
     - '.github/workflows/kafka-connect-ci.yml'
+    - '.github/workflows/cve-scan.yml'
     - '.github/workflows/labeler.yml'
     - '.github/workflows/license-check.yml'
     - '.github/workflows/open-api.yml'
+    - '.github/workflows/pr-title-check.yml'
     - '.github/workflows/publish-snapshot.yml'
     - '.github/workflows/recurring-jmh-benchmarks.yml'
     - '.github/workflows/site-ci.yml'
@@ -92,6 +94,9 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew -DsparkVersions= -DkafkaVersions= -DflinkVersions=${{ matrix.flink }} :iceberg-flink:iceberg-flink-${{ matrix.flink }}:check :iceberg-flink:iceberg-flink-runtime-${{ matrix.flink }}:check -Pquick=true -x javadoc -DtestParallelism=auto
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/hive-ci.yml

@@ -37,9 +37,11 @@ on:
     - '.github/workflows/java-ci.yml'
     - '.github/workflows/jmh-benchmarks-ci.yml'
     - '.github/workflows/kafka-connect-ci.yml'
+    - '.github/workflows/cve-scan.yml'
     - '.github/workflows/labeler.yml'
     - '.github/workflows/license-check.yml'
     - '.github/workflows/open-api.yml'
+    - '.github/workflows/pr-title-check.yml'
     - '.github/workflows/publish-snapshot.yml'
     - '.github/workflows/recurring-jmh-benchmarks.yml'
     - '.github/workflows/site-ci.yml'
@@ -89,6 +91,9 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true :iceberg-mr:check -x javadoc
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/java-ci.yml

@@ -37,9 +37,11 @@ on:
     - '.github/workflows/hive-ci.yml'
     - '.github/workflows/jmh-benchmarks-ci.yml'
     - '.github/workflows/kafka-connect-ci.yml'
+    - '.github/workflows/cve-scan.yml'
     - '.github/workflows/labeler.yml'
     - '.github/workflows/license-check.yml'
     - '.github/workflows/open-api.yml'
+    - '.github/workflows/pr-title-check.yml'
     - '.github/workflows/publish-snapshot.yml'
     - '.github/workflows/recurring-jmh-benchmarks.yml'
     - '.github/workflows/site-ci.yml'
@@ -84,8 +86,11 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
-    - run: ./gradlew check -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true -x javadoc
+    - run: ./gradlew check -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true -x javadoc -x spotlessCheck
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: failure()
       with:
@@ -108,6 +113,9 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
     - run: ./gradlew -DallModules build -x test -x javadoc -x integrationTest
 
   build-javadoc:
@@ -125,6 +133,9 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: ./gradlew -Pquick=true javadoc
 
   check-runtime-deps:
@@ -138,4 +149,7 @@ jobs:
         distribution: zulu
         java-version: 17
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: ./gradlew checkAllRuntimeDeps -q -DallModules=true

.github/workflows/jmh-benchmarks.yml

@@ -104,6 +104,9 @@ jobs:
         distribution: zulu
         java-version: 17
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Disabled: dispatched against arbitrary repo/ref inputs; never restore or write to avoid cache poisoning.
+        cache-disabled: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
 
     - name: Run Benchmark

.github/workflows/kafka-connect-ci.yml

@@ -40,9 +40,11 @@ on:
     - '.github/workflows/labeler.yml'
     - '.github/workflows/license-check.yml'
     - '.github/workflows/open-api.yml'
+    - '.github/workflows/pr-title-check.yml'
     - '.github/workflows/publish-snapshot.yml'
     - '.github/workflows/recurring-jmh-benchmarks.yml'
     - '.github/workflows/site-ci.yml'
+    - '.github/workflows/cve-scan.yml'
     - '.github/workflows/spark-ci.yml'
     - '.github/workflows/stale.yml'
     - '.gitignore'
@@ -89,6 +91,9 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: |
         ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions=3 \

.github/workflows/labeler.yml

@@ -28,6 +28,6 @@ jobs:
   triage:
     runs-on: ubuntu-slim
     steps:
-    - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+    - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
       with:
         sync-labels: true