Skip to content

Conversation

@jasonlin45
Copy link

@jasonlin45 jasonlin45 commented Nov 13, 2025

pulls in a stupid amount of changes...

Tested with Jaffle Shop init - Snowflake and Bigquery are all working with no issues.

Databricks needs an FS PR.

How to Review

The main changes that we care about will be in the go/adbc folder.

There are a ton of changes that got pulled in, but the majority of these changes will not be our Go drivers that we use.

Many of these changes are small and the product of upgrades to the driver base and to Arrow.
e.g.

-r.currentBatch = r.stream.Record()
+r.currentBatch = r.stream.RecordBatch()

eitsupi and others added 30 commits August 12, 2025 09:23
It seems that CI has started to fail as a result of macos-latest
changing from macos 14 to 15.

```log
 [ 65%] Building CXX object driver/sqlite/CMakeFiles/adbc_driver_sqlite_objlib.dir/sqlite.cc.o
/Users/runner/work/arrow-adbc/arrow-adbc/c/driver/sqlite/sqlite.cc:718:16: error: use of undeclared identifier 'sqlite3_load_extension'
  718 |       int rc = sqlite3_load_extension(conn_, extension_path_.c_str(),
      |                ^
1 error generated.
make[2]: *** [driver/sqlite/CMakeFiles/adbc_driver_sqlite_objlib.dir/sqlite.cc.o] Error 1
make[1]: *** [driver/sqlite/CMakeFiles/adbc_driver_sqlite_objlib.dir/all] Error 2
make: *** [all] Error 2
```

I don't know why this error is occurring, but it looks like it can be
avoided by making a change like apache#1259.
…e#3252)

Replicates the change in apache#3250
to the Rust Driver Manager. Follow-on to apache#3247

Modifies the behavior of GetSearchPaths so macOS doesn't follow other
Unix-likes but instead uses the more conventional /Library/Application
Support/ADBC. /etc/ isn't really a thing on macOS.

Tested manually by debugging the test with and without
`/Library/Application Support/ADBC` existing and verifying the right
branch gets hit. I'm not too worried exercising this in CI but we could.
Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.254.0
to 1.255.0.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…adbc (apache#3271)

Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.35.0
to 0.36.0.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… /java (apache#3275)

Bumps [com.uber.nullaway:nullaway](https://github.com/uber/NullAway)
from 0.12.7 to 0.12.8.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… in /go/adbc (apache#3277)

Bumps google.golang.org/protobuf from 1.36.6 to 1.36.7.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…java (apache#3268)

Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj)
from 3.27.3 to 3.27.4.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… /go/adbc (apache#3274)

Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.244.0 to 0.246.0.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… shared Thrift request/response interfaces (apache#3256)

Refactor API to improve handling of request and responses to simplify
number of overloads.
Refactor API to send the IResponse to the Reader (`IArrowArrayStream`). 

- The Stream/Reader is now responsible to close the operation.
- The Statement is no longer responsible for keeping a singleton
instance of the (most recent) response.

Replaces apache#2797
Bumps [slab](https://github.com/tokio-rs/slab) from 0.4.10 to 0.4.11.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to
5.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…che#3285)

# Problem
The CloudFetchResultFetcher.StopAsync() method could not properly cancel
ongoing fetch operations because:
Missing cancellation token chaining: FetchNextResultBatchAsync created
timeout-only tokens using ApacheUtility.GetCancellationToken() and
ignored the external cancellation token passed from StopAsync()
Test reliability issues: Unit tests were failing because StopAsync()
calls weren't actually cancelling background operations
Resource management: Background fetch operations could continue running
even after disposal
# Solution
Fixed cancellation token chaining in FetchNextResultBatchAsync:
Replace single timeout token with proper linked cancellation tokens
Combine both timeout cancellation and external cancellation using
CancellationTokenSource.CreateLinkedTokenSource()
Now operations respond to both user-initiated cancellation (StopAsync())
and query timeouts
# Test
Adding new unit test to test for timeout cancel.
…sts (apache#3265)

Adds unit tests for DatabricksCompositeReader

Includes small changes to the concrete classes for testability
…braries (apache#3291)

Dynamic libraries implemented in Go cannot safely be unloaded. Prevent
this by default but add a flag to opt-into unloading the library.
…rs (apache#2949)

Adds a new project and tests to support adding OpenTelemetry exporters
(TracerProvider).
- Adds an ADBC `FileExporter` implementation.
- Adds a `ExportersBuilder` that 
  - Builds a list of supported exporters
- Activates and returns the appropriate exporter based on the passed
option or environment variable setting.

Note to reviewer:
`ExportersBuilder` is a convenience class - let me know if you think it
is useful.
…apache#3280)

This commit adds a new `adbc.bigquery.sql.location` parameter to the
BigQuery ADBC driver.

I piped it through the `databaseImpl`, down to the `connectionImpl` down
to the actual BigQuery `Client`.

Since the Python driver links to the Go one, I also made it a possible
connection parameter there.
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.47.0 to 1.47.1.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[actions/download-artifact](https://github.com/actions/download-artifact)
from 4 to 5.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [toml](https://github.com/toml-rs/toml) from 0.9.2 to 0.9.5.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… /go/adbc (apache#3309)

Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.246.0 to 0.247.0.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…o 1.16.0 in /go/adbc (apache#3311)

Bumps
[github.com/snowflakedb/gosnowflake](https://github.com/snowflakedb/gosnowflake)
from 1.15.0 to 1.16.0.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…s already closed (apache#3301)

Add check to see if operation is already closed because it's a direct
result.
…m to support old server version of Spark & Hive (apache#3312)

Co-authored-by: Aman Goyal <[email protected]>
Updated
[coverlet.collector](https://github.com/coverlet-coverage/coverlet) from
6.0.0 to 6.0.4.

<details>
<summary>Release notes</summary>

_Sourced from [coverlet.collector's
releases](https://github.com/coverlet-coverage/coverlet/releases)._

## 6.0.4

### Fixed
- Fix empty coverage report when using include and exclude filters
[#​1726](coverlet-coverage/coverlet#1726)

[Diff between 6.0.3 and
6.0.4](coverlet-coverage/coverlet@v6.0.3...v6.0.4)

## 6.0.3

### Fixed
- Fix RuntimeConfigurationReader to support self-contained builds
[#​1705](coverlet-coverage/coverlet#1705) by
https://github.com/pfeigl
- Fix inconsistent filenames with UseSourceLink after .NET 8
[#​1679](coverlet-coverage/coverlet#1679)
- Fix hanging tests
[#​989](coverlet-coverage/coverlet#989)
- Fix coverlet instrumentation becomes slow after installing dotnet sdk
8.0.200
[#​1620](coverlet-coverage/coverlet#1620)
- Fix upgrading v6.0.1 to v6.0.2 increases instrumentation time
[#​1649](coverlet-coverage/coverlet#1649)
- Fix Unable to instrument module - NET 8
[#​1631](coverlet-coverage/coverlet#1631)
- Fix slow modules filtering process
[#​1646](coverlet-coverage/coverlet#1646) by
https://github.com/BlackGad
- Fix incorrect coverage await using in generic method
[#​1490](coverlet-coverage/coverlet#1490)

### Improvements
- Cache the regex used in InstrumentationHelper
[#​1693](coverlet-coverage/coverlet#1693)
- Enable dotnetTool integration tests for linux
[#​660](coverlet-coverage/coverlet#660)

[Diff between 6.0.2 and
6.0.3](coverlet-coverage/coverlet@v6.0.2...v6.0.3)

## 6.0.2

### Fixed
- Threshold-stat triggers error
[#​1634](coverlet-coverage/coverlet#1634)
- Fixed coverlet collector 6.0.1 requires dotnet sdk 8
[#​1625](coverlet-coverage/coverlet#1625)
- Type initializer errors after updating from 6.0.0 to 6.0.1
[#​1629](coverlet-coverage/coverlet#1629)
- Exception when multiple exclude-by-attribute filters specified
[#​1624](coverlet-coverage/coverlet#1624)

### Improvements
- More concise options to specify multiple parameters in
coverlet.console
[#​1624](coverlet-coverage/coverlet#1624)

[Diff between 6.0.1 and
6.0.2](coverlet-coverage/coverlet@v6.0.1...v6.0.2)

## 6.0.1

### Fixed
- Uncovered lines in .NET 8 for inheriting records
[#​1555](coverlet-coverage/coverlet#1555)
- Fix record constructors not covered when SkipAutoProps is true
[#​1561](coverlet-coverage/coverlet#1561)
- Fix .NET 7 Method Group branch coverage issue
[#​1447](coverlet-coverage/coverlet#1447)
- Fix ExcludeFromCodeCoverage does not exclude method in a partial class
[#​1548](coverlet-coverage/coverlet#1548)
- Fix ExcludeFromCodeCoverage does not exclude F# task
[#​1547](coverlet-coverage/coverlet#1547)
- Fix issues where ExcludeFromCodeCoverage ignored
[#​1431](coverlet-coverage/coverlet#1431)
- Fix issues with ExcludeFromCodeCoverage attribute
[#​1484](coverlet-coverage/coverlet#1484)
- Fix broken links in documentation
[#​1514](coverlet-coverage/coverlet#1514)
- Fix problem with coverage for .net5 WPF application
[#​1221](coverlet-coverage/coverlet#1221) by
https://github.com/lg2de
- Fix unable to instrument module for Microsoft.AspNetCore.Mvc.Razor
[#​1459](coverlet-coverage/coverlet#1459) by
https://github.com/lg2de

### Improvements
- Extended exclude by attribute feature to work with fully qualified
name [#​1589](coverlet-coverage/coverlet#1589)
- Use System.CommandLine instead of McMaster.Extensions.CommandLineUtils
[#​1474](coverlet-coverage/coverlet#1474) by
https://github.com/Bertk
- Fix deadlog in Coverlet.Integration.Tests.BaseTest
[#​1541](coverlet-coverage/coverlet#1541) by
https://github.com/Bertk
- Add coverlet.msbuild.tasks unit tests
[#​1534](coverlet-coverage/coverlet#1534) by
https://github.com/Bertk

[Diff between 6.0.0 and
6.0.1](coverlet-coverage/coverlet@v6.0.0...v6.0.1)

Commits viewable in [compare
view](coverlet-coverage/coverlet@v6.0.0...v6.0.4).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coverlet.collector&package-manager=nuget&previous-version=6.0.0&new-version=6.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
eitsupi and others added 11 commits October 30, 2025 08:01
Expands support for arrow to include the latest version 57.

Also, the minor version of datafusion specified in the lock file has
been updated.

Supersede apache#3634.
…ache#3604)

## Motivation
The `Type` metadata key has two limitations which stems from BigQuery's
API:
1. it says fields of type `ARRAY<T>` are just `T` with `Repeated=true`
2. it says `STRUCT<...>` fields are simply `RECORD`, and erases any
information about the inner fields.

These limitations can cause problems when trying to parse the `Type` key
or when using it verbatim against the warehouse in a statement, e.g a
`CREATE TABLE` statement or a `AS T` cast.

## Summary
This PR adds a new `BIGQUERY:type` key that formats the original SQL
string as [specified by
BigQuery](https://cloud.google.com/bigquery/docs/reference/standard-sql/data-types#declaring_a_struct_type).

Most types remain unchanged as they come from `gobigquery`, and in those
cases this key will contain the same value as `Type`.

However, arrays and structs get transformed to match the richer type
string.

## Testing
I ran a `CREATE TABLE AS` query against BigQuery. Here's the result for
fields of different types

[1] Regular non-nested types are simply copied over from the value of
`Type`
<details>
<summary>1</summary>
<img width="331" height="1071" alt="image"
src="https://github.com/user-attachments/assets/ccd2ce17-37d8-4630-bef5-a503ed450c2a"
/>
</details>

[2] An array of integers becomes `ARRAY<INTEGER>`, while `Type` remains
`INTEGER`
<details>
<summary>2</summary>
<img width="319" height="369" alt="image"
src="https://github.com/user-attachments/assets/e588d7ac-c7ca-40fb-ab51-9795e566d240"
/>
</details>

[3] An array of structs becomes `ARRAY<STRUCT<...>>`
<details>
<summary>3</summary>
<img width="551" height="816" alt="image"
src="https://github.com/user-attachments/assets/bb946ebc-747a-4529-88a8-68636f94e44e"
/>
</details>

[4] A struct of arrays' inner types are `ARRAY<...>`
<details>
<summary>4</summary>
<img width="610" height="922" alt="image"
src="https://github.com/user-attachments/assets/932a3554-ea56-4b1f-8642-801ee91c4f63"
/>
</details>

[5] A deeply nested struct also has the correct inner types
<details>
<summary>5</summary>
<img width="1327" height="1307" alt="image"
src="https://github.com/user-attachments/assets/3185651b-8809-42b0-adc4-ec956eaf9e87"
/>
</details>

## Related issues
- apache#3449
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.47.1 to 1.48.0.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…oud downloads (apache#3652)

Improves memory utilization of cloud downloads by casting the downloaded
and/or decompressed cloud data sets directly into Arrow data rather than
having to deserialize them through a stream.

NOTE: I have not benchmarked this change.
…tion of cloud downloads" change (apache#3655)

Reverts apache#3652 as it seems to have caused a regression.
…r behavior and set appropriate limit (apache#3656)

## Summary


**Clarifies memory manager behavior** - Documents that
`CloudFetchMemoryBufferManager` tracks in-flight compressed download
sizes and reduces the default from 200MB to 100MB


## Memory Manager Clarification

The `CloudFetchMemoryBufferManager` tracks **in-flight download memory
based on compressed file sizes**, not decompressed sizes. This design is
intentional:

1. **Limits concurrent downloads** - Prevents unbounded parallel
downloads from exhausting system resources
2. **Natural decompression bounds** - Decompressed data memory is
naturally bounded by the result queue capacity and batch processing flow
3. **Lightweight concurrency control** - Tracking compressed sizes
provides efficient download throttling without overhead of tracking
decompressed memory

### Changes

- Added comprehensive documentation to `CloudFetchMemoryBufferManager`
explaining it tracks in-flight compressed data sizes
- Reduced `DefaultMemoryBufferSizeMB` from 200 to 100 in
`CloudFetchDownloadManager`
- Added inline comments clarifying that size parameters represent
compressed file sizes from the server

## Test plan

- [ ] Existing CloudFetch tests pass
- [ ] Manual testing with CloudFetch queries to verify download behavior

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude <[email protected]>
Closes apache#3619.

Recently, Apache Arrow 22.0.0 is released. If we don't rebuild our
Docker images, we still use old Apache Arrow for building deb/RPM. Our
deb/RPM should use the latest Apache Arrow.
There was a new release with an apparent breaking change 12 hours ago.

```
2025-11-03T02:19:16.5571756Z /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/util/backtracefilter.rb:16:in `method': undefined method `start' for class `#<Class:PowerAssert>' (NameError)
2025-11-03T02:19:16.5573444Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/util/backtracefilter.rb:16:in `<module:BacktraceFilter>'
2025-11-03T02:19:16.5575112Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/util/backtracefilter.rb:9:in `<module:Util>'
2025-11-03T02:19:16.5576301Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/util/backtracefilter.rb:8:in `<module:Unit>'
2025-11-03T02:19:16.5577489Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/util/backtracefilter.rb:7:in `<module:Test>'
2025-11-03T02:19:16.5578900Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/util/backtracefilter.rb:6:in `<top (required)>'
2025-11-03T02:19:16.5580076Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/assertions.rb:7:in `require_relative'
2025-11-03T02:19:16.5581187Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/assertions.rb:7:in `<top (required)>'
2025-11-03T02:19:16.5582277Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/testcase.rb:12:in `require_relative'
2025-11-03T02:19:16.5583344Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/testcase.rb:12:in `<top (required)>'
2025-11-03T02:19:16.5584447Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/autorunner.rb:7:in `require_relative'
2025-11-03T02:19:16.5585769Z 	from /adbc/glib/vendor/bundle/ruby/3.0.0/gems/test-unit-3.7.0/lib/test/unit/autorunner.rb:7:in `<top (required)>'
2025-11-03T02:19:16.5586508Z 	from /adbc/glib/test/run.rb:44:in `require'
2025-11-03T02:19:16.5586903Z 	from /adbc/glib/test/run.rb:44:in `<main>'
2025-11-03T02:19:17.2628569Z Failed to verify release candidate. See /tmp/arrow-adbc-HEAD.pbgze for details.
```
packages = []
with path.open() as source:
for line in source:
if "img.shields.io" in line:

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High documentation

The string
img.shields.io
may be at an arbitrary position in the sanitized URL.

Copilot Autofix

AI 4 days ago

To fix this error, the check should parse any URL(s) found on the line and accept the line only if at least one of the parsed URLs has a hostname of exactly img.shields.io. Since the code processes lines from Markdown source files and looks for badge images (with links of the form ![tag](https://img.shields.io/...)), we should extract any URL(s) within parentheses following markdown image syntax, parse the URLs using Python's standard urllib.parse.urlparse, and check their .hostname field.

  • Import urllib.parse.urlparse at the top.
  • Replace the substring check with code to find all URLs in the line, parse each, and check if any have hostname img.shields.io.
  • Only process the line accordingly if such a URL is found.
  • Only edit the relevant lines in the shown code (we are limited to what code blocks we have).
Suggested changeset 1
docs/source/ext/adbc_misc.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/docs/source/ext/adbc_misc.py b/docs/source/ext/adbc_misc.py
--- a/docs/source/ext/adbc_misc.py
+++ b/docs/source/ext/adbc_misc.py
@@ -23,6 +23,7 @@
 import itertools
 import typing
 from pathlib import Path
+from urllib.parse import urlparse
 
 import docutils
 import sphinx
@@ -77,19 +78,26 @@
     packages = []
     with path.open() as source:
         for line in source:
-            if "img.shields.io" in line:
-                before, _, after = line.partition("img.shields.io")
-                tag = before[before.index("![") + 2 : before.index("]")].strip()
-                key, _, value = tag.partition(": ")
-                key = key.strip()
-                value = value.strip()
+            # Extract probable markdown image link url: ![...](...)
+            start = line.find("](")
+            end = line.find(")", start+2) if start != -1 else -1
+            url = None
+            if start != -1 and end != -1:
+                url = line[start+2:end].strip()
+            if url:
+                parsed_url = urlparse(url)
+                if parsed_url.hostname and parsed_url.hostname == "img.shields.io":
+                    before = line[:line.index("](")]
+                    tag = before[before.index("![") + 2 : before.index("]")].strip()
+                    key, _, value = tag.partition(": ")
+                    key = key.strip()
+                    value = value.strip()
 
-                if key.lower() in {"vendor", "implementation", "status"}:
-                    meta[key.lower()] = value
-                else:
-                    repo = key
-                    url = after[after.rfind("(") + 1 : after.rfind(")")].strip()
-                    packages.append((repo, value, url))
+                    if key.lower() in {"vendor", "implementation", "status"}:
+                        meta[key.lower()] = value
+                    else:
+                        repo = key
+                        packages.append((repo, value, url))
     return DriverStatus(**meta, packages=packages)
 
 
EOF
@@ -23,6 +23,7 @@
import itertools
import typing
from pathlib import Path
from urllib.parse import urlparse

import docutils
import sphinx
@@ -77,19 +78,26 @@
packages = []
with path.open() as source:
for line in source:
if "img.shields.io" in line:
before, _, after = line.partition("img.shields.io")
tag = before[before.index("![") + 2 : before.index("]")].strip()
key, _, value = tag.partition(": ")
key = key.strip()
value = value.strip()
# Extract probable markdown image link url: ![...](...)
start = line.find("](")
end = line.find(")", start+2) if start != -1 else -1
url = None
if start != -1 and end != -1:
url = line[start+2:end].strip()
if url:
parsed_url = urlparse(url)
if parsed_url.hostname and parsed_url.hostname == "img.shields.io":
before = line[:line.index("](")]
tag = before[before.index("![") + 2 : before.index("]")].strip()
key, _, value = tag.partition(": ")
key = key.strip()
value = value.strip()

if key.lower() in {"vendor", "implementation", "status"}:
meta[key.lower()] = value
else:
repo = key
url = after[after.rfind("(") + 1 : after.rfind(")")].strip()
packages.append((repo, value, url))
if key.lower() in {"vendor", "implementation", "status"}:
meta[key.lower()] = value
else:
repo = key
packages.append((repo, value, url))
return DriverStatus(**meta, packages=packages)


Copilot is powered by AI and may make mistakes. Always verify output.

@Test
void initParams() throws Exception {
File tmpPath = File.createTempFile("jni_test", ".sqlite");

Check warning

Code scanning / CodeQL

Local information disclosure in a temporary directory Medium test

Local information disclosure vulnerability due to use of file readable by other local users.

Copilot Autofix

AI 4 days ago

To fix the issue, replace the insecure call to File.createTempFile with a secure version using the java.nio.file.Files.createTempFile API, which creates files with safe permissions (-rw------- on unix-like systems). We'll obtain a Path object from Files.createTempFile, then construct a File from it, to preserve usage in the rest of the code.
In file java/driver/jni/src/test/java/org/apache/arrow/adbc/driver/jni/JniDriverTest.java, line 138 should be replaced. Since the code uses File APIs later on, we will add an import for java.nio.file.Files and update the line to:

File tmpPath = Files.createTempFile("jni_test", ".sqlite").toFile();

No further code changes are necessary, since this preserves the existing File-based usage.


Suggested changeset 1
java/driver/jni/src/test/java/org/apache/arrow/adbc/driver/jni/JniDriverTest.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/java/driver/jni/src/test/java/org/apache/arrow/adbc/driver/jni/JniDriverTest.java b/java/driver/jni/src/test/java/org/apache/arrow/adbc/driver/jni/JniDriverTest.java
--- a/java/driver/jni/src/test/java/org/apache/arrow/adbc/driver/jni/JniDriverTest.java
+++ b/java/driver/jni/src/test/java/org/apache/arrow/adbc/driver/jni/JniDriverTest.java
@@ -21,6 +21,7 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import java.io.File;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
@@ -135,7 +136,7 @@
 
   @Test
   void initParams() throws Exception {
-    File tmpPath = File.createTempFile("jni_test", ".sqlite");
+    File tmpPath = Files.createTempFile("jni_test", ".sqlite").toFile();
     //noinspection ResultOfMethodCallIgnored
     tmpPath.delete();
     tmpPath.deleteOnExit();
EOF
@@ -21,6 +21,7 @@
import static org.junit.jupiter.api.Assertions.assertThrows;

import java.io.File;
import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
@@ -135,7 +136,7 @@

@Test
void initParams() throws Exception {
File tmpPath = File.createTempFile("jni_test", ".sqlite");
File tmpPath = Files.createTempFile("jni_test", ".sqlite").toFile();
//noinspection ResultOfMethodCallIgnored
tmpPath.delete();
tmpPath.deleteOnExit();
Copilot is powered by AI and may make mistakes. Always verify output.
@serramatutu
Copy link

@jasonlin45 this is A LOT of files... Do you have a pointer on where to start reviewing this? Have you changed anything that came from ADBC upstream?

@jasonlin45
Copy link
Author

@serramatutu I added a how to review to the PR description - most of the changes we need to review aren't super large within the drivers themselves

@chasewalden
Copy link

@serramatutu, I'd also assume that many of the changes outside of the go/adbc/... subtree can more-or-less be ignored. To my understanding, we have mostly focussed on the go codebase, but please correct me if I am wrong @jasonlin45.

I will start my review now, but it will likely take me a bit to get through it.


Side note: Is it worthwhile for us to try to automate regular syncs with upstream? That would (hopefully) minimize divergence and make future "catch-up" PRs not have 550+ commits

@jasonlin45 jasonlin45 marked this pull request as ready for review November 13, 2025 23:44
@jasonlin45 jasonlin45 changed the title [DRAFT] Merge with ADBC 21 Merge with ADBC 21 Nov 14, 2025
Copy link
Collaborator

@xuliangs xuliangs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you Jason, this is huge.

@jasonlin45 jasonlin45 merged commit 6c4e98d into main Nov 14, 2025
107 of 210 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.