[polyglotAI-bot]

Summary

Backports six dependency-upgrade PRs from main to v0.11.0, as requested by @chernser in #3230 (comment):

@polyglotAI-bot I'm a maintainer and asking you do the PR to v0.11.0 for me I'll review

Issue: #3230 (a closing keyword has no effect on a PR into a non-default branch, so close the issue manually after merge).

Cherry-picked PRs

In merge order on main. Each one is git cherry-pick -x -m 1 <merge commit>. Each commit keeps its original author and records its source commit.

PR	Merge commit on main	Change	Backport commit
#3183	d68cea51c	jackson-core 2.18.8 → 2.18.11 (examples/client-v2)	f9f3b9e83 (clean)
#3184	12c03e561	jackson-databind 2.18.10 → 2.18.11 (examples/client-v2)	14abe0d95 (clean)
#3182	41a9d05db	jackson-databind 2.22.2 → 2.22.3 (examples/client-v2-json-processors)	1ce3c38d9 (conflict)
#3196	8fb4c1c91	jackson-databind 2.22.2 → 2.22.3 (examples/jdbc-v2-json-processors)	36ee1c8b1 (conflict)
#3195	c21680422	lz4-java 1.11.1 → 1.11.4	2b2cd410e (clean)
#3223	621f85c05	zstd-jni, micrometer, snappy, guava, Spring Boot (demo), Python pins	782a1c9a6 (conflict)

Conflicts and resolution

There are three conflicts, all of the same type. In examples/client-v2-json-processors/pom.xml, examples/jdbc-v2-json-processors/pom.xml and examples/demo-spring-service/pom.xml, the changed line is next to <clickhouse-java.version>. That value is 0.11.0-rc1-SNAPSHOT on v0.11.0 and 0.12.0-rc1-SNAPSHOT on main.

Resolution: keep the branch value of clickhouse-java.version, and take all other lines from the PR. For #3223, this also removes testcontainers.version and its comment from demo-spring-service/pom.xml, as the PR does on main.

Check: the file set (9 files, +21/−29) and the changed lines (+/- lines of git diff -U0) are identical to the combined diffs of the six PRs on main, file by file. The branch has no other changes.

Test

Done in a devbox (JDK 17 + JDK 8 toolchain, ClickHouse server latest):

• mvn -B -DskipTests -Dmaven.javadoc.skip=true install: BUILD SUCCESS, all 9 reactor modules.
• mvn -B -DskipTests test-compile in examples/client-v2, examples/client-v2-json-processors, examples/jdbc-v2-json-processors, examples/client-v2-apache-arrow, examples/demo-spring-service and performance (not in the root reactor): all pass.
• mvn -B -pl clickhouse-data test: 1691 run, 0 failures (113 skipped).
• client-v2 tests for the compression libraries that this PR upgrades. Unit: CompressedBlockInputStreamTest, HttpAPIClientHelperTest, 61 run, 0 failures. Integration: QueryServerContent{LZ4,ZSTD}CompressionTests, QueryServerHttpCompressionTests, InsertClientContent{LZ4,ZSTD}CompressionTests, InsertClientHttpCompressionTests, 433 run, 431 pass. The 2 failures are testInsertAndReadBackWithSecureConnection in the LZ4 and ZSTD insert classes. They connect to the hardcoded https://localhost:8443, which is not reachable in this environment (the server has a different host name), so the connection is refused. They are not related to this change. CI runs them against a local server.

The cherry-picked PRs add and change no tests. This PR adds no tests, docs, CHANGELOG entry or version bump, because the PRs on main have none.

Checklist

• Issue linked: [0.11.0] Version upgrades #3230
• Only the changes of the listed PRs; conflicts resolved to the branch values

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only bumps on a release branch; main risk is transitive behavior changes from compression, metrics, Jackson, and Spring Boot upgrades, mitigated by existing tests rather than new code paths.

Overview
Backports six dependency-upgrade PRs from main onto the v0.11.0 line. There is no application or library source change—only Maven property bumps, example POM pins, CI Python pins, and one wiring fix in client-v2.

The root pom.xml raises shared versions for compression and utilities: lz4-java, zstd-jni, snappy-java, micrometer, and guava. client-v2 now resolves zstd-jni via ${zstd-jni.version} instead of a hardcoded coordinate; performance and client-v2-apache-arrow align zstd-jni to 1.5.7-23.

Jackson patch bumps land in examples: jackson-core / jackson-databind 2.18.11 in examples/client-v2, and jackson 2.22.3 in the JSON processor examples.

examples/demo-spring-service moves Spring Boot from 3.3.5 to 3.5.16, drops the explicit OpenTelemetry BOM import and the Testcontainers version override (relying on Boot’s managed versions instead).

.github/scripts/requirements.txt bumps jwcrypto and adds pins for PyJWT and urllib3 used by CI scripts.

^{Reviewed by Cursor Bugbot for commit 3d8e314. Bugbot is set up for automated code reviews on this repo. Configure here.}

[polyglotAI-bot]

CI on this PR fails before compilation starts. The cause is in the base branch v0.11.0, not in this backport.

Cause

• The CI runners now use Apache Maven 3.10.0. Maven 3.10 rejects a plugin that one POM declares two times. Maven 3.9 only logs a warning for this.
• On v0.11.0, packages/clickhouse-jdbc-all/pom.xml declares maven-jar-plugin two times (the second declaration starts at line 40). This PR does not change that file.
• On main, 91017eb ("Fix duplicate plugin problem", part of [repo] Cluster Tests #3187) removed the duplicate. That commit is not on v0.11.0.

Evidence

• [v0.11.0] Do not fail closing a partly read response that the server ended early (backport #3217) #3234 also targets v0.11.0 and changes no POM file. It fails with the same error (run 39483890702).
• Local mvn -B validate with Maven 3.10.0 (build c43a36b8, the same as CI):
  • origin/v0.11.0 (eeebd1e), no changes: same error.
  • this PR (782a1c9): same error.
  • origin/v0.11.0 + only the packages/clickhouse-jdbc-all/pom.xml part of 91017eb (5 deleted lines): BUILD SUCCESS. -pl packages/clickhouse-jdbc-all -am package also passes and writes the shaded, javadoc and sources jars.
• With Maven 3.9.15, origin/v0.11.0 gives only a WARNING. That is why the earlier builds passed.

Each PR into v0.11.0 fails CI until the branch has this fix. I did not add the fix here, because it is not in the PRs that #3230 lists.

Options

1. (Recommended) I add one commit to this PR: cherry-pick -x of the packages/clickhouse-jdbc-all/pom.xml part of 91017eb. This is the smallest step. [v0.11.0] Do not fail closing a partly read response that the server ended early (backport #3217) #3234 and the [0.11.0] Fix user agent #3232 backport then pass after this PR merges and they merge v0.11.0.
2. I open a separate PR into v0.11.0 with only that commit. This PR then stays identical to the six listed PRs.
3. You fix v0.11.0 yourself, or pin Maven 3.9 in CI for the branch. Then I merge v0.11.0 into this PR.

Notes:

• The root pom.xml part of 91017eb is not necessary for this error. It moves the default-jar manifest configuration out of the profiles, so it changes the jar manifest of builds that do not use those profiles. I recommend that we do not include it.
• With the fix, clickhouse-jdbc-all uses maven-jar-plugin 3.4.2 from pluginManagement (the duplicate pinned 3.3.0). This is the same as on main.

Which option do you want? Please mention @polyglotAI-bot in your reply.

[chernser]

@polyglotAI-bot sync from v0.11.0 - there is fix for build

[chernser]

sync with v0.11.0 to fix the CI build

[polyglotAI-bot]

Done. I merged v0.11.0 (fd98bda, #3236) into this branch: merge commit 3d8e314. No force-push.

Conflict

• One file: examples/client-v2/pom.xml. [v0.11.0] Fix duplicate POM declarations rejected by Maven 3.10 #3236 removed the duplicate jackson-databind declaration. This PR changed the version in both declarations.
• Resolution: one jackson-databind dependency, default (compile) scope, version 2.18.11. The file is now identical to main, except for the branch value of clickhouse-java.version.

Result

• Diff to v0.11.0: 9 files, +20/−28. It was +21/−29, because v0.11.0 now has one jackson-databind declaration less to bump.

Verification (Maven 3.10.0, the CI version)

• mvn validate: OK.
• Root install -Dj8 -DskipTests: BUILD SUCCESS, all 9 modules.
• The "Compile examples" CI step, run locally: all 10 examples compile.

CI is running on the new head (run 39555085820). This merge dismisses no approval, because the PR had none. Please re-review when CI is green.

[github-actions]

Triage

Category: deps • Risk: medium

Summary
Bot-authored backport of six dependency-upgrade PRs (#3183, #3184, #3182, #3196, #3195, #3223) from main onto the v0.11.0 release branch, explicitly requested by maintainer @chernser in issue #3230. The diff (+20/−28 across 9 files) is version bumps only — no Java source changes: root pom.xml raises lz4-java (1.11.1→1.11.4), zstd-jni (1.5.5-5→1.5.7-23), snappy (1.1.10.4→1.1.10.12), micrometer (1.14.3→1.17.1) and guava (33.4.6→33.7.2); client-v2/pom.xml switches its zstd-jni cloud classifier dependency from a hardcoded version to ${zstd-jni.version}; example POMs get Jackson patch bumps and a Spring Boot 3.3.5→3.5.16 bump (demo only); .github/scripts/requirements.txt bumps jwcrypto and adds PyJWT/urllib3 pins. Three cherry-pick conflicts were all the same clickhouse-java.version adjacency issue, resolved to branch values, and the PR body documents a file-by-file diff equivalence check against the combined main diffs.

What this impacts

• Compression libraries (lz4, zstd-jni, snappy) used on the query/insert hot path of clickhouse-client/client-v2 — shipped-artifact dependency versions on a release branch.
• client-v2 zstd-jni dependency wiring (hardcoded version → shared ${zstd-jni.version} property, including the cloud classifier artifact).
• Example/demo projects only: Jackson patch bumps, Spring Boot minor bump, OpenTelemetry BOM and testcontainers override removal in demo-spring-service.
• CI tooling: .github/scripts/requirements.txt Python pins.

Concerns

• Medium rule fired: changes in the .github directory (requirements.txt pins) plus minor/patch bumps of security-sensitive packages (jwcrypto, PyJWT, urllib3).
• Target is the v0.11.0 release branch and the bumps include compression libraries that sit on the hot path of shipped artifacts; author's local run of LZ4/ZSTD compression test suites mitigates this, but CI on the release branch should confirm.
• No major version bumps (Spring Boot 3.3→3.5 is minor and demo-only), so no High rule fires.
• Reviewer @chernser has already requested changes — resolve that feedback before merge. CI check status could not be fetched during triage.

Required reviewer action

• At least one human reviewer (medium risk); @chernser already engaged per issue [0.11.0] Version upgrades #3230.