[dependabot]

Bumps org.ow2.asm:asm-commons from 9.10.1 to 9.11.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[FrankChen021]

This is an automated review by Codex GPT-5.6 Luna(Max).

Compatibility analysis

Inherited ROUND_1 review is SAFE for org.ow2.asm:asm-commons, source 9.10.1 to target 9.11. The complete published release path is 9.10.1 -> 9.11, with no intervening published release. Evidence covers API/ABI, runtime, configuration, serialization/wire, persistence, clients, transitive dependencies, licenses, and extension/plugin SPI: all are SAFE. ASM 9.11 aligns asm, asm-commons, and asm-tree; Druid’s ASM consumers remain compatible, the focused TopN specialization suite passed, and BSD-3-Clause license metadata was aligned without changing runtime behavior.

Druid impact

The changed paths are root pom.xml and licenses.yaml: managed ASM version and license metadata changes only. There are no tracked production or test source changes. Druid continues to resolve the ASM family consistently at 9.11; no Druid API, runtime, configuration, serialization/wire, persistence, client, or extension/plugin SPI behavior changes.

Validation

The dependency tree resolves all ASM artifacts at 9.11 and RequireUpperBoundDeps passes. TopNQueryRunnerTest#testTopN passed 96/96; git diff --check passed. Complete current-base diff verification passed: SHA-256 c7c5ac5351333a5bdc4dfd430c2374e6ea1a488729e0b87f4f2c5984ea138480, containing only licenses.yaml and pom.xml, both metadata-only. Automation pushed bounded version and license metadata repairs in commits e4028648aca604e56ccd7a50f06e8e67a184a679 and e939c0c9420caf7d4eee573b906fef23d856a62f.

CI gate

Exact head e939c0c9420caf7d4eee573b906fef23d856a62f and base 3e9c628f0844657cfd3a64eccb591b5b9ae34daf are unchanged. The PR is OPEN, non-draft, and MERGEABLE/CLEAN. The complete exact-head statusCheckRollup is SUCCESS: 27 CheckRuns are COMPLETED/SUCCESS, 0 StatusContexts are reported, and every reported item succeeded. The earlier external CodeQL baseline configuration state has cleared; all current-head items are successful.

Automation actions

Automation pushed commits e4028648aca604e56ccd7a50f06e8e67a184a679 and e939c0c9420caf7d4eee573b906fef23d856a62f changing only dependency/version and license metadata. No source files changed and no merge was performed.
No merge was performed.