Skip to content

Bump dependencies: Beam 2.72.0, Jackson, Guava, and more#1039

Open
labianchin wants to merge 18 commits intomasterfrom
updates
Open

Bump dependencies: Beam 2.72.0, Jackson, Guava, and more#1039
labianchin wants to merge 18 commits intomasterfrom
updates

Conversation

@labianchin
Copy link
Copy Markdown
Collaborator

@labianchin labianchin commented Apr 7, 2026

Summary

Key upgrade: Apache Beam SDK 2.65.0 → 2.72.0. Beam 2.65.0 will be deprecated on May 12, 2026. Beam 2.72.0 is the latest stable release, supported until March 2027.

Dependency updates

  • Apache Beam SDK: 2.65.0 → 2.72.0
  • Jackson: 2.15.4 → 2.18.2 (aligned with libraries-bom 26.76.0)
  • Guava: 33.1.0-jre → 33.5.0-jre
  • google-cloud-libraries-bom: 26.57.0 → 26.76.0
  • Avro: 1.11.4 → 1.11.5
  • PostgreSQL JDBC: 42.7.4 → 42.7.8 (fixes CVE-2025-49146)
  • MariaDB JDBC: 3.5.3 → 3.5.8
  • Cloud SQL socket factory: 1.18.0 → 1.25.0
  • google-api-services-cloudkms: v1-rev20240314 → v1-rev20260319
  • zstd-jni: 1.5.6-3 → 1.5.7-7
  • Netty: 4.1.121.Final → 4.1.124.Final
  • SLF4J: 1.7.30 → 2.0.16
  • Error Prone: 2.10.0 → 2.31.0
  • Joda-Time: 2.10.14 → 2.14.0

Maven plugin updates

  • maven-enforcer-plugin: 3.5.0 → 3.6.2
  • mockito-core: 5.17.0 → 5.20.0
  • maven-compiler-plugin → 3.14.1
  • maven-javadoc-plugin: 3.11.2 → 3.12.0
  • maven-gpg-plugin: 3.2.7 → 3.2.8
  • build-helper-maven-plugin: 3.6.0 → 3.6.1
  • maven-project-info-reports-plugin → 3.9.0
  • h2 (test): → 2.3.232
  • maven-surefire-plugin → 3.5.3

Test plan

  • mvn verify passes locally

dependabot bot and others added 17 commits April 7, 2026 16:31
Bumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.5.0 to 3.6.2.
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](apache/maven-enforcer@enforcer-3.5.0...enforcer-3.6.2)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.mockito:mockito-core](https://github.com/mockito/mockito) from 5.17.0 to 5.20.0.
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.17.0...v5.20.0)

---
updated-dependencies:
- dependency-name: org.mockito:mockito-core
  dependency-version: 5.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.13.0 to 3.14.1.
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.13.0...maven-compiler-plugin-3.14.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) from 3.11.2 to 3.12.0.
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases)
- [Commits](apache/maven-javadoc-plugin@maven-javadoc-plugin-3.11.2...maven-javadoc-plugin-3.12.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-gpg-plugin](https://github.com/apache/maven-gpg-plugin) from 3.2.7 to 3.2.8.
- [Release notes](https://github.com/apache/maven-gpg-plugin/releases)
- [Commits](apache/maven-gpg-plugin@maven-gpg-plugin-3.2.7...maven-gpg-plugin-3.2.8)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-gpg-plugin
  dependency-version: 3.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) from 3.6.0 to 3.6.1.
- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)
- [Commits](mojohaus/build-helper-maven-plugin@3.6.0...3.6.1)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:build-helper-maven-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [org.apache.maven.plugins:maven-project-info-reports-plugin](https://github.com/apache/maven-project-info-reports-plugin) from 3.8.0 to 3.9.0.
- [Release notes](https://github.com/apache/maven-project-info-reports-plugin/releases)
- [Commits](apache/maven-project-info-reports-plugin@maven-project-info-reports-plugin-3.8.0...maven-project-info-reports-plugin-3.9.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-project-info-reports-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Beam 2.65.0 reaches end-of-support in May 2026. Beam 2.72.0 is the
latest stable release, supported until March 2027.

Updated dependency versions to match Beam 2.72.0:
- errorprone: 2.10.0 -> 2.31.0
- joda-time: 2.10.14 -> 2.14.0
- netty: 4.1.121.Final -> 4.1.124.Final
- slf4j: 1.7.30 -> 2.0.16
- google-cloud-libraries-bom: 26.57.0 -> 26.76.0

Added dependency management overrides to resolve version convergence
between Beam BOM and libraries-bom:
- jackson-dataformat-xml 2.18.2 (from google-cloud-storage)
- google-cloud-bigtable 2.73.1 and proto stubs (from beam-io-gcp)
- j2objc-annotations 3.1 (from libraries-bom)
- failureaccess 1.0.3 (from transitives)
Aligns with the version provided by google-cloud-libraries-bom 26.76.0,
removing the separate jackson-dataformat-xml override.
Aligns with the version provided by google-cloud-libraries-bom 26.76.0.
1.25.0 is the highest version compatible with the current
libraries-bom 26.76.0 without introducing dependency conflicts.
Versions >= 1.25.1 require a newer google-api-client than what
the BOM provides.
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 7, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.92%. Comparing base (05add13) to head (900fc1a).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff            @@
##             master    #1039   +/-   ##
=========================================
  Coverage     91.92%   91.92%           
  Complexity      283      283           
=========================================
  Files            27       27           
  Lines          1015     1015           
  Branches         86       86           
=========================================
  Hits            933      933           
  Misses           54       54           
  Partials         28       28           
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The previous URL for avro-tools 1.11.3 is no longer available on
dlcdn.apache.org, causing CI failures.
@labianchin labianchin marked this pull request as ready for review April 7, 2026 15:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant