This is an automated email from the ASF dual-hosted git repository.
Fokko pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/avro.git
The following commit(s) were added to refs/heads/main by this push:
new bd9fc0882b Bump org.apache.maven.plugins:maven-surefire-plugin from
3.5.6 to 3.6.1 in /lang/java (#4073)
bd9fc0882b is described below
commit bd9fc0882bc66ff0a936f4f94f5b5c1dea8433bc
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Tue Nov 10 19:07:24 2026 +0100
Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.1 in
/lang/java (#4073)
* Bump org.apache.maven.plugins:maven-surefire-plugin in /lang/java
Bumps
[org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire)
from 3.5.6 to 3.6.1.
- [Release notes](https://github.com/apache/maven-surefire/releases)
-
[Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.6...surefire-3.6.1)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
dependency-version: 3.6.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <[email protected]>
* Fix TestSpecificRecordWithUnion under surefire 3.6.x
The testNotSerializableClasses assertion relied on SpecificData.get()
having an empty class-resolution cache: when another test in the class
(or a previously-run test) already resolved TestUnionRecord, the
security validator never fired and no SecurityException was thrown.
Surefire 3.6.x runs the tests in a different order, exposing this.
Use a fresh SpecificData instance for the reader so the class lookup
genuinely goes through the security validator.
---------
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Fokko Driesprong <[email protected]>
---
.../org/apache/avro/specific/TestSpecificRecordWithUnion.java | 10 +++++++++-
pom.xml | 2 +-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git
a/lang/java/avro/src/test/java/org/apache/avro/specific/TestSpecificRecordWithUnion.java
b/lang/java/avro/src/test/java/org/apache/avro/specific/TestSpecificRecordWithUnion.java
index 70f3e7ac90..b1a1dbe59c 100644
---
a/lang/java/avro/src/test/java/org/apache/avro/specific/TestSpecificRecordWithUnion.java
+++
b/lang/java/avro/src/test/java/org/apache/avro/specific/TestSpecificRecordWithUnion.java
@@ -55,10 +55,18 @@ public class TestSpecificRecordWithUnion {
byte[] recordBytes = serializeRecord(
"{ \"org.apache.avro.specific.TestUnionRecord\": { \"amount\": {
\"bytes\": \"\\u0000\" } } }", schema);
+ // Use a fresh SpecificData so class resolution is not served from
+ // SpecificData.get()'s cache (other tests in this class may have resolved
+ // TestUnionRecord already, and surefire 3.6.x JUnit Platform ordering can
+ // run them first). The test must exercise the security validator on
lookup.
+ SpecificDatumReader<SpecificRecord> reader = new
SpecificDatumReader<>(schema, schema, new SpecificData());
+
ClassSecurityPredicate originalValidator =
ClassSecurityValidator.getGlobal();
try {
ClassSecurityValidator.setGlobal(ClassSecurityValidator.builder().build());
- assertThrows(SecurityException.class, () -> deserializeRecord(schema,
recordBytes));
+ ByteArrayInputStream in = new ByteArrayInputStream(recordBytes);
+ Decoder decoder = DecoderFactory.get().binaryDecoder(in, null);
+ assertThrows(SecurityException.class, () -> reader.read(null, decoder));
} finally {
ClassSecurityValidator.setGlobal(originalValidator);
}
diff --git a/pom.xml b/pom.xml
index 14ea4497ac..4f27ca00a3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -63,7 +63,7 @@
<maven-toolchains-plugin.version>3.3.0</maven-toolchains-plugin.version>
<plugin-tools-javadoc.version>3.5.2</plugin-tools-javadoc.version>
<spotless-maven-plugin.version>3.11.0</spotless-maven-plugin.version>
- <maven-surefire-plugin.version>3.5.6</maven-surefire-plugin.version>
+ <maven-surefire-plugin.version>3.6.1</maven-surefire-plugin.version>
<!-- Pin output timestamp to make the Java build reproducible -->
<project.build.outputTimestamp>1723122283</project.build.outputTimestamp>
