From 902d2e32c9f69c2275b92be7e87ffb46baf3f292 Mon Sep 17 00:00:00 2001
From: "renovate-sh-app[bot]"
 <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Date: Wed, 6 May 2026 22:05:37 +0000
Subject: [PATCH] chore(deps): Update module github.com/apache/thrift to
 v0.23.0 [SECURITY]

| datasource | package                  | from    | to      |
| ---------- | ------------------------ | ------- | ------- |
| go         | github.com/apache/thrift | v0.22.0 | v0.23.0 |


Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
---
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 vendor/github.com/apache/thrift/LICENSE       |   9 ++
 .../thrift/lib/go/thrift/binary_protocol.go   |  65 +++++++++--
 .../thrift/lib/go/thrift/compact_protocol.go  |  58 ++++++++--
 .../thrift/lib/go/thrift/configuration.go     |   2 +-
 .../thrift/lib/go/thrift/framed_transport.go  |  14 ++-
 .../thrift/lib/go/thrift/header_transport.go  |  40 ++-----
 .../thrift/lib/go/thrift/json_protocol.go     |  50 +++++++-
 .../lib/go/thrift/multiplexed_protocol.go     |   7 +-
 .../apache/thrift/lib/go/thrift/pool.go       |   2 +-
 .../thrift/lib/go/thrift/server_socket.go     |  12 +-
 .../thrift/lib/go/thrift/simple_server.go     |  11 +-
 .../lib/go/thrift/socket_aix_syscall.go       |   1 -
 .../lib/go/thrift/socket_non_aix_syscall.go   |   1 -
 .../lib/go/thrift/socket_non_unix_conn.go     |   1 -
 .../thrift/lib/go/thrift/socket_unix_conn.go  |   1 -
 .../apache/thrift/lib/go/thrift/zlib_pool.go  | 109 ++++++++++++++++++
 .../thrift/lib/go/thrift/zlib_transport.go    |  19 +--
 vendor/modules.txt                            |   4 +-
 20 files changed, 322 insertions(+), 90 deletions(-)
 create mode 100644 vendor/github.com/apache/thrift/lib/go/thrift/zlib_pool.go

diff --git a/go.mod b/go.mod
index 05eedc1e952..22decc4cecb 100644
--- a/go.mod
+++ b/go.mod
@@ -160,7 +160,7 @@ require (
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/andybalholm/brotli v1.2.1 // indirect
-	github.com/apache/thrift v0.22.0 // indirect
+	github.com/apache/thrift v0.23.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.9 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
diff --git a/go.sum b/go.sum
index b51c9e7dfd7..5136c9d0875 100644
--- a/go.sum
+++ b/go.sum
@@ -140,8 +140,8 @@ github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eT
 github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/apache/arrow-go/v18 v18.6.0 h1:GX/Jyd3R7mCLiECAwY9FWbbaYblie2WXBSz4Sw8fNpM=
 github.com/apache/arrow-go/v18 v18.6.0/go.mod h1:gm3MiPpY82fLYK5VKPB3WoJbsiLVDfT7flD5/vHReKw=
-github.com/apache/thrift v0.22.0 h1:r7mTJdj51TMDe6RtcmNdQxgn9XcyfGDOzegMDRg47uc=
-github.com/apache/thrift v0.22.0/go.mod h1:1e7J/O1Ae6ZQMTYdy9xa3w9k+XHWPfRvdPyJeynQ+/g=
+github.com/apache/thrift v0.23.0 h1:wKR6YnefQSEnxpEfmgTPuJibNG4bF0p2TK34tHLWi3s=
+github.com/apache/thrift v0.23.0/go.mod h1:zPt6WxgvTOM6hF92y8C+MkEM5LMxZuk4JcQOiU4Esvs=
 github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
 github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
diff --git a/vendor/github.com/apache/thrift/LICENSE b/vendor/github.com/apache/thrift/LICENSE
index 2bc6fbbf65c..f308fa849ed 100644
--- a/vendor/github.com/apache/thrift/LICENSE
+++ b/vendor/github.com/apache/thrift/LICENSE
@@ -304,3 +304,12 @@ For t_cl_generator.cc
  * Copyright (c) 2006- Facebook
 
 ---------------------------------------------------
+
+---------------------------------------------------
+For compiler/cpp/src/thrift/generate/sha256.h
+
+SHA-256 implementation by Brad Conte (brad AT bradconte.com).
+Source: https://github.com/B-Con/crypto-algorithms
+The author has placed this code in the public domain (no copyright claimed).
+No algorithmic changes were made; the file was adapted to a C++ header-only
+form for inclusion in the Thrift compiler.
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/binary_protocol.go b/vendor/github.com/apache/thrift/lib/go/thrift/binary_protocol.go
index eded931346e..3f2843ef966 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/binary_protocol.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/binary_protocol.go
@@ -355,7 +355,9 @@ func (p *TBinaryProtocol) ReadMapBegin(ctx context.Context) (kType, vType TType,
 		err = NewTProtocolException(e)
 		return
 	}
-	err = checkSizeForProtocol(size32, p.cfg)
+	minElemSize := p.getMinSerializedSize(kType) + p.getMinSerializedSize(vType)
+	totalMinSize := size32 * minElemSize
+	err = checkSizeForProtocol(totalMinSize, p.cfg)
 	if err != nil {
 		return
 	}
@@ -379,7 +381,9 @@ func (p *TBinaryProtocol) ReadListBegin(ctx context.Context) (elemType TType, si
 		err = NewTProtocolException(e)
 		return
 	}
-	err = checkSizeForProtocol(size32, p.cfg)
+	minElemSize := p.getMinSerializedSize(elemType)
+	totalMinSize := size32 * minElemSize
+	err = checkSizeForProtocol(totalMinSize, p.cfg)
 	if err != nil {
 		return
 	}
@@ -404,7 +408,9 @@ func (p *TBinaryProtocol) ReadSetBegin(ctx context.Context) (elemType TType, siz
 		err = NewTProtocolException(e)
 		return
 	}
-	err = checkSizeForProtocol(size32, p.cfg)
+	minElemSize := p.getMinSerializedSize(elemType)
+	totalMinSize := size32 * minElemSize
+	err = checkSizeForProtocol(totalMinSize, p.cfg)
 	if err != nil {
 		return
 	}
@@ -546,16 +552,59 @@ var (
 	_ TConfigurationSetter = (*TBinaryProtocol)(nil)
 )
 
+// Return the minimum number of bytes a type will consume on the wire
+func (p *TBinaryProtocol) getMinSerializedSize(ttype TType) int32 {
+	switch ttype {
+	case STOP:
+		return 1 // T_STOP needs to count itself
+	case VOID:
+		return 1 // T_VOID needs to count itsel∂
+	case BOOL:
+		return 1 // sizeof(int8)
+	case BYTE:
+		return 1 // sizeof(int8)
+	case DOUBLE:
+		return 8 // sizeof(double)
+	case I16:
+		return 2 // sizeof(short)
+	case I32:
+		return 4 // sizeof(int)
+	case I64:
+		return 8 // sizeof(long)
+	case STRING:
+		return 4 // string length
+	case STRUCT:
+		return 1 // empty struct needs at least 1 byte for the T_STOP
+	case MAP:
+		return 4 // element count
+	case SET:
+		return 4 // element count
+	case LIST:
+		return 4 // element count
+	case UUID:
+		return 16 // 16 bytes
+	default:
+		return 1 // unknown type
+	}
+}
+
 // This function is shared between TBinaryProtocol and TCompactProtocol.
 //
 // It tries to read size bytes from trans, in a way that prevents large
-// allocations when size is insanely large (mostly caused by malformed message).
+// allocations when size is insanely large (mostly caused by malformed message),
+// or smaller than bytes.MinRead.
 func safeReadBytes(size int32, trans io.Reader) ([]byte, error) {
 	if size < 0 {
 		return nil, nil
 	}
-
-	buf := new(bytes.Buffer)
-	_, err := io.CopyN(buf, trans, int64(size))
-	return buf.Bytes(), err
+	if size > bytes.MinRead {
+		// Use bytes.Buffer to prevent allocating size bytes when size is very large
+		buf := new(bytes.Buffer)
+		_, err := io.CopyN(buf, trans, int64(size))
+		return buf.Bytes(), err
+	}
+	// Allocate size bytes
+	b := make([]byte, size)
+	n, err := io.ReadFull(trans, b)
+	return b[:n], err
 }
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/compact_protocol.go b/vendor/github.com/apache/thrift/lib/go/thrift/compact_protocol.go
index 18915fee8ad..a5223d38e41 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/compact_protocol.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/compact_protocol.go
@@ -486,10 +486,6 @@ func (p *TCompactProtocol) ReadMapBegin(ctx context.Context) (keyType TType, val
 		err = NewTProtocolException(e)
 		return
 	}
-	err = checkSizeForProtocol(size32, p.cfg)
-	if err != nil {
-		return
-	}
 	size = int(size32)
 
 	keyAndValueType := byte(STOP)
@@ -501,6 +497,13 @@ func (p *TCompactProtocol) ReadMapBegin(ctx context.Context) (keyType TType, val
 	}
 	keyType, _ = p.getTType(tCompactType(keyAndValueType >> 4))
 	valueType, _ = p.getTType(tCompactType(keyAndValueType & 0xf))
+
+	minElemSize := p.getMinSerializedSize(keyType) + p.getMinSerializedSize(valueType)
+	totalMinSize := size32 * minElemSize
+	err = checkSizeForProtocol(totalMinSize, p.cfg)
+	if err != nil {
+		return
+	}
 	return
 }
 
@@ -524,15 +527,18 @@ func (p *TCompactProtocol) ReadListBegin(ctx context.Context) (elemType TType, s
 		}
 		size = int(size2)
 	}
-	err = checkSizeForProtocol(int32(size), p.cfg)
-	if err != nil {
-		return
-	}
 	elemType, e := p.getTType(tCompactType(size_and_type))
 	if e != nil {
 		err = NewTProtocolException(e)
 		return
 	}
+
+	minElemSize := p.getMinSerializedSize(elemType)
+	totalMinSize := int32(size) * minElemSize
+	err = checkSizeForProtocol(totalMinSize, p.cfg)
+	if err != nil {
+		return
+	}
 	return
 }
 
@@ -860,6 +866,42 @@ func (p *TCompactProtocol) SetTConfiguration(conf *TConfiguration) {
 	p.cfg = conf
 }
 
+// Return the minimum number of bytes a type will consume on the wire
+func (p *TCompactProtocol) getMinSerializedSize(ttype TType) int32 {
+	switch ttype {
+	case STOP:
+		return 1 // T_STOP needs to count itself
+	case VOID:
+		return 1 // T_VOID needs to count itself
+	case BOOL:
+		return 1 // sizeof(int8)
+	case BYTE:
+		return 1 // sizeof(int8)
+	case DOUBLE:
+		return 8 // uses PutUint64() which always writes 8 bytes
+	case I16:
+		return 1 // zigzag
+	case I32:
+		return 1 // zigzag
+	case I64:
+		return 1 // zigzag
+	case STRING:
+		return 1 // string length
+	case STRUCT:
+		return 1 // empty struct needs at least 1 byte for the T_STOP
+	case MAP:
+		return 1 // element count
+	case SET:
+		return 1 // element count
+	case LIST:
+		return 1 // element count
+	case UUID:
+		return 16 // 16 bytes
+	default:
+		return 1 // unknown type
+	}
+}
+
 var (
 	_ TConfigurationSetter = (*TCompactProtocolFactory)(nil)
 	_ TConfigurationSetter = (*TCompactProtocol)(nil)
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/configuration.go b/vendor/github.com/apache/thrift/lib/go/thrift/configuration.go
index a9565d399df..9ae64180237 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/configuration.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/configuration.go
@@ -306,7 +306,7 @@ type TConfigurationSetter interface {
 //
 // NOTE: nil cfg is not propagated. If you want to propagate a TConfiguration
 // with everything being default value, use &TConfiguration{} explicitly instead.
-func PropagateTConfiguration(impl interface{}, cfg *TConfiguration) {
+func PropagateTConfiguration(impl any, cfg *TConfiguration) {
 	if cfg == nil || cfg.noPropagation {
 		return
 	}
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go b/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go
index e3c323afc60..00f277e1819 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go
@@ -26,6 +26,7 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
+	"math"
 )
 
 // Deprecated: Use DEFAULT_MAX_FRAME_SIZE instead.
@@ -60,8 +61,13 @@ func NewTFramedTransportFactory(factory TTransportFactory) TTransportFactory {
 
 // Deprecated: Use NewTFramedTransportFactoryConf instead.
 func NewTFramedTransportFactoryMaxLength(factory TTransportFactory, maxLength uint32) TTransportFactory {
+	safeMax := maxLength
+	if safeMax > math.MaxInt32 {
+		safeMax = math.MaxInt32
+	}
+
 	return NewTFramedTransportFactoryConf(factory, &TConfiguration{
-		MaxFrameSize: int32(maxLength),
+		MaxFrameSize: int32(safeMax),
 
 		noPropagation: true,
 	})
@@ -196,8 +202,12 @@ func (p *TFramedTransport) WriteString(s string) (n int, err error) {
 }
 
 func (p *TFramedTransport) Flush(ctx context.Context) error {
-	defer bufPool.put(&p.writeBuf)
 	size := p.writeBuf.Len()
+	if size > math.MaxUint32 {
+		return NewTTransportException(UNKNOWN_TRANSPORT_EXCEPTION, fmt.Sprintf("frame too large: %d bytes exceeds uint32 max",size))
+	}
+
+	defer bufPool.put(&p.writeBuf)
 	buf := p.buffer[:4]
 	binary.BigEndian.PutUint32(buf, uint32(size))
 	_, err := p.transport.Write(buf)
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/header_transport.go b/vendor/github.com/apache/thrift/lib/go/thrift/header_transport.go
index d6d64160af3..2eb5d155c4f 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/header_transport.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/header_transport.go
@@ -28,6 +28,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"slices"
 )
 
 // Size in bytes for 32-bit ints.
@@ -166,7 +167,7 @@ func (tr *TransformReader) AddTransform(id THeaderTransformID) error {
 	case TransformNone:
 		// no-op
 	case TransformZlib:
-		readCloser, err := zlib.NewReader(tr.Reader)
+		readCloser, err := newZlibReader(tr.Reader)
 		if err != nil {
 			return err
 		}
@@ -211,25 +212,6 @@ func (tw *TransformWriter) Close() error {
 	return nil
 }
 
-var zlibDefaultLevelWriterPool = newPool(
-	func() *zlib.Writer {
-		return zlib.NewWriter(nil)
-	},
-	nil,
-)
-
-type zlibPoolCloser struct {
-	writer *zlib.Writer
-}
-
-func (z *zlibPoolCloser) Close() error {
-	defer func() {
-		z.writer.Reset(nil)
-		zlibDefaultLevelWriterPool.put(&z.writer)
-	}()
-	return z.writer.Close()
-}
-
 // AddTransform adds a transform.
 func (tw *TransformWriter) AddTransform(id THeaderTransformID) error {
 	switch id {
@@ -241,12 +223,12 @@ func (tw *TransformWriter) AddTransform(id THeaderTransformID) error {
 	case TransformNone:
 		// no-op
 	case TransformZlib:
-		writeCloser := zlibDefaultLevelWriterPool.get()
-		writeCloser.Reset(tw.Writer)
-		tw.Writer = writeCloser
-		tw.closers = append(tw.closers, &zlibPoolCloser{
-			writer: writeCloser,
-		})
+		writer, closer, err := newZlibWriterCloserLevel(tw.Writer, zlib.DefaultCompression)
+		if err != nil {
+			return err
+		}
+		tw.Writer = writer
+		tw.closers = append(tw.closers, closer)
 	}
 	return nil
 }
@@ -806,10 +788,8 @@ func (t *THeaderTransport) isFramed() bool {
 // addWriteTransformsDedupe adds id to writeTransforms only if it's not already
 // there.
 func (t *THeaderTransport) addWriteTransformsDedupe(id THeaderTransformID) {
-	for _, existingID := range t.writeTransforms {
-		if existingID == id {
-			return
-		}
+	if slices.Contains(t.writeTransforms, id) {
+		return
 	}
 	t.writeTransforms = append(t.writeTransforms, id)
 }
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/json_protocol.go b/vendor/github.com/apache/thrift/lib/go/thrift/json_protocol.go
index 6743a7fe3b8..3d53b698d80 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/json_protocol.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/json_protocol.go
@@ -314,11 +314,14 @@ func (p *TJSONProtocol) ReadMapBegin(ctx context.Context) (keyType TType, valueT
 	if err != nil {
 		return keyType, valueType, size, err
 	}
-	err = checkSizeForProtocol(int32(iSize), p.cfg)
+	size = int(iSize)
+
+	minElemSize := p.getMinSerializedSize(keyType) + p.getMinSerializedSize(valueType)
+	totalMinSize := int32(iSize) * minElemSize
+	err = checkSizeForProtocol(totalMinSize, p.cfg)
 	if err != nil {
 		return keyType, valueType, 0, err
 	}
-	size = int(iSize)
 
 	_, e = p.ParseObjectStart()
 	return keyType, valueType, size, e
@@ -492,11 +495,14 @@ func (p *TJSONProtocol) ParseElemListBegin() (elemType TType, size int, e error)
 	if err != nil {
 		return elemType, 0, err
 	}
-	err = checkSizeForProtocol(int32(nSize), p.cfg)
+	size = int(nSize)
+
+	minElemSize := p.getMinSerializedSize(elemType)
+	totalMinSize := int32(nSize) * minElemSize
+	err = checkSizeForProtocol(totalMinSize, p.cfg)
 	if err != nil {
 		return elemType, 0, err
 	}
-	size = int(nSize)
 	return elemType, size, nil
 }
 
@@ -564,4 +570,40 @@ func (p *TJSONProtocol) StringToTypeId(fieldType string) (TType, error) {
 	return TType(STOP), NewTProtocolExceptionWithType(INVALID_DATA, e)
 }
 
+// Return the minimum number of bytes a type will consume on the wire
+func (p *TJSONProtocol) getMinSerializedSize(ttype TType) int32 {
+	switch ttype {
+	case STOP:
+		return 1 // T_STOP needs to count itself
+	case VOID:
+		return 1 // T_VOID needs to count itself
+	case BOOL:
+		return 1 // written as int
+	case BYTE:
+		return 1
+	case DOUBLE:
+		return 1
+	case I16:
+		return 1
+	case I32:
+		return 1
+	case I64:
+		return 1
+	case STRING:
+		return 2 // empty string
+	case STRUCT:
+		return 2 // empty struct
+	case MAP:
+		return 2 // empty map
+	case SET:
+		return 2 // empty set
+	case LIST:
+		return 2 // empty list
+	case UUID:
+		return 16 // empty UUID
+	default:
+		return 1 // unknown type
+	}
+}
+
 var _ TConfigurationSetter = (*TJSONProtocol)(nil)
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/multiplexed_protocol.go b/vendor/github.com/apache/thrift/lib/go/thrift/multiplexed_protocol.go
index cacbf6bef3e..db549e34632 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/multiplexed_protocol.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/multiplexed_protocol.go
@@ -22,6 +22,7 @@ package thrift
 import (
 	"context"
 	"fmt"
+	"maps"
 	"strings"
 )
 
@@ -136,9 +137,7 @@ func (t *TMultiplexedProcessor) ProcessorMap() map[string]TProcessorFunction {
 		}
 	}
 	if t.DefaultProcessor != nil {
-		for method, processorFunc := range t.DefaultProcessor.ProcessorMap() {
-			processorFuncMap[method] = processorFunc
-		}
+		maps.Copy(processorFuncMap, t.DefaultProcessor.ProcessorMap())
 	}
 	return processorFuncMap
 }
@@ -220,7 +219,7 @@ func (t *TMultiplexedProcessor) Process(ctx context.Context, in, out TProtocol)
 	return actualProcessor.Process(ctx, smb, out)
 }
 
-//Protocol that use stored message for ReadMessageBegin
+// Protocol that use stored message for ReadMessageBegin
 type storedMessageProtocol struct {
 	TProtocol
 	name   string
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/pool.go b/vendor/github.com/apache/thrift/lib/go/thrift/pool.go
index 1d623d42223..6912f3ea5d5 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/pool.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/pool.go
@@ -43,7 +43,7 @@ func newPool[T any](generate func() *T, reset func(*T)) *pool[T] {
 	}
 	return &pool[T]{
 		pool: sync.Pool{
-			New: func() interface{} {
+			New: func() any {
 				return generate()
 			},
 		},
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/server_socket.go b/vendor/github.com/apache/thrift/lib/go/thrift/server_socket.go
index 7dd24ae3648..164221e92b2 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/server_socket.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/server_socket.go
@@ -26,12 +26,12 @@ import (
 )
 
 type TServerSocket struct {
-	listener      net.Listener
 	addr          net.Addr
 	clientTimeout time.Duration
 
-	// Protects the interrupted value to make it thread safe.
+	// Protects the listener and interrupted fields to make them thread safe.
 	mu          sync.RWMutex
+	listener    net.Listener
 	interrupted bool
 }
 
@@ -69,15 +69,13 @@ func (p *TServerSocket) Listen() error {
 func (p *TServerSocket) Accept() (TTransport, error) {
 	p.mu.RLock()
 	interrupted := p.interrupted
+	listener := p.listener
 	p.mu.RUnlock()
 
 	if interrupted {
 		return nil, errTransportInterrupted
 	}
 
-	p.mu.Lock()
-	listener := p.listener
-	p.mu.Unlock()
 	if listener == nil {
 		return nil, NewTTransportException(NOT_OPEN, "No underlying server socket")
 	}
@@ -110,7 +108,9 @@ func (p *TServerSocket) Open() error {
 }
 
 func (p *TServerSocket) Addr() net.Addr {
-	if p.listener != nil {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	if p.IsListening() {
 		return p.listener.Addr()
 	}
 	return p.addr
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/simple_server.go b/vendor/github.com/apache/thrift/lib/go/thrift/simple_server.go
index a8634fc5f0e..58973753723 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/simple_server.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/simple_server.go
@@ -24,7 +24,6 @@ import (
 	"errors"
 	"io"
 	"log/slog"
-	"net"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -205,12 +204,14 @@ func (p *TSimpleServer) innerAccept() (int32, error) {
 		return 0, err
 	}
 	if client != nil {
+
 		ctx, cancel := context.WithCancel(context.Background())
 		p.wg.Add(2)
 
 		go func() {
 			defer p.wg.Done()
 			defer cancel()
+			defer client.Close()
 			if err := p.processRequests(client); err != nil {
 				ctx := p.logContext.Load()
 				slog.ErrorContext(*ctx, "error processing request", "err", err)
@@ -366,13 +367,7 @@ func (p *TSimpleServer) processRequests(client TTransport) (err error) {
 
 		ok, err := processor.Process(ctx, inputProtocol, outputProtocol)
 		if errors.Is(err, ErrAbandonRequest) {
-			err := client.Close()
-			if errors.Is(err, net.ErrClosed) {
-				// In this case, it's kinda expected to get
-				// net.ErrClosed, treat that as no-error
-				return nil
-			}
-			return err
+			return nil
 		}
 		if errors.As(err, new(TTransportException)) && err != nil {
 			return err
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/socket_aix_syscall.go b/vendor/github.com/apache/thrift/lib/go/thrift/socket_aix_syscall.go
index 2253f753188..643181bfa9f 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/socket_aix_syscall.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/socket_aix_syscall.go
@@ -1,5 +1,4 @@
 //go:build aix
-// +build aix
 
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_aix_syscall.go b/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_aix_syscall.go
index 523f356dba3..45e38a623bf 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_aix_syscall.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_aix_syscall.go
@@ -1,5 +1,4 @@
 //go:build !aix && !windows && !wasm
-// +build !aix,!windows,!wasm
 
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_unix_conn.go b/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_unix_conn.go
index 75ed91dd437..644bd8c4369 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_unix_conn.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/socket_non_unix_conn.go
@@ -1,5 +1,4 @@
 //go:build windows || wasm
-// +build windows wasm
 
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/socket_unix_conn.go b/vendor/github.com/apache/thrift/lib/go/thrift/socket_unix_conn.go
index c06e0e1f6ec..c7621257995 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/socket_unix_conn.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/socket_unix_conn.go
@@ -1,5 +1,4 @@
 //go:build !windows && !wasm
-// +build !windows,!wasm
 
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/zlib_pool.go b/vendor/github.com/apache/thrift/lib/go/thrift/zlib_pool.go
new file mode 100644
index 00000000000..b41929167bb
--- /dev/null
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/zlib_pool.go
@@ -0,0 +1,109 @@
+/*
+* Licensed to the Apache Software Foundation (ASF) under one
+* or more contributor license agreements. See the NOTICE file
+* distributed with this work for additional information
+* regarding copyright ownership. The ASF licenses this file
+* to you under the Apache License, Version 2.0 (the
+* "License"); you may not use this file except in compliance
+* with the License. You may obtain a copy of the License at
+*
+*   http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing,
+* software distributed under the License is distributed on an
+* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+* KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations
+* under the License.
+ */
+
+package thrift
+
+import (
+	"compress/zlib"
+	"io"
+	"sync"
+)
+
+type zlibReader interface {
+	io.ReadCloser
+	zlib.Resetter
+}
+
+var zlibReaderPool sync.Pool
+
+func newZlibReader(r io.Reader) (io.ReadCloser, error) {
+	if reader, _ := zlibReaderPool.Get().(*wrappedZlibReader); reader != nil {
+		if err := reader.Reset(r, nil); err == nil {
+			return reader, nil
+		}
+	}
+	reader, err := zlib.NewReader(r)
+	if err != nil {
+		return nil, err
+	}
+	return &wrappedZlibReader{reader.(zlibReader)}, nil
+}
+
+type wrappedZlibReader struct {
+	zlibReader
+}
+
+func (wr *wrappedZlibReader) Close() error {
+	defer func() {
+		zlibReaderPool.Put(wr)
+	}()
+	return wr.zlibReader.Close()
+}
+
+func newZlibWriterLevelMust(level int) *zlib.Writer {
+	w, err := zlib.NewWriterLevel(nil, level)
+	if err != nil {
+		panic(err)
+	}
+	return w
+}
+
+// level -> pool
+var zlibWriterPools map[int]*pool[zlib.Writer] = func() map[int]*pool[zlib.Writer] {
+	m := make(map[int]*pool[zlib.Writer])
+	for level := zlib.HuffmanOnly; level <= zlib.BestCompression; level++ {
+		// force a panic at init if we have an invalid level here
+		newZlibWriterLevelMust(level)
+		m[level] = newPool(
+			func() *zlib.Writer {
+				return newZlibWriterLevelMust(level)
+			},
+			nil,
+		)
+	}
+	return m
+}()
+
+type zlibWriterPoolCloser struct {
+	writer *zlib.Writer
+	pool   *pool[zlib.Writer]
+}
+
+func (z *zlibWriterPoolCloser) Close() error {
+	defer func() {
+		z.writer.Reset(nil)
+		z.pool.put(&z.writer)
+	}()
+	return z.writer.Close()
+}
+
+func newZlibWriterCloserLevel(w io.Writer, level int) (*zlib.Writer, io.Closer, error) {
+	pool, ok := zlibWriterPools[level]
+	if !ok {
+		// not pooled
+		writer, err := zlib.NewWriterLevel(w, level)
+		if err != nil {
+			return nil, nil, err
+		}
+		return writer, writer, nil
+	}
+	writer := pool.get()
+	writer.Reset(w)
+	return writer, &zlibWriterPoolCloser{writer: writer, pool: pool}, nil
+}
diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/zlib_transport.go b/vendor/github.com/apache/thrift/lib/go/thrift/zlib_transport.go
index cefe1f99448..8f2d073b53e 100644
--- a/vendor/github.com/apache/thrift/lib/go/thrift/zlib_transport.go
+++ b/vendor/github.com/apache/thrift/lib/go/thrift/zlib_transport.go
@@ -33,9 +33,10 @@ type TZlibTransportFactory struct {
 
 // TZlibTransport is a TTransport implementation that makes use of zlib compression.
 type TZlibTransport struct {
-	reader    io.ReadCloser
-	transport TTransport
-	writer    *zlib.Writer
+	reader      io.ReadCloser
+	transport   TTransport
+	writer      *zlib.Writer
+	writeCloser io.Closer
 }
 
 // GetTransport constructs a new instance of NewTZlibTransport
@@ -64,14 +65,14 @@ func NewTZlibTransportFactoryWithFactory(level int, factory TTransportFactory) *
 
 // NewTZlibTransport constructs a new instance of TZlibTransport
 func NewTZlibTransport(trans TTransport, level int) (*TZlibTransport, error) {
-	w, err := zlib.NewWriterLevel(trans, level)
+	writer, closer, err := newZlibWriterCloserLevel(trans, level)
 	if err != nil {
 		return nil, err
 	}
-
 	return &TZlibTransport{
-		writer:    w,
-		transport: trans,
+		writer:      writer,
+		writeCloser: closer,
+		transport:   trans,
 	}, nil
 }
 
@@ -83,7 +84,7 @@ func (z *TZlibTransport) Close() error {
 			return err
 		}
 	}
-	if err := z.writer.Close(); err != nil {
+	if err := z.writeCloser.Close(); err != nil {
 		return err
 	}
 	return z.transport.Close()
@@ -109,7 +110,7 @@ func (z *TZlibTransport) Open() error {
 
 func (z *TZlibTransport) Read(p []byte) (int, error) {
 	if z.reader == nil {
-		r, err := zlib.NewReader(z.transport)
+		r, err := newZlibReader(z.transport)
 		if err != nil {
 			return 0, NewTTransportExceptionFromError(err)
 		}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0a203f0b1be..730d292f771 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -341,8 +341,8 @@ github.com/apache/arrow-go/v18/parquet/internal/debug
 github.com/apache/arrow-go/v18/parquet/internal/gen-go/parquet
 github.com/apache/arrow-go/v18/parquet/schema
 github.com/apache/arrow-go/v18/parquet/variant
-# github.com/apache/thrift v0.22.0
-## explicit; go 1.23
+# github.com/apache/thrift v0.23.0
+## explicit; go 1.25
 github.com/apache/thrift/lib/go/thrift
 # github.com/armon/go-metrics v0.4.1
 ## explicit; go 1.12