[dependabot]

Bumps org.checkerframework:checker-qual from 4.2.3 to 4.3.0.

Release notes

Sourced from org.checkerframework:checker-qual's releases.

Checker Framework 4.3.0

Version 4.3.0 (2026-10-01)

User-visible changes

The new Modifiability Checker warns when a program might throw UnsupportedOperationException at run time because it calls a mutating method on a collection that does not support the method.

The new wpi2.sh script does whole-program inference, but requires buildfile edits.

Purity Checker:

• Renamed message keys purity.not.deterministic.X, purity.not.sideeffectfree.X, and purity.not.deterministic.not.sideeffectfree.X to purity.X.
• -AcheckPurityAnnotations issues warnings that it missed previously.

The Checker Framework runs under JDK 27 -- that is, it runs on a version 27 JVM.

The Checker Framework runs noticeably faster, due to performance tuning.

The HTML version of the manual has a new look. In addition to the single-page version, there is a multi-page version.

Changes for type system implementers

JavaParserUtil: moved DEFAULT_LANGUAGE_LEVEL, parseCompilationUnit(), parseStubUnit(), and parseExpression() into new class StaticJavaParserUtil.

Renamed AnnotatedTypes.innerMostType() to innermostComponentType().

Removed the unused method WholeProgramInferenceScenesStorage.updateAnnotationSetInScene().

Methods that used to return (or accept) an IPair now use a record with meaningful component names.

Closed issues

#294, #1170, #1184, #1256, #1440, #1444, #1669, #2090, #2172, #2429, #2448, #2561, #2637, #2704, #2722, #2770, #2896, #2995, #3015, #3025, #3027, #3146, #3281, #3624, #4690, #4708, #4754, #5064, #5201, #6038, #6716, #6741, #6748, #6756, #6768, #6832, #6881, #7023, #7049, #7064, #7311, #7683, #8053, #8054, #8055, #8167, #8168, #8169, #8238, #8261, #8284.

Changelog

Sourced from org.checkerframework:checker-qual's changelog.

Version 4.3.0 (2026-10-01)

User-visible changes

The new Modifiability Checker warns when a program might throw UnsupportedOperationException at run time because it calls a mutating method on a collection that does not support the method.

The new wpi2.sh script does whole-program inference, but requires buildfile edits.

Purity Checker:

• Renamed message keys purity.not.deterministic.X, purity.not.sideeffectfree.X, and purity.not.deterministic.not.sideeffectfree.X to purity.X.
• -AcheckPurityAnnotations issues warnings that it missed previously.

The Checker Framework runs under JDK 27 -- that is, it runs on a version 27 JVM.

The Checker Framework runs noticeably faster, due to performance tuning.

The HTML version of the manual has a new look. In addition to the single-page version, there is a multi-page version.

Changes for type system implementers

JavaParserUtil: moved DEFAULT_LANGUAGE_LEVEL, parseCompilationUnit(), parseStubUnit(), and parseExpression() into new class StaticJavaParserUtil.

Renamed AnnotatedTypes.innerMostType() to innermostComponentType().

Removed the unused method WholeProgramInferenceScenesStorage.updateAnnotationSetInScene().

Methods that used to return (or accept) an IPair now use a record with meaningful component names.

Closed issues

#294, #1170, #1184, #1256, #1440, #1444, #1669, #2090, #2172, #2429, #2448, #2561, #2637, #2704, #2722, #2770, #2896, #2995, #3015, #3025, #3027, #3146, #3281, #3624, #4690, #4708, #4754, #5064, #5201, #6038, #6716, #6741, #6748, #6756, #6768, #6832, #6881, #7023, #7049, #7064, #7311, #7683, #8053, #8054, #8055, #8167, #8168, #8169, #8238, #8261, #8284.

Commits

• a850bea new release 4.3.0
• 2df7db6 Fix the module in links to Collections Javadoc
• c714cde Fix broken links in the lwarp-generated manuals (#8312)
• 1014d08 Add the Modifiability Checker (#8234)
• 3c6e930 Don't bound a fresh capture type variable by unresolved inference variables (...
• cd86e5d Prep for the release.
• 0195f64 Check a constructor's purity against its class's instance initializers (#8113)
• 93d6023 Add test cases for issues that are already fixed (#8303)
• 9e0f606 Add test cases for issues that are already fixed (#8302)
• 8a1a3aa Don't let an inference bound that ignores annotations override one that (#8285)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[FrankChen021]

This is an automated review by Codex GPT-5.6 Luna(Max).

Compatibility analysis

Dependency: org.checkerframework:checker-qual, source 4.2.3, target 4.3.0. The complete published-release path reviewed is 4.2.3 -> 4.3.0; no published release lies between them. The carried-forward ROUND_1 verdict is SAFE. API/ABI is SAFE: Druid-consumed annotations remain present and no incompatible public signature or binary change was found. Runtime is SAFE: the update changes annotation metadata only and introduces no Druid runtime logic change. Configuration is SAFE: no configuration keys, defaults, or startup behavior changed. Serialization/wire and persistence are SAFE: no schema, protocol, serialized class, wire format, segment, index, or metadata format changed. Clients are SAFE: no Druid client-facing API or transport behavior changed. Transitive dependencies are SAFE: only the checker-qual version property changed and no dependency graph change was introduced. Licenses are SAFE: both versions retain MIT licensing and Druid already has checker-qual license mapping. Extension/plugin SPI is SAFE: no extension registration, service-provider, or SPI contract changed. No Druid-relevant CONCERN, INCOMPATIBLE, or UNRESOLVED evidence remains.

Druid impact

pom.xml is the only changed file. The PR updates checkerframework.version from 4.2.3 to 4.3.0; relevant annotation consumers are in cloud/aws-common, processing, server, and sql, including Nullable, MonotonicNonNull, and EnsuresNonNull. No tracked production or test source changed. Practical behavior is unchanged; this is a build-time annotation dependency update.

Validation

The complete PR diff, exact base/head commits, published artifacts, public signatures, Maven metadata, licenses, Druid call sites, and extension/plugin surfaces were reviewed. git diff --check passed. Dependency resolution and license checks were reviewed for the target artifact, with no transitive or license issue found. The initial K/U/Z/Y/X Kafka timeout and E/G/F BindException were classified as external; the authorized reruns produced job 116960743346 (K, reproduced the Kafka timeout), job 116960743653 (E/G/F, successful), and job 116978225768 (K, successful). Coverage progressed from skipped to successful. No local full suite was run; exact-head CI supplies the build/test validation.

CI gate

At exact current head 20c4288abe56fe13e53c0c80ab6453214da1a3c5, the PR is OPEN, non-draft, MERGEABLE, and CLEAN. The authoritative complete statusCheckRollup is SUCCESS: 27/27 CheckRuns are COMPLETED/SUCCESS and 0 StatusContexts are reported. Every reported item succeeded; no failed, skipped, pending, queued, in-progress, neutral, cancelled, or unknown result remains.

Automation actions

No files were changed, no commit was pushed, and no closure or merge was performed. The automation reran the eligible external failures described above and verified their exact-head results before approval.

No merge was performed.