chore(deps): consolidate Dependabot dependency updates (batch 2)

[schenksj]

Consolidates the open Dependabot PRs (#163-#172, #175, #177, #178, #180, #181) into a single change, following the same triage process as #179. Each update was applied to the appropriate manifest and verified to compile.

Applied

Maven (pom.xml)

• software.amazon.awssdk:s3 2.43.0 → 2.46.15 (Bump the test-dependencies group across 1 directory with 13 updates #181)
• azure-storage-blob 12.33.3 → 12.35.0 (Bump the test-dependencies group across 1 directory with 13 updates #181)
• azure-identity 1.18.2 → 1.18.4 (Bump the test-dependencies group across 1 directory with 13 updates #181)
• azure-core 1.57.1 → 1.58.1 (Bump the test-dependencies group across 1 directory with 13 updates #181)
• google-cloud-storage 2.67.0 → 2.69.0 (Bump the test-dependencies group across 1 directory with 13 updates #181)
• google-cloud-nio 0.131.0 → 0.133.0 (Bump the test-dependencies group across 1 directory with 13 updates #181)
• central-publishing-maven-plugin 0.10.0 → 0.11.0 (Bump the test-dependencies group across 1 directory with 13 updates #181)

Cargo (native/)

• libc 0.2.181 → 0.2.186 (lockfile-only bump) (Bump libc from 0.2.181 to 0.2.186 in /native #169)
• moka 0.12.13 → 0.12.15 (lockfile-only bump) (Bump moka from 0.12.13 to 0.12.15 in /native #165)

Already applied (no-op, superseded by #179)

• jackson-databind 2.15.2 → 2.22.0 (Bump com.fasterxml.jackson.core:jackson-databind from 2.15.2 to 2.22.0 #178) — pom.xml already at 2.22.0
• maven-surefire-plugin 3.1.2 → 3.5.6 (Bump org.apache.maven.plugins:maven-surefire-plugin from 3.1.2 to 3.5.6 #177) — pom.xml already at 3.5.6
• exec-maven-plugin 3.1.0 → 3.6.3 (Bump org.codehaus.mojo:exec-maven-plugin from 3.1.0 to 3.6.3 #175) — pom.xml already at 3.6.3
• futures 0.3.31 → 0.3.32 (Bump futures from 0.3.31 to 0.3.32 in /native #164) — Cargo.toml already at 0.3.32
• tokio 1.45 → 1.50 (Bump tokio from 1.49.0 to 1.50.0 in /native #166) — Cargo.toml already at 1.50
• lru 0.12 → 0.16 (Bump lru from 0.12.5 to 0.16.3 in /native #167) — Cargo.toml already at 0.16
• sha2 0.10 → 0.11 (Bump sha2 from 0.10.9 to 0.11.0 in /native #163) — Cargo.toml already at 0.11
• thiserror 1 → 2 (Bump thiserror from 1.0.69 to 2.0.18 in /native #170) — Cargo.toml already at 2

These PRs' proposed target versions are already present on main (applied in a prior consolidation); their diffs are effectively no-ops against the current base and they are being closed as already-satisfied.

Held back (incompatible — not applied)

• junit 5.12.2 → 6.1.0 (Bump the test-dependencies group across 1 directory with 13 updates #181 sub-update) — JUnit 6 raises its baseline to Java 17 (bytecode 61); this project targets Java 11 and CI compiles with JDK 11. Left at 5.12.2.
• scala-library 2.13.12 → 3.8.4 (Bump the test-dependencies group across 1 directory with 13 updates #181 sub-update) — Scala 2 → 3 major bump; s3mock_2.13 requires Scala 2.13. Kept at 2.13.12.
• iceberg-core / iceberg-api 1.10.1 → 1.11.0 (Bump the test-dependencies group across 1 directory with 13 updates #181 sub-update) — initially applied, then reverted after CI caught it: 1.11.0 ships Java 17 bytecode (class file version 61.0), which fails to compile under this project's JDK 11 target (bad class file ... class file has wrong version 61.0, should be 55.0). Held at 1.10.1, the version already verified working in chore(deps): consolidate Dependabot dependency updates #179.
• actions/checkout v6 → v7, then pinned to v4 (Bump actions/checkout from 6 to 7 #180) — initially applied (v7), then reverted after CI caught it: v7 requires a Node 24 action runtime, and this repo's self-hosted Linux runner (runner v2.321.0) only supports up to Node 20 ('using: node24' is not supported). First reverted to v6 (the prior working value), but a second CI run showed v6 also now fails the same way — GitHub has repatched the v5 and v6 major tags (even old point releases) to require Node 24, so this isn't specific to the v7 bump; main is silently affected by the same drift. v4's latest patch (v4.2.2) still declares node20 and is unaffected, so pinned there instead. Bump actions/checkout from 6 to 7 #180 is being closed as not-yet-actionable rather than merged; a future re-attempt at v5/v6/v7 needs the self-hosted runners upgraded first.
• arrow-array / arrow-buffer 57 → 58 (Bump arrow-array from 57.3.0 to 58.1.0 in /native #168, Bump arrow-buffer from 57.3.0 to 58.1.0 in /native #172) — arrow, arrow-schema, and parquet remain at 57 (pinned transitively by delta-kernel 0.19 and the quickwit fork). Re-attempted the bump in isolation: arrow-array/arrow-buffer at 58 with the rest at 57 fails with 212 compile errors from type mismatches across the arrow ecosystem — same failure mode as when chore(deps): consolidate Dependabot dependency updates #179 was prepared. Needs a coordinated full arrow-ecosystem upgrade (including delta_kernel/quickwit), which is out of scope here.
• object_store 0.12 → 0.13 (Bump object_store from 0.12.5 to 0.13.2 in /native #171) — re-attempted in isolation; fails with 34 compile errors from breaking API changes (head/get/put/delete) and version coupling with delta-kernel 0.19 / quickwit which pin 0.12. Still incompatible.

Verification

• cargo check (native/) — clean, no errors
• mvn test-compile — BUILD SUCCESS (includes native release build via exec-maven-plugin)
• CI (macOS ARM64 / Linux x64) caught the iceberg 1.11.0 and actions/checkout v7 incompatibilities described above; both were reverted and the branch pushed again for a clean re-run.

The three held-back PRs (#168, #171, #172) should remain open for a future coordinated arrow/object_store upgrade. All other PRs in this batch (#163, #164, #165, #166, #167, #169, #170, #175, #177, #178, #180, #181) are being closed in favor of this PR.

🤖 Generated with Claude Code

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.