From f9f3b9e83df360043915b5c665ffab79e2bb0cff Mon Sep 17 00:00:00 2001
From: Sergey Chernov <sergey.chernov@clickhouse.com>
Date: Mon, 5 Oct 2026 07:19:46 -0700
Subject: [PATCH 1/6] Merge pull request #3183 from
 ClickHouse/dependabot/maven/examples/client-v2/com.fasterxml.jackson.core-jackson-core-2.18.11

Bump com.fasterxml.jackson.core:jackson-core from 2.18.8 to 2.18.11 in /examples/client-v2

(cherry picked from commit d68cea51c360f6698626d40e5415f4bb6c6f0720)
---
 examples/client-v2/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/client-v2/pom.xml b/examples/client-v2/pom.xml
index e5e78f8e8..66d5b566f 100644
--- a/examples/client-v2/pom.xml
+++ b/examples/client-v2/pom.xml
@@ -74,7 +74,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.18.8</version>
+            <version>2.18.11</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>

From 14abe0d95ebdb305e8dc0e0c44f7d22976ccb4bd Mon Sep 17 00:00:00 2001
From: Sergey Chernov <sergey.chernov@clickhouse.com>
Date: Mon, 5 Oct 2026 07:22:58 -0700
Subject: [PATCH 2/6] Merge pull request #3184 from
 ClickHouse/dependabot/maven/examples/client-v2/com.fasterxml.jackson.core-jackson-databind-2.18.11

Bump com.fasterxml.jackson.core:jackson-databind from 2.18.10 to 2.18.11 in /examples/client-v2

(cherry picked from commit 12c03e5617fbab169d6b1cfdd800dd61839583ab)
---
 examples/client-v2/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/client-v2/pom.xml b/examples/client-v2/pom.xml
index 66d5b566f..a10ba6b22 100644
--- a/examples/client-v2/pom.xml
+++ b/examples/client-v2/pom.xml
@@ -80,7 +80,7 @@
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
             <scope>test</scope>
-            <version>2.18.10</version>
+            <version>2.18.11</version>
         </dependency>
 
         <!-- Popular Alternative to Jackson -->
@@ -124,7 +124,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.18.10</version>
+            <version>2.18.11</version>
             <scope>compile</scope>
         </dependency>
 

From 1ce3c38d9bca8fec7a7eaf58053902a691522960 Mon Sep 17 00:00:00 2001
From: Sergey Chernov <sergey.chernov@clickhouse.com>
Date: Mon, 5 Oct 2026 07:23:28 -0700
Subject: [PATCH 3/6] Merge pull request #3182 from
 ClickHouse/dependabot/maven/examples/client-v2-json-processors/com.fasterxml.jackson.core-jackson-databind-2.22.3

Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /examples/client-v2-json-processors

(cherry picked from commit 41a9d05db79e1804763309770e0cfabfca986d11)
---
 examples/client-v2-json-processors/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/client-v2-json-processors/pom.xml b/examples/client-v2-json-processors/pom.xml
index 393ec4b3d..6689ecbab 100644
--- a/examples/client-v2-json-processors/pom.xml
+++ b/examples/client-v2-json-processors/pom.xml
@@ -18,7 +18,7 @@
         <maven.compiler.release>17</maven.compiler.release>
 
         <clickhouse-java.version>0.11.0-rc1-SNAPSHOT</clickhouse-java.version>
-        <jackson.version>2.22.2</jackson.version>
+        <jackson.version>2.22.3</jackson.version>
         <gson.version>2.14.0</gson.version>
         <slf4j.version>2.0.17</slf4j.version>
 

From 36ee1c8b15550c15013645e7efd480183c52d8df Mon Sep 17 00:00:00 2001
From: Sergey Chernov <sergey.chernov@clickhouse.com>
Date: Thu, 8 Oct 2026 15:54:04 -0700
Subject: [PATCH 4/6] Merge pull request #3196 from
 ClickHouse/dependabot/maven/examples/jdbc-v2-json-processors/com.fasterxml.jackson.core-jackson-databind-2.22.3

Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /examples/jdbc-v2-json-processors

(cherry picked from commit 8fb4c1c91a05b00f07443d625575a047031160e8)
---
 examples/jdbc-v2-json-processors/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/jdbc-v2-json-processors/pom.xml b/examples/jdbc-v2-json-processors/pom.xml
index a8fb34d27..f9a381a92 100644
--- a/examples/jdbc-v2-json-processors/pom.xml
+++ b/examples/jdbc-v2-json-processors/pom.xml
@@ -18,7 +18,7 @@
         <maven.compiler.release>17</maven.compiler.release>
 
         <clickhouse-java.version>0.11.0-rc1-SNAPSHOT</clickhouse-java.version>
-        <jackson.version>2.22.2</jackson.version>
+        <jackson.version>2.22.3</jackson.version>
         <gson.version>2.14.0</gson.version>
         <slf4j.version>2.0.17</slf4j.version>
 

From 2b2cd410ec3d283d0e7b42a89da55c66d5b161ad Mon Sep 17 00:00:00 2001
From: Sergey Chernov <sergey.chernov@clickhouse.com>
Date: Thu, 8 Oct 2026 15:55:59 -0700
Subject: [PATCH 5/6] Merge pull request #3195 from
 ClickHouse/dependabot/maven/at.yawk.lz4-lz4-java-1.11.4

Bump at.yawk.lz4:lz4-java from 1.11.1 to 1.11.4

(cherry picked from commit c2168042244b9e97d64a59e36b55a9f9a868cd17)
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 4026554a3..37edae3e9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -96,7 +96,7 @@
         <opencensus.version>0.31.1</opencensus.version>
         <opentelemetry.version>1.51.0</opentelemetry.version>
         <protobuf.version>3.23.4</protobuf.version>
-        <lz4.version>1.11.1</lz4.version>
+        <lz4.version>1.11.4</lz4.version>
         <msgpack.version>0.9.5</msgpack.version>
         <roaring-bitmap.version>1.0.6</roaring-bitmap.version>
         <slf4j.version>2.0.7</slf4j.version>

From 782a1c9a63e86bce0a3599a3bed4686f36e3234c Mon Sep 17 00:00:00 2001
From: Sergey Chernov <sergey.chernov@clickhouse.com>
Date: Mon, 19 Oct 2026 10:09:29 -0700
Subject: [PATCH 6/6] Merge pull request #3223 from
 ClickHouse/10/16/26/upgrade_dependencies

Upgrade dependencies

(cherry picked from commit 621f85c058fd93f02a21251f15a8f9544db2b2b5)
---
 .github/scripts/requirements.txt        |  4 +++-
 client-v2/pom.xml                       |  2 +-
 examples/client-v2-apache-arrow/pom.xml |  5 +++++
 examples/demo-spring-service/pom.xml    | 17 +----------------
 performance/pom.xml                     |  2 +-
 pom.xml                                 |  8 ++++----
 6 files changed, 15 insertions(+), 23 deletions(-)

diff --git a/.github/scripts/requirements.txt b/.github/scripts/requirements.txt
index c461f0bba..d9ef930fc 100644
--- a/.github/scripts/requirements.txt
+++ b/.github/scripts/requirements.txt
@@ -1,2 +1,4 @@
-jwcrypto==1.6.0
+jwcrypto==1.6.1
+PyJWT==2.15.1
+urllib3==2.8.0
 
diff --git a/client-v2/pom.xml b/client-v2/pom.xml
index ad1f767cf..c8e24d143 100644
--- a/client-v2/pom.xml
+++ b/client-v2/pom.xml
@@ -61,7 +61,7 @@
         <dependency>
             <groupId>com.github.luben</groupId>
             <artifactId>zstd-jni</artifactId>
-            <version>1.5.7-20</version>
+            <version>${zstd-jni.version}</version>
             <classifier>cloud</classifier>
         </dependency>
 
diff --git a/examples/client-v2-apache-arrow/pom.xml b/examples/client-v2-apache-arrow/pom.xml
index c4eaba616..ef2797869 100644
--- a/examples/client-v2-apache-arrow/pom.xml
+++ b/examples/client-v2-apache-arrow/pom.xml
@@ -69,6 +69,11 @@
 
     <dependencyManagement>
         <dependencies>
+            <dependency>
+                <groupId>com.github.luben</groupId>
+                <artifactId>zstd-jni</artifactId>
+                <version>1.5.7-23</version>
+            </dependency>
             <!-- BOM used to keep versions consistent across all Arrow libraries -->
             <dependency>
                 <groupId>org.apache.arrow</groupId>
diff --git a/examples/demo-spring-service/pom.xml b/examples/demo-spring-service/pom.xml
index 4e5f6b396..9a2b3929a 100755
--- a/examples/demo-spring-service/pom.xml
+++ b/examples/demo-spring-service/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.3.5</version>
+        <version>3.5.16</version>
         <relativePath/>
     </parent>
 
@@ -19,27 +19,12 @@
 
     <properties>
         <java.version>17</java.version>
-        <opentelemetry.version>1.43.0</opentelemetry.version>
         <opentelemetry.javaagent.version>2.30.0</opentelemetry.javaagent.version>
         <opentelemetry.javaagent.traces.exporter>otlp</opentelemetry.javaagent.traces.exporter>
         <opentelemetry.javaagent.traces.endpoint>http://localhost:4318/v1/traces</opentelemetry.javaagent.traces.endpoint>
         <clickhouse-java.version>0.11.0-rc1-SNAPSHOT</clickhouse-java.version>
-        <!-- Spring Boot 3.3 manages 1.19.x, which cannot negotiate with Docker Engine 29. -->
-        <testcontainers.version>1.21.4</testcontainers.version>
     </properties>
 
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>io.opentelemetry</groupId>
-                <artifactId>opentelemetry-bom</artifactId>
-                <version>${opentelemetry.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
     <dependencies>
         <!-- Web layer -->
         <dependency>
diff --git a/performance/pom.xml b/performance/pom.xml
index 68cf5c785..d7702806a 100644
--- a/performance/pom.xml
+++ b/performance/pom.xml
@@ -18,7 +18,7 @@
         <ch.jdbc.revision>0.11.0-rc1-SNAPSHOT</ch.jdbc.revision>
         <jmh.version>1.37</jmh.version>
         <testcontainers.version>2.0.2</testcontainers.version>
-        <zstd-jni.version>1.5.7-6</zstd-jni.version>
+        <zstd-jni.version>1.5.7-23</zstd-jni.version>
         <brotli.version>0.1.2</brotli.version>
         <brotli4j.version>1.12.0</brotli4j.version>
 
diff --git a/pom.xml b/pom.xml
index 37edae3e9..29a64ba53 100644
--- a/pom.xml
+++ b/pom.xml
@@ -92,7 +92,7 @@
         <fastutil.version>8.5.12</fastutil.version>
         <gson.version>2.10.1</gson.version>
         <jctools.version>4.0.1</jctools.version>
-        <micrometer.version>1.14.3</micrometer.version>
+        <micrometer.version>1.17.1</micrometer.version>
         <opencensus.version>0.31.1</opencensus.version>
         <opentelemetry.version>1.51.0</opentelemetry.version>
         <protobuf.version>3.23.4</protobuf.version>
@@ -101,9 +101,9 @@
         <roaring-bitmap.version>1.0.6</roaring-bitmap.version>
         <slf4j.version>2.0.7</slf4j.version>
         <antlr4.version>4.13.2</antlr4.version>
-        <snappy.version>1.1.10.4</snappy.version>
+        <snappy.version>1.1.10.12</snappy.version>
         <xz.version>1.9</xz.version>
-        <zstd-jni.version>1.5.5-5</zstd-jni.version>
+        <zstd-jni.version>1.5.7-23</zstd-jni.version>
         <testcontainers.version>2.0.2</testcontainers.version>
         <testcontainers.toxiproxy.version>1.21.3</testcontainers.toxiproxy.version>
         <!-- stay 7.5 for JDK 8 support -->
@@ -143,7 +143,7 @@
         <versions-plugin.version>2.18.0</versions-plugin.version>
         <resource-plugin.version>3.3.1</resource-plugin.version>
         <jmh.version>1.37</jmh.version>
-        <guava.version>33.4.6-jre</guava.version>
+        <guava.version>33.7.2-jre</guava.version>
         <sonar.publish-pluing.version>0.8.0</sonar.publish-pluing.version>
         <jackson.version>2.22.0</jackson.version>
         <jackson.version.annotations>2.22</jackson.version.annotations>