Skip to content

feat(huggingface): add qa and ranking tasks - #2

Open
anishshiva7 wants to merge 54 commits into
hf/04-audio-mediagenfrom
hf/05-qa-ranking
Open

feat(huggingface): add qa and ranking tasks#2
anishshiva7 wants to merge 54 commits into
hf/04-audio-mediagenfrom
hf/05-qa-ranking

Conversation

@anishshiva7

Copy link
Copy Markdown
Collaborator

⚠️ This PR is stacked on hf/04-audio-mediagen. Until that lands, the diff below may also include earlier HuggingFace task-family changes depending on which base GitHub is showing. The new code in this PR is codegen/QaRankingCodegen.scala, the QA/ranking-related additions to codegen/PythonCodegenBase.scala, the new QA/ranking fields on HuggingFaceInferenceOpDesc.scala, and the QA/ranking task tests in HuggingFaceInferenceOpDescSpec.scala. Once PR 4 merges and this PR is retargeted to main, the diff should auto-clean to the PR 5 QA/ranking changes only.

What changes were proposed in this PR?

Adds the QA/ranking/classification task family — 5 HF pipeline tasks — as a new TaskCodegen plugged into the dispatcher established by the text-generation PR:

QA tasks: question-answering, table-question-answering

classification/ranking tasks: zero-shot-classification, sentence-similarity, text-ranking

codegen/QaRankingCodegen.scala supplies the per-task payload + parse Python branches for all 5 tasks.

CodegenContext is extended with contextColumn, candidateLabels, and sentencesColumn (EncodableString).

HuggingFaceInferenceOpDesc.scala gains 3 new @JsonProperty fields and registers QaRankingCodegen in the dispatcher.

PythonCodegenBase.scala grows to host the shared QA/ranking infrastructure:

  • Per-row validation for the new column-named fields.
  • question-answering payload handling with prompt + context.
  • table-question-answering payload handling with table data.
  • zero-shot-classification payload handling with candidate labels.
  • sentence-similarity and text-ranking payload handling with sentence inputs.
  • Response parsing for QA/ranking outputs.

User-input strings continue to flow through pyb"..." + EncodableString so they reach Python as self.decode_python_template('<base64>') rather than raw literals. PythonCodeRawInvalidTextSpec still passes with 117/117 descriptors py_compile cleanly.

Any related issues, documentation, or discussions?

Tracking issue: Add HuggingFace question answering and ranking tasks apache#5292

Closes Add HuggingFace question answering and ranking tasks apache#5292

Stacked on: PR 4 audio/media generation tasks / hf/04-audio-mediagen

Parent issue: Add Hugging Face inference operator apache#5041

Closed sibling issue: Add HuggingFaceModelResource REST endpoints for HF operator UI apache#5134

How was this PR tested?

sbt "WorkflowOperator/compile; WorkflowOperator/Test/compile" clean.

sbt "WorkflowOperator/testOnly org.apache.texera.amber.operator.huggingFace.HuggingFaceInferenceOpDescSpec org.apache.texera.amber.util.PythonCodeRawInvalidTextSpec" — 31 focused tests pass, including HuggingFace QA/ranking task coverage and the raw Python descriptor scan.

sbt "WorkflowOperator / scalafmtCheck" clean.

sbt "WorkflowOperator / Test / scalafmtCheck" clean.

PythonCodeRawInvalidTextSpec — 117/117 descriptors py_compile cleanly with the new operator code paths, no marker leaks.

Was this PR authored or co-authored using generative AI tooling?

Yes, co-authored with generative AI tooling (Codex).

@github-actions

github-actions Bot commented Jun 8, 2026

Copy link
Copy Markdown

👋 Thanks for your first contribution to Texera, @anishshiva7!

You can drive common housekeeping tasks just by leaving a comment. Type the command on its own line.

On issues

Command What it does
/take Assign the issue to yourself (self-claim it)
/untake Remove yourself as assignee

To find unclaimed work, search is:issue is:open no:assignee — there's no "triage" label; the search filter is the triage state.

Linking sub-issues

Command Where to run it What it does
/sub-issue #12 #13 On the parent Links apache#12 and apache#13 as children of this issue
/unsub-issue #12 #13 On the parent Unlinks those children
/parent-issue #5 On the child Sets apache#5 as this issue's parent
/unparent-issue On the child Removes this issue's parent (auto-detected)
/unparent-issue #5 On the child Removes parent apache#5 explicitly

You can write references as #12 or bare 12. Cross-repo references like owner/repo#12 aren't supported and are ignored.

On pull requests (author only)

Command What it does
/request-review @user [@user ...] Request reviews from those users
/unrequest-review @user [@user ...] Cancel those review requests

You can mention teams as @org/team, and @copilot works too. Only the PR author can use these commands.

Note: Commands must match exactly — /take this won't work, only /take. Bots are ignored, and you can't self-link an issue or set an issue as its own parent.

For the full contribution flow, see CONTRIBUTING.md.

@anishshiva7
anishshiva7 force-pushed the hf/04-audio-mediagen branch from 2fab0ab to b77eaec Compare June 16, 2026 18:20
@anishshiva7
anishshiva7 force-pushed the hf/04-audio-mediagen branch from b77eaec to 1ca3ce2 Compare June 19, 2026 18:39
@anishshiva7
anishshiva7 force-pushed the hf/04-audio-mediagen branch from 1ca3ce2 to 57a901c Compare June 19, 2026 19:11
@anishshiva7
anishshiva7 force-pushed the hf/05-qa-ranking branch 2 times, most recently from cb6cf1e to b81c325 Compare June 19, 2026 20:48
<!--
Thanks for sending a pull request (PR)! Here are some tips for you:
1. If this is your first time, please read our contributor guidelines:
[Contributing to
Texera](https://github.com/apache/texera/blob/main/CONTRIBUTING.md)
  2. Ensure you have added or run the appropriate tests for your PR
  3. If the PR is work in progress, mark it a draft on GitHub.
  4. Please write your PR title to summarize what this PR proposes, we 
    are following Conventional Commits style for PR titles as well.
  5. Be sure to keep the PR description updated to reflect all changes.
-->

### What changes were proposed in this PR?
<!--
Please clarify what changes you are proposing. The purpose of this
section
is to outline the changes. Here are some tips for you:
  1. If you propose a new API, clarify the use case for a new API.
  2. If you fix a bug, you can clarify why it is a bug.
  3. If it is a refactoring, clarify what has been changed.
  3. It would be helpful to include a before-and-after comparison using 
     screenshots or GIFs.
  4. Please consider writing useful notes for better and faster reviews.
-->
Adds a unit test spec for `TextGenCodegen`. Tests cover:
- `task` equals `"text-generation"`
- `payloadPython(ctx)` opens with the `if task == "text-generation":`
branch
- `payloadPython(ctx)` emits the chat-completions shape (`messages`,
`max_tokens`, `temperature`)
- `payloadPython(ctx)` includes the `else` fallback with `{"inputs":
prompt_value}`
- `parsePython(ctx)` reads from `choices` / `message` / `content`
- No raw-string leakage: snippets reference `self.*` attributes, never
literal context values
- Context-independence: two different `CodegenContext` inputs produce
identical output

### Any related issues, documentation, discussions?
<!--
Please use this section to link other resources if not mentioned
already.
1. If this PR fixes an issue, please include `Fixes apache#1234`, `Resolves
apache#1234`
or `Closes apache#1234`. If it is only related, simply mention the issue
number.
  2. If there is design documentation, please add the link.
  3. If there is a discussion in the mailing list, please add the link.
-->
Closes apache#5778

### How was this PR tested?
<!--
If tests were added, say they were added here. Or simply mention that if
the PR
is tested with existing test cases. Make sure to include/update test
cases that
check the changes thoroughly including negative and positive cases if
possible.
If it was tested in a way different from regular unit tests, please
clarify how
you tested step by step, ideally copy and paste-able, so that other
reviewers can
test and check, and descendants can verify in the future. If tests were
not added,
please describe why they were not added and/or why it was difficult to
add.
-->
Spec verified with `sbt "WorkflowOperator/testOnly
*TextGenCodegenSpec"`. 7 tests passing.

### Was this PR authored or co-authored using generative AI tooling?
<!--
If generative AI tooling has been used in the process of authoring this
PR,
please include the phrase: 'Generated-by: ' followed by the name of the
tool
and its version. If no, write 'No'. 
Please refer to the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) for
details.
-->
Coauthored-by: Claude Code (Anthropic)
<!--
Thanks for sending a pull request (PR)! Here are some tips for you:
1. If this is your first time, please read our contributor guidelines:
[Contributing to
Texera](https://github.com/apache/texera/blob/main/CONTRIBUTING.md)
  2. Ensure you have added or run the appropriate tests for your PR
  3. If the PR is work in progress, mark it a draft on GitHub.
  4. Please write your PR title to summarize what this PR proposes, we 
    are following Conventional Commits style for PR titles as well.
  5. Be sure to keep the PR description updated to reflect all changes.
-->



### What changes were proposed in this PR?
<!--
Please clarify what changes you are proposing. The purpose of this
section
is to outline the changes. Here are some tips for you:
  1. If you propose a new API, clarify the use case for a new API.
  2. If you fix a bug, you can clarify why it is a bug.
  3. If it is a refactoring, clarify what has been changed.
  3. It would be helpful to include a before-and-after comparison using 
     screenshots or GIFs.
  4. Please consider writing useful notes for better and faster reviews.
-->

Adds a behavior-focused unit test spec for `AdminGuardService`. Tests
cover:
- Admin user: `canActivate()` returns `true`, `Router.navigate` is NOT
called
- Non-admin user: `canActivate()` returns `false`, `Router.navigate` is
called with `[USER_WORKFLOW]`
- No signed-in user: `canActivate()` returns `false`, `Router.navigate`
is called with `[USER_WORKFLOW]`

Mirrors the existing `auth-guard.service.spec.ts` pattern.

### Any related issues, documentation, discussions?
<!--
Please use this section to link other resources if not mentioned
already.
1. If this PR fixes an issue, please include `Fixes apache#1234`, `Resolves
apache#1234`
or `Closes apache#1234`. If it is only related, simply mention the issue
number.
  2. If there is design documentation, please add the link.
  3. If there is a discussion in the mailing list, please add the link.
-->

closes  apache#5780

### How was this PR tested?
<!--
If tests were added, say they were added here. Or simply mention that if
the PR
is tested with existing test cases. Make sure to include/update test
cases that
check the changes thoroughly including negative and positive cases if
possible.
If it was tested in a way different from regular unit tests, please
clarify how
you tested step by step, ideally copy and paste-able, so that other
reviewers can
test and check, and descendants can verify in the future. If tests were
not added,
please describe why they were not added and/or why it was difficult to
add.
-->

Spec verified with `npx ng test --watch=false
--include='**/admin-guard.service.spec.ts'`. 3 tests passing.

### Was this PR authored or co-authored using generative AI tooling?
<!--
If generative AI tooling has been used in the process of authoring this
PR,
please include the phrase: 'Generated-by: ' followed by the name of the
tool
and its version. If no, write 'No'. 
Please refer to the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) for
details.
-->
Co-Authored: Claude Code (Anthropic)
aglinxinyuan and others added 15 commits June 19, 2026 22:58
… abstractions and small Jackson config bags (apache#5770)

### What changes were proposed in this PR?

Pin behavior of four small contract / config classes in
`common/workflow-operator/`. Each is too thin to justify its own PR but
the bundle stays cohesive (everything sits in the descriptor / metadata
surface). No production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `SourceOperatorDescriptorSpec` | `SourceOperatorDescriptor` (abstract)
| 4 |
| `PythonSourceOperatorDescriptorSpec` |
`PythonSourceOperatorDescriptor` (abstract) | 5 |
| `GaugeChartStepsSpec` | `GaugeChartSteps` (Jackson bag) | 7 |
| `DummyPropertiesSpec` | `DummyProperties` (Jackson bag) | 7 |

All four spec files follow the `<srcClassName>Spec.scala` one-to-one
convention.

**Behavior pinned — `SourceOperatorDescriptor`**

| Surface | Contract |
| --- | --- |
| `sourceSchema()` | declared as an abstract member; pinned via a
minimal test-only concrete subclass |
| `LogicalOp` inheritance | upcast compiles; `case _: LogicalOp` and
`case _: SourceOperatorDescriptor` both match a concrete instance |

**Behavior pinned — `PythonSourceOperatorDescriptor`**

| Surface | Contract |
| --- | --- |
| Composition | a concrete subclass IS a `SourceOperatorDescriptor` AND
a `PythonOperatorDescriptor` (compile-time enforced + four-way
`isInstanceOf` check) |
| Inherited defaults | `parallelizable() == false` and `asSource() ==
false` (the documented base defaults) when the subclass does not
override |

**Behavior pinned — `GaugeChartSteps`**

| Surface | Contract |
| --- | --- |
| Defaults | `start == ""` and `end == ""` on a fresh instance |
| Mutability | both fields are `var`-assignable post-construction |
| JSON wire-keys | serialize under `start` / `end` (Jackson tree-API
verified) |
| JSON round-trip | preserves both fields |
| Annotations | `@JsonProperty("start")` and `@JsonProperty("end")` on
the corresponding fields (verified via reflection) |
| Instance independence | no static state shared across `new` |

**Behavior pinned — `DummyProperties`**

| Surface | Contract |
| --- | --- |
| Defaults | `dummyProperty == ""` and `dummyValue == ""` |
| Mutability | both fields are `var`-assignable |
| JSON round-trip | preserves both fields (including the default-empty
round-trip) |
| Annotations | `@JsonProperty` present on both fields |
| Instance independence | no static state shared across `new` |

### Any related issues, documentation, discussions?

Closes apache#5767.

### How was this PR tested?

Pure unit-test additions; verified locally with:

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.source.SourceOperatorDescriptorSpec
org.apache.texera.amber.operator.source.PythonSourceOperatorDescriptorSpec
org.apache.texera.amber.operator.visualization.gaugeChart.GaugeChartStepsSpec
org.apache.texera.amber.operator.DummyPropertiesSpec"` — 23 tests, all
green
- `sbt scalafmtCheckAll` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.7 [1M context])
…zOp (descriptor + executor pairs) (apache#5769)

### What changes were proposed in this PR?

Pin behavior of two previously-uncovered standalone operators
(descriptor + executor pairs). No production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `SplitOpDescSpec` | `SplitOpDesc` | 8 |
| `SplitOpExecSpec` | `SplitOpExec` | 7 |
| `UrlVizOpDescSpec` | `UrlVizOpDesc` | 7 |
| `UrlVizOpExecSpec` | `UrlVizOpExec` | 6 |

All four spec files follow the `<srcClassName>Spec.scala` one-to-one
convention.

**Behavior pinned — `SplitOpDesc`**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | name `"Split"`, group `UTILITY_GROUP`, one input, two
outputs (PortIdentity 0 = training, PortIdentity 1 = testing) |
| Field defaults | `k = 80`, `random = true`, `seed = 1` |
| `getPhysicalOp` | wires
`OpExecWithClassName("…operator.split.SplitOpExec", <json>)`;
non-parallelizable; payload includes the `k` / `random` / `seed`
wire-keys |
| Schema propagation | propagates the single input schema to every
output port; throws `IllegalArgumentException` unless exactly one input
is supplied |
| Independent instances | `operatorIdentifier` (UUID-seeded) differs
across `new` |

**Behavior pinned — `SplitOpExec`**

| Surface | Contract |
| --- | --- |
| `k = 100` | every tuple emitted on PortIdentity 0 (training) |
| `k = 0` | every tuple emitted on PortIdentity 1 (testing) |
| Deterministic seed | two fresh instances with the same `(k, seed)`
produce identical port sequences over 200 tuples |
| `k = 50` (deterministic seed) | ~50% ratio over 2000 tuples (±150 band
— safely outside binomial 3σ ≈ 67) |
| `close()` | clears the `random` reference to `null` |
| `processTuple` (single-port overload) | throws `NotImplementedError` |
| Malformed descriptor JSON | construction throws
`JsonProcessingException` |

**Behavior pinned — `UrlVizOpDesc`**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | name `"URL Visualizer"`, group
`VISUALIZATION_MEDIA_GROUP` |
| `getPhysicalOp` | wires
`OpExecWithClassName("…operator.visualization.urlviz.UrlVizOpExec",
<json>)` |
| Output schema | propagation function ignores input and emits a single
`html-content` STRING attribute |
| `urlContentAttrName` annotations | `@JsonProperty(required = true)` +
`@AutofillAttributeName` + `@NotNull` (verified via reflection) |
| Class-level `@JsonSchemaInject` | restricts `urlContentAttrName` to
STRING attributes |
| Independent instances | `operatorIdentifier` (UUID-seeded) differs
across `new` |

**Behavior pinned — `UrlVizOpExec`**

| Surface | Contract |
| --- | --- |
| `processTuple` | emits a single `TupleLike` whose only value contains
the generated HTML |
| Generated HTML | `<!DOCTYPE html>` preamble; `<iframe src="…">`
interpolates the input URL; `frameborder="0"` and the `height:100vh;
width:100%; border:none` sizing style |
| Per-tuple cardinality | exactly one emission per `processTuple` call |
| Distinct URLs | interpolated into distinct outputs |
| Malformed descriptor JSON | construction throws
`JsonProcessingException` |

**Test-harness note**

`UrlVizOpDesc` declares `urlContentAttrName: val = ""`; the production
code seeds it via `objectMapper.readValue` and the
`jackson-module-no-ctor-deser` module that bypasses immutable vals. To
test the executor without touching production code, `UrlVizOpExecSpec`
builds the descriptor JSON via Jackson's tree API and injects both the
`operatorType` discriminator (`"URLVisualizer"`, per `LogicalOp`'s
`@JsonSubTypes` table) and the `urlContentAttrName` field.

### Any related issues, documentation, discussions?

Closes apache#5766.

### How was this PR tested?

Pure unit-test additions; verified locally with:

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.split.SplitOpDescSpec
org.apache.texera.amber.operator.split.SplitOpExecSpec
org.apache.texera.amber.operator.visualization.urlviz.UrlVizOpDescSpec
org.apache.texera.amber.operator.visualization.urlviz.UrlVizOpExecSpec"`
— 30 tests, all green
- `sbt scalafmtCheckAll` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.7 [1M context])
…#4962)

Bumps [ajv](https://github.com/ajv-validator/ajv) from 8.10.0 to 8.18.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ajv-validator/ajv/releases">ajv's
releases</a>.</em></p>
<blockquote>
<h2>v8.18.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: allow tree-shaking by adding <code>&quot;sideEffects&quot;:
false</code> to <code>package.json</code> by <a
href="https://github.com/josdejong"><code>@​josdejong</code></a> in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2480">ajv-validator/ajv#2480</a></li>
<li>fix: <a
href="https://redirect.github.com/ajv-validator/ajv/issues/2482">#2482</a>
Infinity and NaN serialise to null by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2487">ajv-validator/ajv#2487</a></li>
<li>fix: small grammatical error in managing-schemas.md by <a
href="https://github.com/monteiro-renato"><code>@​monteiro-renato</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2508">ajv-validator/ajv#2508</a></li>
<li>fix: typos in schema-language.md by <a
href="https://github.com/monteiro-renato"><code>@​monteiro-renato</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2507">ajv-validator/ajv#2507</a></li>
<li>fix(pattern): use configured RegExp engine with $data keyword to
mitigate ReDoS attacks (CVE-2025-69873) by <a
href="https://github.com/epoberezkin"><code>@​epoberezkin</code></a> in
<a
href="https://redirect.github.com/ajv-validator/ajv/pull/2586">ajv-validator/ajv#2586</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/josdejong"><code>@​josdejong</code></a>
made their first contribution in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2480">ajv-validator/ajv#2480</a></li>
<li><a
href="https://github.com/monteiro-renato"><code>@​monteiro-renato</code></a>
made their first contribution in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2508">ajv-validator/ajv#2508</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0">https://github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0</a></p>
<h2>v8.17.1</h2>
<h2>What's Changed</h2>
<ul>
<li>bump version to 8.17.1 by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2472">ajv-validator/ajv#2472</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ajv-validator/ajv/compare/v8.17.0...v8.17.1">https://github.com/ajv-validator/ajv/compare/v8.17.0...v8.17.1</a></p>
<h2>Plus everything in 8.17.0 which failed to release</h2>
<p>The only functional change is to switch from uri-js (which is no
longer supported), to fast-uri. This is the second attempt and the team
on fast-uri have been really helpful addressing the issues we found last
time.</p>
<p>Revert &quot;Revert fast-uri change (<a
href="https://redirect.github.com/ajv-validator/ajv/pull/2444">ajv-validator/ajv#2444</a>)&quot;
by <a href="https://github.com/gurgunday"><code>@​gurgunday</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2448">ajv-validator/ajv#2448</a>
fix: ignore new eslint error for
<code>@​typescript-eslint/no-extraneous-class</code> by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2455">ajv-validator/ajv#2455</a>
docs: clarify behaviour of addVocabulary by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2454">ajv-validator/ajv#2454</a>
docs: refactor to improve legibility by <a
href="https://github.com/blottn"><code>@​blottn</code></a> in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2432">ajv-validator/ajv#2432</a>
Fix grammatical typo in managing-schemas.md by <a
href="https://github.com/wetneb"><code>@​wetneb</code></a> in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2305">ajv-validator/ajv#2305</a>
docs: Fix broken strict-mode link by <a
href="https://github.com/alexanderjsx"><code>@​alexanderjsx</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2459">ajv-validator/ajv#2459</a>
feat: add test for encoded refs and bump fast-uri by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2449">ajv-validator/ajv#2449</a>
fix: changes for <code>@​typescript-eslint/array-type</code> rule by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2467">ajv-validator/ajv#2467</a>
fixes <a
href="https://redirect.github.com/ajv-validator/ajv/issues/2217">ajv-validator/ajv#2217</a>
- clarify custom keyword naming by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2457">ajv-validator/ajv#2457</a></p>
<h2>v8.17.0</h2>
<h2>What's Changed</h2>
<p>The only functional change is to switch from uri-js (which is no
longer supported), to fast-uri. This is the second attempt and the team
on fast-uri have been really helpful addressing the issues we found last
time.</p>
<ul>
<li>Revert &quot;Revert fast-uri change (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2444">#2444</a>)&quot;
by <a href="https://github.com/gurgunday"><code>@​gurgunday</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2448">ajv-validator/ajv#2448</a></li>
<li>fix: ignore new eslint error for
<code>@​typescript-eslint/no-extraneous-class</code> by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2455">ajv-validator/ajv#2455</a></li>
<li>docs: clarify behaviour of addVocabulary by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2454">ajv-validator/ajv#2454</a></li>
<li>docs: refactor to improve legibility by <a
href="https://github.com/blottn"><code>@​blottn</code></a> in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2432">ajv-validator/ajv#2432</a></li>
<li>Fix grammatical typo in managing-schemas.md by <a
href="https://github.com/wetneb"><code>@​wetneb</code></a> in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2305">ajv-validator/ajv#2305</a></li>
<li>docs: Fix broken strict-mode link by <a
href="https://github.com/alexanderjsx"><code>@​alexanderjsx</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2459">ajv-validator/ajv#2459</a></li>
<li>feat: add test for encoded refs and bump fast-uri by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2449">ajv-validator/ajv#2449</a></li>
<li>fix: changes for <code>@​typescript-eslint/array-type</code> rule by
<a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2467">ajv-validator/ajv#2467</a></li>
<li>fixes <a
href="https://redirect.github.com/ajv-validator/ajv/issues/2217">#2217</a>
- clarify custom keyword naming by <a
href="https://github.com/jasoniangreen"><code>@​jasoniangreen</code></a>
in <a
href="https://redirect.github.com/ajv-validator/ajv/pull/2457">ajv-validator/ajv#2457</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ajv-validator/ajv/commit/142ce84b807c4fe66e619c22480a28d0e4bd50fa"><code>142ce84</code></a>
8.18.0</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5"><code>720a23f</code></a>
fix(pattern): use configured RegExp engine with $data keyword to
mitigate ReD...</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/82735a15826a30cc51e97a1bbfb59b3d388e4b98"><code>82735a1</code></a>
fix: typos in schema-language.md (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2507">#2507</a>)</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/b17ec32cd97542e90ae27231d8a8bce88b9e53b6"><code>b17ec32</code></a>
fix: small grammatical error in managing-schemas.md (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2508">#2508</a>)</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/69568d08564303e2c32a2de61feb833b41075f96"><code>69568d0</code></a>
fix: <a
href="https://redirect.github.com/ajv-validator/ajv/issues/2482">#2482</a>
Infinity and NaN serialise to null (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2487">#2487</a>)</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/f06766f33ed7291f84c19f22a1286a34475fbdaf"><code>f06766f</code></a>
feat: allow tree-shaking by adding ``&quot;sideEffects&quot;:
false<code>to</code>package.json` ...</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/9050ba1359fb87cd7c143f3c79513ea7624ea443"><code>9050ba1</code></a>
bump version to 8.17.1 (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2472">#2472</a>)</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/f7831b41c3a27064c6219f51a1e7371ffb582dfe"><code>f7831b4</code></a>
fixes <a
href="https://redirect.github.com/ajv-validator/ajv/issues/2217">#2217</a>
- clarify custom keyword naming (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2457">#2457</a>)</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/a523784388a79ce65e42caf4d2731da36a94b386"><code>a523784</code></a>
fix: changes for <code>@​typescript-eslint/array-type</code> rule (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2467">#2467</a>)</li>
<li><a
href="https://github.com/ajv-validator/ajv/commit/595fe58e64e8d5fb8a50fd7a58f9e7f3bcca0bac"><code>595fe58</code></a>
feat: add test for encoded refs and bump fast-uri (<a
href="https://redirect.github.com/ajv-validator/ajv/issues/2449">#2449</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ajv-validator/ajv/compare/v8.10.0...v8.18.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ajv&package-manager=npm_and_yarn&previous-version=8.10.0&new-version=8.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…che#4961)

Bumps [elysia](https://github.com/elysiajs/elysia) from 1.4.18 to
1.4.27.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/elysiajs/elysia/releases">elysia's
releases</a>.</em></p>
<blockquote>
<h2>1.4.27</h2>
<h2>What's changed</h2>
<p>Bug fix:</p>
<ul>
<li>getSchemaValidator: handle TypeBox as sub type</li>
<li>handle cookie prototype pollution when parsing cookie</li>
</ul>
<p>Improvement:</p>
<ul>
<li>conditional async on getSchemaValidator when schema is Standard
Schema</li>
<li>use Response.json on Bun</li>
<li>export <code>AnySchema</code>, <code>UnwrapSchema</code>,
<code>ModelsToTypes</code> from root</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elysiajs/elysia/compare/1.4.26...1.4.27">https://github.com/elysiajs/elysia/compare/1.4.26...1.4.27</a></p>
<h2>1.4.26</h2>
<h2>What's changed</h2>
<p>Bug fix:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1755">#1755</a>
deduplicate local handler from global event</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a>
system router with trailing path doesn't match with non-trailing</li>
<li>url format redos</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1747">#1747</a>
parsing request from mount hang</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elysiajs/elysia/compare/1.4.25...1.4.26">https://github.com/elysiajs/elysia/compare/1.4.25...1.4.26</a></p>
<h2>1.4.25</h2>
<h2>What's changed</h2>
<p>Feature:</p>
<ul>
<li>export ElysiaStatus</li>
</ul>
<p>Bug fix:</p>
<ul>
<li>macro with conflict literal value per status</li>
<li>recursive macro with conflict value per status</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elysiajs/elysia/compare/1.4.24...1.4.25">https://github.com/elysiajs/elysia/compare/1.4.24...1.4.25</a></p>
<h2>1.4.24</h2>
<h2>What's Changed</h2>
<p>Feature:</p>
<ul>
<li>graceful unsigned cookie transition</li>
</ul>
<p>Bug fix:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1733">#1733</a>
preserve multiple set-cookie headers in mounted handlers by <a
href="https://github.com/cipher416"><code>@​cipher416</code></a></li>
<li>object cookie with secret doesn't deserialized after parsed</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/cipher416"><code>@​cipher416</code></a>
made their first contribution in <a
href="https://redirect.github.com/elysiajs/elysia/pull/1733">elysiajs/elysia#1733</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elysiajs/elysia/compare/1.4.23...1.4.24">https://github.com/elysiajs/elysia/compare/1.4.23...1.4.24</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md">elysia's
changelog</a>.</em></p>
<blockquote>
<h1>1.4.27 - 1 Mar 2026</h1>
<p>Bug fix:</p>
<ul>
<li>getSchemaValidator: handle TypeBox as sub type</li>
<li>handle cookie prototype pollution when parsing cookie</li>
</ul>
<p>Improvement:</p>
<ul>
<li>conditional async on getSchemaValidator when schema is Standard
Schema</li>
<li>use Response.json on Bun</li>
</ul>
<h1>1.4.26 - 25 Feb 2026</h1>
<p>Bug fix:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1755">#1755</a>
deduplicate local handler from global event</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a>
system router with trailing path doesn't match with non-trailing</li>
<li>url format redos</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1747">#1747</a>
parsing request from mount hang</li>
</ul>
<h1>1.4.25 - 12 Feb 2026</h1>
<p>Feature:</p>
<ul>
<li>export ElysiaStatus</li>
</ul>
<p>Bug fix:</p>
<ul>
<li>macro with conflict literal value per status</li>
<li>recursive macro with conflict value per status</li>
</ul>
<h1>1.4.24 - 11 Feb 2026</h1>
<p>Feature:</p>
<ul>
<li>graceful unsigned cookie transition</li>
</ul>
<p>Bug fix:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1733">#1733</a>
preserve multiple set-cookie headers in mounted handlers</li>
<li>object cookie with secret doesn't deserialized after parsed</li>
</ul>
<h1>1.4.23 - 9 Feb 2026</h1>
<p>Feature:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1719">#1719</a>
add t.Union/t.Intersection handling in property enumerations/checks</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1697">#1697</a>
extend complex formdata support to StandardSchema</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1675">#1656</a>
serialize custom array-like custom class with array sub class</li>
</ul>
<p>Bug fix:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1721">#1721</a>
Promise<!-- raw HTML omitted --> with response schema</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1700">#1700</a>
distinct union object</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1683">#1683</a>
response validation returns 500 instead of 422 for nested schemas in
dynamic mode</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1679">#1679</a>
preserve headers when throwing from AsyncGenerator</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1595">#1595</a>
stream reference should point to teed value</li>
<li>fix can't modify immutable headers error</li>
</ul>
<p>Change:</p>
<ul>
<li>update exact-mirror to 0.2.7</li>
</ul>
<h1>1.4.22 - 14 Jan 2026</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/elysiajs/elysia/commit/cc9159b5c60a8eb16bbac4525005e2b5880d3624"><code>cc9159b</code></a>
:tada: feat: 1.4.27</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab"><code>e9d6b17</code></a>
:tada: feat: 1.4.27</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/21dce4c9b84c3151490a9c8c4ef851f1dc676a3f"><code>21dce4c</code></a>
:tada: feat: use Response.json on Bun</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/6b44646f5cb5ae61bb3f2a7bcf269cd90971f4e3"><code>6b44646</code></a>
:wrench: fix(getSchemaValidator): handle TypeBox as sub type</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/bbaf6b7f729b858a7435bf28b97119112177479e"><code>bbaf6b7</code></a>
:tada: feat: 1.4.26</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/e596dab627d54dd194511532faf20d59e2e92f96"><code>e596dab</code></a>
:wrench: fix: <a
href="https://redirect.github.com/elysiajs/elysia/issues/1747">#1747</a>
parsing request from mount hang</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/6561d614f7f2462a2fe162b99f78a6af58e85565"><code>6561d61</code></a>
:wrench: fix: <a
href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a>
system router with trailing path doesn't match with non-t...</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/3c9dabc47409c2f104e2a954a459c72aa94e38f5"><code>3c9dabc</code></a>
:wrench: fix: <a
href="https://redirect.github.com/elysiajs/elysia/issues/1752">#1752</a>
system router with trailing path doesn't match with non-t...</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/d17a7aa204b5feea65d6d8f7651fb7141fb322bd"><code>d17a7aa</code></a>
:wrench: fix: <a
href="https://redirect.github.com/elysiajs/elysia/issues/1755">#1755</a>
deduplicate local handler from global event</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/e5c9449d4c10dbddd01dda726a80a0b8dc16d68c"><code>e5c9449</code></a>
:wrench: fix: recursive macro with conflict value per status</li>
<li>Additional commits viewable in <a
href="https://github.com/elysiajs/elysia/compare/1.4.18...1.4.27">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for elysia since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=elysia&package-manager=npm_and_yarn&previous-version=1.4.18&new-version=1.4.27)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.13 to 7.5.16.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-tar/commit/cf213384ac558b539c07c830ed7cca5ffc9e8550"><code>cf21338</code></a>
7.5.16</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/21a822027658c8063542be330530bbecdf0dbbfe"><code>21a8220</code></a>
do not apply PAX header fields to meta entries</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/52632cf38fdbdbbc7ab86184d68a85b11fdb0970"><code>52632cf</code></a>
update project deps</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/302f51ff3f8eefeccc06be4caf7d0de9b7c321d7"><code>302f51f</code></a>
fix inconsequential typo in PENDINGLINKS symbol name</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/55dbb99b27640bb12b2ac059b26883c23523b3e3"><code>55dbb99</code></a>
remove some uses of mutate-fs</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/87cc309f13c21d598b0b833235d387a252455058"><code>87cc309</code></a>
7.5.15</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/7aef486f0d21c10fd7790b16b1b28f04648cf334"><code>7aef486</code></a>
fix: regression in pending links detection</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/6244eb33846bbd407443f5d0e339bd8c91663cd6"><code>6244eb3</code></a>
7.5.14</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/9704d8c6f639573775133cbbd541aba83cb46c9c"><code>9704d8c</code></a>
stricter protection against hardlinks preempting their targets</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/700734f9aeb113bcc5f1400d81b8be7d499e54a2"><code>700734f</code></a>
update workflows and deps</li>
<li>See full diff in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.13...v7.5.16">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.13&new-version=7.5.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps torch from 2.8.0 to 2.12.0+cpu.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=torch&package-manager=pip&previous-version=2.8.0&new-version=2.12.0+cpu)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…pache#5811)

Bumps [launch-editor](https://github.com/vitejs/launch-editor) from
2.13.2 to 2.14.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/launch-editor/commit/3f97c648307a70e7c930ba63f040e6ba8e72bc16"><code>3f97c64</code></a>
v2.14.1</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/0cc9550e05c35224a1f61914b9731723f78c06a7"><code>0cc9550</code></a>
fix: reject UNC paths (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/138">#138</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/afd1ab907769adbb0fb76b564551f3cd24822ea6"><code>afd1ab9</code></a>
ci: run tests on mac and windows (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/136">#136</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/0bfa328e4d2a70d3accd86645efde43a5a8fd931"><code>0bfa328</code></a>
test: add some tests for launch-editor package (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/135">#135</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/1b006ae00061e83628c884770df4869bac481ed3"><code>1b006ae</code></a>
chore: add README (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/134">#134</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/383ef26fceaaab75e4f122bf833a8d457e187272"><code>383ef26</code></a>
v2.14.0</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/6277209316b28bd76b057a97fcdfa42da5adc181"><code>6277209</code></a>
ci: harden publish settings</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/520b2f787af1bbe3d2333d952547fc90f2c01bb3"><code>520b2f7</code></a>
fix(deps): update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/129">#129</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/475ac662aeaa40eebe319f76acf7bd7ff2aba5d5"><code>475ac66</code></a>
chore(deps): update dependency lint-staged to v17 (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/130">#130</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/247bf1dfe2c75efb50f507d33c2c5a3cbf4e20d0"><code>247bf1d</code></a>
chore(deps): update dependency yorkie to v2 (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/131">#131</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/launch-editor/compare/v2.13.2...v2.14.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for launch-editor since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=launch-editor&package-manager=npm_and_yarn&previous-version=2.13.2&new-version=2.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's
changelog</a>.</em></p>
<blockquote>
<h2>[4.2.0] - 2026-06-01</h2>
<h3>Added</h3>
<ul>
<li>Added <code>docs/safety.md</code> with notes about processing
untrusted YAML.</li>
<li>Added <code>maxDepth</code> (100) loader option. Not a problem, but
gives a better
exception instead of RangeError on stack overflow.</li>
<li>Added <code>maxMergeSeqLength</code> (20) loader option. Not a
problem after <code>merge</code> fix,
but an additional restriction for safety.</li>
<li>Added sourcemaps to <code>dist/</code> builds.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Stop resolving numbers with underscores as numeric scalars, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/627">#627</a>.</li>
<li>Switched dev toolchains to Vite / neostandard.</li>
<li>Updated demo.</li>
<li>Reorganized tests.</li>
<li><code>dist/</code> files are no longer kept in the repository.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix parsing of properties on the first implicit block mapping key,
<a
href="https://redirect.github.com/nodeca/js-yaml/issues/62">#62</a>.</li>
<li>Fix trailing whitespace handling when folding flow scalar lines, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Reject top-level block scalars without content indentation, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/280">#280</a>.</li>
<li>Ensure numbers survive round-trip, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/737">#737</a>.</li>
<li>Fix test coverage for issue <a
href="https://redirect.github.com/nodeca/js-yaml/issues/221">#221</a>.</li>
<li>Fix flow scalar trailing whitespace folding, <a
href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Fix digits in YAML named tag handles.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Fix potential DoS via quadratic complexity in merge - deduplicate
repeated
elements (makes sense for malformed files &gt; 10K).</li>
</ul>
<h2>[3.14.2] - 2025-11-15</h2>
<h3>Security</h3>
<ul>
<li>Backported v4.1.1 fix to v3</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/nodeca/js-yaml/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=js-yaml&package-manager=npm_and_yarn&previous-version=4.1.1&new-version=4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [pyarrow](https://github.com/apache/arrow) from 21.0.0 to 23.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/apache/arrow/releases">pyarrow's
releases</a>.</em></p>
<blockquote>
<h2>Apache Arrow 23.0.1</h2>
<p>Release Notes URL: <a
href="https://arrow.apache.org/release/23.0.1.html">https://arrow.apache.org/release/23.0.1.html</a></p>
<h2>Apache Arrow 23.0.1 RC0</h2>
<p>Release Notes: Release Candidate: 23.0.1 RC0</p>
<h2>Apache Arrow 23.0.0</h2>
<p>Release Notes URL: <a
href="https://arrow.apache.org/release/23.0.0.html">https://arrow.apache.org/release/23.0.0.html</a></p>
<h2>Apache Arrow 23.0.0 RC2</h2>
<p>Release Notes: Release Candidate: 23.0.0 RC2</p>
<h2>Apache Arrow 22.0.0</h2>
<p>Release Notes URL: <a
href="https://arrow.apache.org/release/22.0.0.html">https://arrow.apache.org/release/22.0.0.html</a></p>
<h2>Apache Arrow 22.0.0 RC1</h2>
<p>Release Notes: Release Candidate: 22.0.0 RC1</p>
<h2>Apache Arrow 22.0.0 RC0</h2>
<p>Release Notes: Release Candidate: 22.0.0 RC0</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9"><code>82a374e</code></a>
MINOR: [Release] Update versions for 23.0.1</li>
<li><a
href="https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5"><code>c1ae37c</code></a>
MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1</li>
<li><a
href="https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111"><code>8f6e557</code></a>
MINOR: [Release] Update CHANGELOG.md for 23.0.1</li>
<li><a
href="https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980"><code>4e16a1a</code></a>
<a
href="https://redirect.github.com/apache/arrow/issues/49159">GH-49159</a>:
[C++][Gandiva] Detect overflow in repeat() (<a
href="https://redirect.github.com/apache/arrow/issues/49160">#49160</a>)</li>
<li><a
href="https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f"><code>985621d</code></a>
<a
href="https://redirect.github.com/apache/arrow/issues/48817">GH-48817</a>
[R][C++] Bump C++20 in R build infrastructure (<a
href="https://redirect.github.com/apache/arrow/issues/48819">#48819</a>)</li>
<li><a
href="https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc"><code>1bea06a</code></a>
<a
href="https://redirect.github.com/apache/arrow/issues/49024">GH-49024</a>:
[CI] Update Debian version in <code>.env</code> (<a
href="https://redirect.github.com/apache/arrow/issues/49032">#49032</a>)</li>
<li><a
href="https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334"><code>147bcd6</code></a>
<a
href="https://redirect.github.com/apache/arrow/issues/49156">GH-49156</a>:
[Python] Require GIL for string comparison (<a
href="https://redirect.github.com/apache/arrow/issues/49161">#49161</a>)</li>
<li><a
href="https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483"><code>e4f922b</code></a>
<a
href="https://redirect.github.com/apache/arrow/issues/49138">GH-49138</a>:
[Packaging][Python] Remove nightly cython install from manylinux
wh...</li>
<li><a
href="https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30"><code>f9376e4</code></a>
<a
href="https://redirect.github.com/apache/arrow/issues/49003">GH-49003</a>:
[C++] Don't consider <code>out_of_range</code> an error in float parsing
(<a
href="https://redirect.github.com/apache/arrow/issues/49095">#49095</a>)</li>
<li><a
href="https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4"><code>ab2c0ad</code></a>
<a
href="https://redirect.github.com/apache/arrow/issues/49044">GH-49044</a>:
[CI][Python] Fix test_download_tzdata_on_windows by adding
required...</li>
<li>Additional commits viewable in <a
href="https://github.com/apache/arrow/compare/apache-arrow-21.0.0...apache-arrow-23.0.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyarrow&package-manager=pip&previous-version=21.0.0&new-version=23.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Xinyuan Lin <xinyual3@uci.edu>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.0 to
9.0.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pytest-dev/pytest/releases">pytest's
releases</a>.</em></p>
<blockquote>
<h2>9.0.3</h2>
<h1>pytest 9.0.3 (2026-04-07)</h1>
<h2>Bug fixes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/12444">#12444</a>:
Fixed <code>pytest.approx</code> which now correctly takes into account
<code>~collections.abc.Mapping</code> keys order to compare them.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13634">#13634</a>:
Blocking a <code>conftest.py</code> file using the <code>-p no:</code>
option is now explicitly disallowed.</p>
<p>Previously this resulted in an internal assertion failure during
plugin loading.</p>
<p>Pytest now raises a clear <code>UsageError</code> explaining that
conftest files are not plugins and cannot be disabled via
<code>-p</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13734">#13734</a>:
Fixed crash when a test raises an exceptiongroup with
<code>__tracebackhide__ = True</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14195">#14195</a>:
Fixed an issue where non-string messages passed to <!-- raw HTML omitted
-->unittest.TestCase.subTest()<!-- raw HTML omitted --> were not
printed.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14343">#14343</a>:
Fixed use of insecure temporary directory (CVE-2025-71176).</p>
</li>
</ul>
<h2>Improved documentation</h2>
<ul>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13388">#13388</a>:
Clarified documentation for <code>-p</code> vs
<code>PYTEST_PLUGINS</code> plugin loading and fixed an incorrect
<code>-p</code> example.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13731">#13731</a>:
Clarified that capture fixtures (e.g. <code>capsys</code> and
<code>capfd</code>) take precedence over the <code>-s</code> /
<code>--capture=no</code> command-line options in <code>Accessing
captured output from a test function
&lt;accessing-captured-output&gt;</code>.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14088">#14088</a>:
Clarified that the default <code>pytest_collection</code> hook sets
<code>session.items</code> before it calls
<code>pytest_collection_finish</code>, not after.</li>
<li><a
href="https://redirect.github.com/pytest-dev/pytest/issues/14255">#14255</a>:
TOML integer log levels must be quoted: Updating reference
documentation.</li>
</ul>
<h2>Contributor-facing changes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/12689">#12689</a>:
The test reports are now published to Codecov from GitHub Actions.
The test statistics is visible <a
href="https://app.codecov.io/gh/pytest-dev/pytest/tests">on the web
interface</a>.</p>
<p>-- by <code>aleguy02</code></p>
</li>
</ul>
<h2>9.0.2</h2>
<h1>pytest 9.0.2 (2025-12-06)</h1>
<h2>Bug fixes</h2>
<ul>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13896">#13896</a>:
The terminal progress feature added in pytest 9.0.0 has been disabled by
default, except on Windows, due to compatibility issues with some
terminal emulators.</p>
<p>You may enable it again by passing <code>-p terminalprogress</code>.
We may enable it by default again once compatibility improves in the
future.</p>
<p>Additionally, when the environment variable <code>TERM</code> is
<code>dumb</code>, the escape codes are no longer emitted, even if the
plugin is enabled.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13904">#13904</a>:
Fixed the TOML type of the <code>tmp_path_retention_count</code>
settings in the API reference from number to string.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pytest-dev/pytest/issues/13946">#13946</a>:
The private <code>config.inicfg</code> attribute was changed in a
breaking manner in pytest 9.0.0.
Due to its usage in the ecosystem, it is now restored to working order
using a compatibility shim.
It will be deprecated in pytest 9.1 and removed in pytest 10.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pytest-dev/pytest/commit/a7d58d7a21b78581e636bbbdea13c66ad1657c1e"><code>a7d58d7</code></a>
Prepare release version 9.0.3</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/089d98199c253d8f89a040243bc4f2aa6cd5ab22"><code>089d981</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14366">#14366</a>
from bluetech/revert-14193-backport</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/8127eaf4ab7f6b2fdd0dc1b38343ec97aeef05ac"><code>8127eaf</code></a>
Revert &quot;Fix: assertrepr_compare respects dict insertion order (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14050">#14050</a>)
(<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14193">#14193</a>)&quot;</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/99a7e6029e7a6e8d53e5df114b1346e035370241"><code>99a7e60</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14363">#14363</a>
from pytest-dev/patchback/backports/9.0.x/95d8423bd...</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/ddee02a578da30dd43aedc39c1c1f1aaadfcee95"><code>ddee02a</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14343">#14343</a>
from bluetech/cve-2025-71176-simple</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/74eac6916fee34726cb194f16c516e96fbd29619"><code>74eac69</code></a>
doc: Update training info (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14298">#14298</a>)
(<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14301">#14301</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/f92dee777cfdb77d1c43633d02766ddf1f07c869"><code>f92dee7</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14267">#14267</a>
from pytest-dev/patchback/backports/9.0.x/d6fa26c62...</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/7ee58acc8777c31ac6cf388d01addf5a414a7439"><code>7ee58ac</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/12378">#12378</a>
from Pierre-Sassoulas/fix-implicit-str-concat-and-d...</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/37da870d37e3a2f5177cae075c7b9ae279432bf8"><code>37da870</code></a>
Merge pull request <a
href="https://redirect.github.com/pytest-dev/pytest/issues/14259">#14259</a>
from mitre88/patch-4 (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14268">#14268</a>)</li>
<li><a
href="https://github.com/pytest-dev/pytest/commit/c34bfa3b7acb65b594707c714f1d8461b0304eed"><code>c34bfa3</code></a>
Add explanation for string context diffs (<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14257">#14257</a>)
(<a
href="https://redirect.github.com/pytest-dev/pytest/issues/14266">#14266</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pytest-dev/pytest/compare/7.4.0...9.0.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pytest&package-manager=pip&previous-version=7.4.0&new-version=9.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…che#5820)

Bumps [elysia](https://github.com/elysiajs/elysia) from 1.4.27 to
1.4.29.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/elysiajs/elysia/releases">elysia's
releases</a>.</em></p>
<blockquote>
<h2>1.4.29</h2>
<h2>What's changed</h2>
<p>Improvement:</p>
<ul>
<li>normalize a multipart/form-data with .get instead of .getAll for
faster performance</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elysiajs/elysia/compare/1.4.28...1.4.29">https://github.com/elysiajs/elysia/compare/1.4.28...1.4.29</a></p>
<h2>1.4.28</h2>
<h2>What's new</h2>
<p>Feature:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1803">#1803</a>
stream response with pull based backpressure</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1802">#1802</a>
handle range header for file/blob response</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1772">#1722</a>,
<a
href="https://redirect.github.com/elysiajs/elysia/issues/1741">#1741</a>
direct ReadableStream perf blow-up</li>
</ul>
<p>Bug fix:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1805">#1805</a>
dynamic imports inside .guard not registering routes</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1771">#1771</a>
breaks Bun HTML imports</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1797">#1797</a>
await mapped error response promise</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1794">#1794</a>
merge app cookie config into route cookie validator config</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1796">#1796</a>
check custom parser by full name</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1795">#1795</a>
write transformed cookie value to cookie entry directly</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1793">#1793</a>
use cookie schema for cookie noValidate check</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1792">#1792</a>
throw ValidationError instead of boolean in response encode path</li>
<li>detect HTML bundle when inline response is Promise</li>
</ul>
<p>Change:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1613">#1613</a>
export <code>ElysiaTypeCustomErrors</code></li>
<li>remove Bun specific built</li>
<li>export <code>AnySchema</code>, <code>UnwrapSchema</code>,
<code>ModelsToTypes</code> from root</li>
<li>conditional set headers of String and Object when no set.headers is
set</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/MegaManSec"><code>@​MegaManSec</code></a> made
their first contribution in <a
href="https://redirect.github.com/elysiajs/elysia/pull/1797">elysiajs/elysia#1797</a></li>
<li><a href="https://github.com/ap0nia"><code>@​ap0nia</code></a> made
their first contribution in <a
href="https://redirect.github.com/elysiajs/elysia/pull/1613">elysiajs/elysia#1613</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/elysiajs/elysia/compare/1.4.27...1.4.28">https://github.com/elysiajs/elysia/compare/1.4.27...1.4.28</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md">elysia's
changelog</a>.</em></p>
<blockquote>
<h1>1.4.29 - 17 Jun 2026</h1>
<p>Bug fix:</p>
<ul>
<li>normalize a <code>multipart/form-data</code> with <code>.get</code>
instead of <code>.getAll</code> for faster performance</li>
</ul>
<h1>1.4.28 - 17 Mar 2025</h1>
<p>Feature:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1803">#1803</a>
stream response with pull based backpressure</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1802">#1802</a>
handle range header for file/blob response</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1772">#1722</a>,
<a
href="https://redirect.github.com/elysiajs/elysia/issues/1741">#1741</a>
direct ReadableStream perf blow-up</li>
</ul>
<p>Bug fix:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1805">#1805</a>
dynamic imports inside .guard not registering routes</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/issues/1771">#1771</a>
breaks Bun HTML imports</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1797">#1797</a>
await mapped error response promise</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1794">#1794</a>
merge app cookie config into route cookie validator config</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1796">#1796</a>
check custom parser by full name</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1795">#1795</a>
write transformed cookie value to cookie entry directly</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1793">#1793</a>
use cookie schema for cookie noValidate check</li>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1792">#1792</a>
throw ValidationError instead of boolean in response encode path</li>
<li>detect HTML bundle when inline response is Promise</li>
</ul>
<p>Change:</p>
<ul>
<li><a
href="https://redirect.github.com/elysiajs/elysia/pull/1613">#1613</a>
export <code>ElysiaTypeCustomErrors</code></li>
<li>remove Bun specific built</li>
<li>export <code>AnySchema</code>, <code>UnwrapSchema</code>,
<code>ModelsToTypes</code> from root</li>
<li>conditional set headers of String and Object when no set.headers is
set</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/elysiajs/elysia/commit/8358ff9efbcedf9534995f5977f26b9ceab59329"><code>8358ff9</code></a>
normalize formdata with get instead of getAll</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/56310be9617b826f862c985eae95ae823d95f097"><code>56310be</code></a>
:blue_book: doc: document changelog</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/708f8c6fdb618617c40d2c02eb31ca8d2227b8b9"><code>708f8c6</code></a>
:blue_book: doc: document changelog</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/7acc183b5938e336399d825d1418e5b4e19859e8"><code>7acc183</code></a>
Merge pull request <a
href="https://redirect.github.com/elysiajs/elysia/issues/1613">#1613</a>
from ap0nia/feat/extend-errors</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/c00b9e38b6efe75437155cdfe0a19aad3900c9ef"><code>c00b9e3</code></a>
Merge branch 'main' of <a
href="https://github.com/elysiajs/elysia">https://github.com/elysiajs/elysia</a></li>
<li><a
href="https://github.com/elysiajs/elysia/commit/ccbd9e48ae359c8052803a8ffc5f466bacaef4de"><code>ccbd9e4</code></a>
:blue_book: fix: <a
href="https://redirect.github.com/elysiajs/elysia/issues/1772">#1772</a>
resolve merge conflict</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/01340b72a4c9134927a6af499e79a6eaf41ad3c0"><code>01340b7</code></a>
Merge pull request <a
href="https://redirect.github.com/elysiajs/elysia/issues/1792">#1792</a>
from MegaManSec/j1</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/0956af9572e9ff7aa3bb3b53e4140bfd950e83ca"><code>0956af9</code></a>
Merge pull request <a
href="https://redirect.github.com/elysiajs/elysia/issues/1793">#1793</a>
from MegaManSec/j2</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/b48ade6ca35f9fe28e4ed31872b065d818db11d6"><code>b48ade6</code></a>
:blue_book: doc: update changelog</li>
<li><a
href="https://github.com/elysiajs/elysia/commit/b32931459fcdf0d657041b10ad12a9d404b37dee"><code>b329314</code></a>
Merge branch 'main' of <a
href="https://github.com/elysiajs/elysia">https://github.com/elysiajs/elysia</a></li>
<li>Additional commits viewable in <a
href="https://github.com/elysiajs/elysia/compare/1.4.27...1.4.29">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=elysia&package-manager=bun&previous-version=1.4.27&new-version=1.4.29)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
)

Bumps [hono](https://github.com/honojs/hono) from 4.12.15 to 4.12.26.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.26</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(lambda-edge): satisfy Deno lib types for Content-Length body
encoding by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5013">honojs/hono#5013</a></li>
<li>ci: publish to npm from CI with OIDC trusted publishing by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5028">honojs/hono#5028</a></li>
<li>chore: remove unused devcontainer and gitpod configs by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5029">honojs/hono#5029</a></li>
<li>chore: replace arg and glob with Bun native APIs in build script by
<a href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5030">honojs/hono#5030</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26">https://github.com/honojs/hono/compare/v4.12.25...v4.12.26</a></p>
<h2>v4.12.25</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>CORS Middleware reflects any Origin with credentials when
<code>origin</code> defaults to the wildcard</h3>
<p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting
the request <code>Origin</code> and sending
<code>Access-Control-Allow-Credentials: true</code> when
<code>credentials: true</code> is set without an explicit
<code>origin</code>, where any site a logged-in user visited could make
credentialed cross-origin requests and read responses from
cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p>
<h3>Body Limit Middleware can be bypassed on AWS Lambda by understating
<code>Content-Length</code></h3>
<p>Affects: <code>hono/body-limit</code> on AWS Lambda
(<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the
request being built with the client-declared <code>Content-Length</code>
while the body is delivered fully buffered, where a client could declare
a small <code>Content-Length</code> with a much larger body and slip
past the configured size limit. GHSA-rv63-4mwf-qqc2</p>
<h3>Path traversal in <code>serve-static</code> on Windows via encoded
backslash (<code>%5C</code>)</h3>
<p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno
adapters). Fixes the path guard allowing a lone backslash, where an
encoded backslash (<code>%5C</code>) decoded to <code>\</code> was
treated as a separator by the Windows path resolver, letting a single
URL segment escape into a middleware-guarded subtree.
GHSA-wwfh-h76j-fc44</p>
<h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers
into one value, dropping cookies on ALB single-header and Lattice</h3>
<p>Affects: <code>hono/aws-lambda</code>. Fixes multiple
<code>Set-Cookie</code> response headers being joined into one
comma-separated value for ALB single-header responses and VPC Lattice
v2, where the value could not be split back into individual cookies and
clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p>
<h3>Lambda@Edge adapter keeps only the last value of a repeated request
header, dropping the rest</h3>
<p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request
headers being written with overwrite instead of append, where only the
last value of a header such as <code>X-Forwarded-For</code> reached the
application and the remaining values were silently dropped.
GHSA-wgpf-jwqj-8h8p</p>
<h2>v4.12.24</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contribution): simplifyAI Usage Policy by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li>
<li>chore: remove <code>@​types/glob</code> by <a
href="https://github.com/rtritto"><code>@​rtritto</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li>
<li>fix(bearer-auth): mention verifyToken in missing-options error
message by <a
href="https://github.com/tan7vir"><code>@​tan7vir</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li>
<li>refactor(language): Test/improve tests on languages middleware by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li>
<li>fix(utils/ipaddr): expand &quot;::&quot; to eight zero groups by <a
href="https://github.com/youcefzemmar"><code>@​youcefzemmar</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li>
<li>fix: clean up config files trailing comma, stale excludes,
typesVersions gaps, jsr paths by <a
href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@​Mohammad-Faiz-Cloud-Engineer</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li>
<li>refactor(timing): Test/add test for middleware timing by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li>
<li>fix(utils/ipaddr): render the unspecified address binary as
&quot;::&quot; by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p>
<h2>v4.12.23</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/27b7992f821bc10c2f62ad0ad86bd94eea251862"><code>27b7992</code></a>
4.12.26</li>
<li><a
href="https://github.com/honojs/hono/commit/d29982cc40c3babb417db625ab0671d982398646"><code>d29982c</code></a>
chore: replace arg and glob with Bun native APIs in build script</li>
<li><a
href="https://github.com/honojs/hono/commit/16215d5f509099b81b00d60a2777bc6b5ac06827"><code>16215d5</code></a>
chore: remove unused devcontainer and gitpod configs (<a
href="https://redirect.github.com/honojs/hono/issues/5029">#5029</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/c574cf16403b42a17917506bcba1916d32d3094f"><code>c574cf1</code></a>
ci: publish to npm from CI with OIDC trusted publishing (<a
href="https://redirect.github.com/honojs/hono/issues/5028">#5028</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/e50df01453e71b071c3e6136b161b160b9fdf916"><code>e50df01</code></a>
fix(lambda-edge): satisfy Deno lib types for Content-Length body
encoding (<a
href="https://redirect.github.com/honojs/hono/issues/5">#5</a>...</li>
<li><a
href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a>
4.12.25</li>
<li><a
href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.15...v4.12.26">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for hono since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.15&new-version=4.12.26)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…che#5819)

Bumps [prettier](https://github.com/prettier/prettier) from 3.4.2 to
3.8.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.8.4</h2>
<ul>
<li>Markdown: Fix blank lines between list items and nested sub-lists
being removed in Markdown/MDX (<a
href="https://redirect.github.com/prettier/prettier/pull/17746">prettier/prettier#17746</a>
by <a
href="https://github.com/byplayer"><code>@​byplayer</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.8.4/CHANGELOG.md#384">Changelog</a></p>
<h2>3.8.3</h2>
<ul>
<li>SCSS: Prevent trailing comma in <code>if()</code> function (<a
href="https://redirect.github.com/prettier/prettier/pull/18471">prettier/prettier#18471</a>
by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.8.3/CHANGELOG.md#383">Changelog</a></p>
<h2>3.8.2</h2>
<ul>
<li>Support Angular v21.2</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#382">Changelog</a></p>
<h2>3.8.1</h2>
<ul>
<li>Include available <code>printers</code> in plugin type declarations
(<a
href="https://redirect.github.com/prettier/prettier/pull/18706">#18706</a>
by <a href="https://github.com/porada"><code>@​porada</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#381">Changelog</a></p>
<h2>3.8.0</h2>
<ul>
<li>Support Angular v21.1</li>
</ul>
<p><a
href="https://github.com/prettier/prettier/compare/3.7.4...3.8.0">diff</a></p>
<p>🔗 <a href="https://prettier.io/blog/2026/01/14/3.8.0">Release note
&quot;Prettier 3.8: Support for Angular v21.1&quot;</a></p>
<h2>3.7.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix comment in union type gets duplicated by <a
href="https://github.com/fisker"><code>@​fisker</code></a> in <a
href="https://redirect.github.com/prettier/prettier/pull/18393">prettier/prettier#18393</a></li>
<li>Fix unstable comment print in union type by <a
href="https://github.com/fisker"><code>@​fisker</code></a> in <a
href="https://redirect.github.com/prettier/prettier/pull/18395">prettier/prettier#18395</a></li>
<li>Avoid quote around LWC interpolations by <a
href="https://github.com/kovsu"><code>@​kovsu</code></a> in <a
href="https://redirect.github.com/prettier/prettier/pull/18383">prettier/prettier#18383</a></li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#374">Changelog</a></p>
<h2>3.7.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix <code>prettier.getFileInfo()</code> change that breaks VSCode
extension by <a
href="https://github.com/fisker"><code>@​fisker</code></a> in <a
href="https://redirect.github.com/prettier/prettier/pull/18375">prettier/prettier#18375</a></li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#373">Changelog</a></p>
<h2>3.7.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix string print when switching quotes by <a
href="https://github.com/fisker"><code>@​fisker</code></a> in <a
href="https://redirect.github.com/prettier/prettier/pull/18351">prettier/prettier#18351</a></li>
<li>Preserve quote for embedded HTML attribute values by <a
href="https://github.com/kovsu"><code>@​kovsu</code></a> in <a
href="https://redirect.github.com/prettier/prettier/pull/18352">prettier/prettier#18352</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.8.4</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.8.3...3.8.4">diff</a></p>
<h4>Markdown: Fix blank lines between list items and nested sub-lists
being removed in Markdown/MDX (<a
href="https://redirect.github.com/prettier/prettier/pull/17746">#17746</a>
by <a
href="https://github.com/byplayer"><code>@​byplayer</code></a>)</h4>
<p>Prettier was removing blank lines between list items and their nested
sub-lists, converting loose lists into tight lists and changing their
semantic meaning.</p>
<!-- raw HTML omitted -->
<pre lang="markdown"><code>&lt;!-- Input --&gt;
- a
<ul>
<li>
<p>b</p>
</li>
<li>
<p>c</p>
<ul>
<li>d</li>
</ul>
</li>
</ul>
<p>&lt;!-- Prettier 3.8.3 --&gt;</p>
<ul>
<li>a
<ul>
<li>b</li>
</ul>
</li>
<li>c
<ul>
<li>d</li>
</ul>
</li>
</ul>
<p>&lt;!-- Prettier 3.8.4 --&gt;</p>
<ul>
<li>
<p>a</p>
<ul>
<li>b</li>
</ul>
</li>
<li>
<p>c</p>
<ul>
<li>d<br />
</code></pre></li>
</ul>
</li>
</ul>
<h1>3.8.3</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.8.2...3.8.3">diff</a></p>
<h4>SCSS: Prevent trailing comma in <code>if()</code> function (<a
href="https://redirect.github.com/prettier/prettier/pull/18471">#18471</a>
by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="scss"><code>// Input
$value: if(sass(false): 1; else: -1);
<p>// Prettier 3.8.2<br />
$value: if(<br />
sass(false): 1; else: -1,<br />
&lt;/tr&gt;&lt;/table&gt;<br />
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/1c6ba5539141552e0e8e22d401ea620d8fdff468"><code>1c6ba55</code></a>
Release 3.8.4</li>
<li><a
href="https://github.com/prettier/prettier/commit/4a673dc9b59ddf7296bbab9822093d2971da84a8"><code>4a673dc</code></a>
Fix blank lines between list items and nested sub-lists being removed in
Mark...</li>
<li><a
href="https://github.com/prettier/prettier/commit/074aaedbb052a288e89d15eb0a4214de37a08866"><code>074aaed</code></a>
Replace <code>main</code> branch in changelog link with tags (<a
href="https://redirect.github.com/prettier/prettier/issues/19054">#19054</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/c22a003ae97917c5043e8685b4fdff0f93e978f9"><code>c22a003</code></a>
Bump Prettier dependency to 3.8.3</li>
<li><a
href="https://github.com/prettier/prettier/commit/07bad1f04536e9799927007baf466e67151576f0"><code>07bad1f</code></a>
Clean changelog_unreleased</li>
<li><a
href="https://github.com/prettier/prettier/commit/d7108a79ec745c04292aabf22c4c1adbd690b191"><code>d7108a7</code></a>
Release 3.8.3</li>
<li><a
href="https://github.com/prettier/prettier/commit/177f90898170d363ef64fde663e4d13170688bfe"><code>177f908</code></a>
Prevent trailing comma in SCSS <code>if()</code> function (<a
href="https://redirect.github.com/prettier/prettier/issues/18471">#18471</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/1cd40668c3d6f2f4cf9d87bbc9096d92361b2606"><code>1cd4066</code></a>
Release <code>@​prettier/plugin-oxc</code><a
href="https://github.com/0"><code>@​0</code></a>.1.4</li>
<li><a
href="https://github.com/prettier/prettier/commit/a8700e245038cd8cc0cf28ef06ffedbcb3fc2dfc"><code>a8700e2</code></a>
Update oxc-parser to v0.125.0</li>
<li><a
href="https://github.com/prettier/prettier/commit/752157c78eca6f0a30e5d5cb513b682c5ecfa01e"><code>752157c</code></a>
Fix tests</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/prettier/compare/3.4.2...3.8.4">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for prettier since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=prettier&package-manager=bun&previous-version=3.4.2&new-version=3.8.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Bumps [ws](https://github.com/websockets/ws) from 6.2.3 to 6.2.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>6.2.4</h2>
<h1>Bug fixes</h1>
<ul>
<li>Backported 2b2abd45 to the 6.x release line (a76e2111).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7"><code>86d3e8a</code></a>
[dist] 6.2.4</li>
<li><a
href="https://github.com/websockets/ws/commit/a76e2111c91d7e031c00148a73db90db059bf989"><code>a76e211</code></a>
[security] Limit retained message parts</li>
<li>See full diff in <a
href="https://github.com/websockets/ws/compare/6.2.3...6.2.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ws&package-manager=npm_and_yarn&previous-version=6.2.3&new-version=6.2.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
…pache#5817)

Bumps
[@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun)
from 1.3.3 to 1.3.14.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/bun&package-manager=bun&previous-version=1.3.3&new-version=1.3.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
aglinxinyuan and others added 17 commits June 21, 2026 03:58
… types (OperatorInfo, PortDescription, PortDescriptor) (apache#5832)

### What changes were proposed in this PR?

Pin behavior of three core operator-metadata types in
`common/workflow-operator/` — the data/trait types every `LogicalOp`
relies on for port wiring and metadata. No production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `OperatorInfoSpec` | `OperatorInfo` (case class) | 4 |
| `PortDescriptionSpec` | `PortDescription` (case class) | 5 |
| `PortDescriptorSpec` | `PortDescriptor` (trait) | 2 |

**Behavior pinned**

| Surface | Contract |
| --- | --- |
| `OperatorInfo` fields | constructor field exposure; the four boolean
flags default to `false` and round-trip `true` when set; value equality
|
| `OperatorInfo.forVisualization` | `inputPorts ==
List(InputPort(disallowMultiLinks = true))`, `outputPorts ==
List(OutputPort(mode = SINGLE_SNAPSHOT))` |
| `PortDescription` | field exposure; `dependencies` defaults
`List.empty` + accepts explicit deps; value equality + `copy`;
`@JsonIgnoreProperties("allowMultiInputs")` backward-compat marker
(verified via reflection) |
| `PortDescriptor` (trait) | `inputPorts`/`outputPorts` default to
`null` (not empty) and are reassignable |

**Note for reviewers:** scoped to the pure case-class/trait types only.
The `OperatorMetadataGenerator` object in the same file is deliberately
**not** tested — it eagerly reflects over the entire `LogicalOp`
registry at init (instantiating every descriptor), which is not
pure-unit-testable.

### Any related issues, documentation, discussions?

Closes apache#5829.

### How was this PR tested?

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.metadata.OperatorInfoSpec
org.apache.texera.amber.operator.PortDescriptionSpec
org.apache.texera.amber.operator.PortDescriptorSpec"` — 11 tests, all
green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
…criptors (ContourPlot, PolarChart, StripChart) (apache#5831)

### What changes were proposed in this PR?

Pin behavior of three previously-untested visualization
`PythonOperatorDescriptor`s in `common/workflow-operator/`. No
production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `ContourPlotOpDescSpec` | `ContourPlotOpDesc` | 4 |
| `PolarChartOpDescSpec` | `PolarChartOpDesc` | 5 |
| `StripChartOpDescSpec` | `StripChartOpDesc` | 5 |

**Behavior pinned**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | exact name + visualization group (Scientific /
Scientific / Statistical); one input / one output |
| `getOutputSchemas` | single `html-content` STRING column, asserted as
the **full map keyed by `operatorInfo.outputPorts.head.id`** (input map
ignored — `Map.empty` proves it) |
| Field defaults | ContourPlot `x/y/z/gridSize == ""`, `connectGaps ==
false`; Polar `r/theta == ""`; Strip `x/y/colorBy/facetColumn == ""` |
| `generatePythonCode` | Polar emits `go.Scatterpolargl(`; Strip emits
`px.strip(` (structural Python only) |
| Round-trip | all column fields preserved through the polymorphic base
|

**Notes for reviewers**
- `ContourPlotOpDesc.generatePythonCode` is intentionally **not**
exercised: a freshly-constructed instance has a `null` `coloringMethod`
var, so codegen throws an NPE (the `@NotNull` is validation-layer only,
not enforced at codegen). The spec pins the clean, deterministic
contracts instead.
- Codegen assertions check only structural Python (class def / import /
plotly call) — never the interpolated `EncodableString` column values,
which are base64-encoded at `.encode` time and do not appear literally.

### Any related issues, documentation, discussions?

Closes apache#5828.

### How was this PR tested?

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.visualization.contourPlot.ContourPlotOpDescSpec
org.apache.texera.amber.operator.visualization.polarChart.PolarChartOpDescSpec
org.apache.texera.amber.operator.visualization.stripChart.StripChartOpDescSpec"`
— 14 tests, all green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
…rator descriptors (apache#5827)

### What changes were proposed in this PR?

Pin behavior of three previously-untested visualization descriptors in
`common/workflow-operator/`. No production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `HtmlVizOpDescSpec` | `HtmlVizOpDesc` | 4 |
| `CandlestickChartOpDescSpec` | `CandlestickChartOpDesc` | 5 |
| `Histogram2DOpDescSpec` | `Histogram2DOpDesc` | 6 |

All three spec files follow the `<srcClassName>Spec.scala` one-to-one
convention.

**Behavior pinned**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | exact name + visualization group (`MEDIA` /
`FINANCIAL` / `STATISTICAL`); one input / one output |
| Output schema | all three emit a single `html-content` STRING column
(`HtmlViz` via `getExternalOutputSchemas`; charts via
`getOutputSchemas`) |
| `getPhysicalOp` wiring (`HtmlViz`) |
`OpExecWithClassName("…htmlviz.HtmlVizOpExec")`; port **identities**
carried forward |
| Field defaults | `Candlestick` OHLC columns default `""`;
`Histogram2D` `xBins`/`yBins == 10`, `normalize == DENSITY` |
| `generatePythonCode` | `Candlestick` emits a Plotly `go.Candlestick(`
figure; `Histogram2D` emits `px.density_heatmap(` and **rejects a
non-positive bin count** (`AssertionError`) |
| Round-trip | all config fields preserved through the polymorphic base
|

The specs pin the stable contract (operatorInfo + output schema +
codegen guards) rather than the full Plotly template, and never assert
on interpolated `EncodableString` values (which are decoded at runtime,
not embedded raw).

### Any related issues, documentation, discussions?

Closes apache#5824.

### How was this PR tested?

Pure unit-test additions; verified locally with:

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.visualization.htmlviz.HtmlVizOpDescSpec
org.apache.texera.amber.operator.visualization.candlestickChart.CandlestickChartOpDescSpec
org.apache.texera.amber.operator.visualization.histogram2d.Histogram2DOpDescSpec"`
— 15 tests, all green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
…nUtils, and OperatorGroupConstants (apache#5845)

### What changes were proposed in this PR?

Pin behavior of three join/utility classes in
`common/workflow-operator/`. No production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `IntervalJoinOpDescSpec` | `IntervalJoinOpDesc` | 5 |
| `JoinUtilsSpec` | `JoinUtils` (object) | 3 |
| `OperatorGroupConstantsSpec` | `OperatorGroupConstants` (object) | 4 |

**Behavior pinned — `IntervalJoinOpDesc`**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | `Interval Join`, JOIN_GROUP; two ordered inputs
(`left table` at `PortIdentity()`, `right table` at `PortIdentity(1)`
depending on the left); one output |
| Field defaults | join-key attrs `null`; `constant == 10`;
`includeLeftBound`/`includeRightBound == true` |
| `getPhysicalOp` | wires `IntervalJoinOpExec`; port identities carried;
`HashPartition` requirement on each join key |
| Schema propagation | merges left ⧺ right schemas, suffixing a
conflicting attribute with `#@1` |

**Behavior pinned — `JoinUtils.joinTuples`**

| Surface | Contract |
| --- | --- |
| Concatenation | left + right fields merged |
| Skip | the named join-key attribute is dropped from the right side |
| Conflict rename | a right-side name collision is renamed with a `#@1`
suffix |

**Behavior pinned — `OperatorGroupConstants`**

| Surface | Contract |
| --- | --- |
| Constant values | the canonical group-name strings (`Data Input`,
`Join`, `Set`, … `Control Block`) |
| `OperatorGroupOrderList` | starts at `Data Input`, ends at `Control
Block`; relational subgroups (Join/Set/Aggregate/Sort) nested under
`Data Cleaning`; visualization subgroups nested under `Visualization` in
panel order |

### Any related issues, documentation, discussions?

Closes apache#5840.

### How was this PR tested?

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.intervalJoin.IntervalJoinOpDescSpec
org.apache.texera.amber.operator.hashJoin.JoinUtilsSpec
org.apache.texera.amber.operator.metadata.OperatorGroupConstantsSpec"` —
12 tests, all green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
…pache#5667)

### What changes were proposed in this PR?
- Route `DatasetFileDocument`'s presigned-URL fetch and file download
through a `requests.Session` configured with a `(5s connect, 10s read)`
timeout, so a hung or unreachable file-service fails in bounded time
instead of blocking the worker thread forever. The read timeout bounds
inactivity *between bytes*, not the total download time, so large
dataset files that stream steadily are unaffected; it only trips when
the connection stalls for 10s with no data.
- Mount a `urllib3` `Retry` policy on the session (3 retries,
exponential backoff, retrying on connection errors and 5xx). Both calls
are idempotent GETs, so the retry set is restricted to `GET`.
- Translate network failures (connect/read timeouts and connection
errors, including those surfaced after retries are exhausted) into
`RuntimeError`, consistent with the module's existing failure handling,
so callers get a uniform error contract instead of a raw
`requests`/`urllib3` exception.

### Any related issues, documentation, discussions?
Closes: apache#5666

### How was this PR tested?
- Added `pytest` coverage in `test_dataset_file_document.py` (26 tests):
- asserts the `(connect, read)` timeout tuple is passed on both the
presigned-URL request and the file download;
- asserts the retry adapter is mounted for `http://` and `https://` with
the expected policy (`total=3`, `connect=3`, `read=3`,
`backoff_factor=0.5`, `status_forcelist={500,502,503,504}`, GET-only);
- asserts a `ReadTimeout` / `ConnectionError` is wrapped in
`RuntimeError` on both code paths.
- `ruff check` and `ruff format --check` pass on the modified files.

### Was this PR authored or co-authored using generative AI tooling?
Co-authored with Claude Opus 4.8 in compliance with ASF
…git blame (apache#5651)

<!--
Thanks for sending a pull request (PR)! Here are some tips for you:
1. If this is your first time, please read our contributor guidelines:
[Contributing to
Texera](https://github.com/apache/texera/blob/main/CONTRIBUTING.md)
  2. Ensure you have added or run the appropriate tests for your PR
  3. If the PR is work in progress, mark it a draft on GitHub.
  4. Please write your PR title to summarize what this PR proposes, we 
    are following Conventional Commits style for PR titles as well.
  5. Be sure to keep the PR description updated to reflect all changes.
-->

### What changes were proposed in this PR?
This PR adds an automatic reviewer suggestion CI job to
`.github/workflows/comment-commands.yml`. When a PR is opened or updated
(pull_request: opened, synchronize, reopened), the CI automatically runs
`git blame -p` at the base commit on each changed file to identify who
most recently touched that code. Candidates are split into two groups:
- Committers — collaborators who can be formally review-requested via
GitHub's API
- Non-committer contributors — have context but cannot be
review-requested; the author can @-mention them to notify

The CI posts a comment in this format:
`Suggested reviewers (based on git blame of changed files):`
`Committers — can be formally requested: @ alice, @ bob`
`Non-committer contributors — cc to notify: @ carol`
`Use /request-review @ alice to request a review, or cc @ carol to
notify them.`

On every subsequent push, the job finds the existing suggestion comment
(via a hidden HTML marker <!-- texera-reviewer-suggestion -->) and edits
it in place, keeping the PR timeline clean. The CI never sends a review
request on its own as the author must explicitly use /request-review @
user.

Files with status added are skipped before git blame is attempted since
they did not exist at the base commit.

<!--
Please clarify what changes you are proposing. The purpose of this
section
is to outline the changes. Here are some tips for you:
  1. If you propose a new API, clarify the use case for a new API.
  2. If you fix a bug, you can clarify why it is a bug.
  3. If it is a refactoring, clarify what has been changed.
  3. It would be helpful to include a before-and-after comparison using 
     screenshots or GIFs.
  4. Please consider writing useful notes for better and faster reviews.
-->


### Any related issues, documentation, discussions?
Closes apache#5611
<!--
Please use this section to link other resources if not mentioned
already.
1. If this PR fixes an issue, please include `Fixes apache#1234`, `Resolves
apache#1234`
or `Closes apache#1234`. If it is only related, simply mention the issue
number.
  2. If there is design documentation, please add the link.
  3. If there is a discussion in the mailing list, please add the link.
-->


### How was this PR tested?
**Unit tests**: 83 tests across 9 suites were written locally
(https://github.com/juliethecao/texera/tree/cc-test) to cover the core
JavaScript logic extracted from the workflow: `git blame -p` output
parsing, candidate ranking, comment body generation, find-or-update
marker logic, author/bot exclusion, @ mention parsing, file status
filtering, candidate accumulation, and MARKER integrity. Tests were not
checked in as the logic lives inside a GitHub Actions script rather than
a standalone module.

**Manual CI test**: A test PR was opened on a personal fork
(juliethecao#9) against the feature
branch as the base. The suggest-reviewers job triggered on open, ran git
blame on the changed files, and posted the suggestion comment. Closing
and reopening the PR confirmed the comment was updated in place rather
than duplicated.
<!--
If tests were added, say they were added here. Or simply mention that if
the PR
is tested with existing test cases. Make sure to include/update test
cases that
check the changes thoroughly including negative and positive cases if
possible.
If it was tested in a way different from regular unit tests, please
clarify how
you tested step by step, ideally copy and paste-able, so that other
reviewers can
test and check, and descendants can verify in the future. If tests were
not added,
please describe why they were not added and/or why it was difficult to
add.
-->


### Was this PR authored or co-authored using generative AI tooling?
Co-authored with Claude Sonnet 4.6 in compliance with ASF guidelines
<!--
If generative AI tooling has been used in the process of authoring this
PR,
please include the phrase: 'Generated-by: ' followed by the name of the
tool
and its version. If no, write 'No'. 
Please refer to the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) for
details.
-->

---------

Signed-off-by: oplaws <juucceey@gmail.com>
Signed-off-by: Julie Cao <116243642+juliethecao@users.noreply.github.com>
Co-authored-by: oplaws <juucceey@gmail.com>
Co-authored-by: Matthew B. <mgball@uci.edu>
### What changes were proposed in this PR?
- Remove the unused `fs-extra` (10.0.1) devDependency from
`frontend/package.json`; it is never imported or referenced in `src/`,
`build-version.js`, `custom-webpack.config.js`, any config, or any npm
script. It was introduced by apache#899
and we have replaced it in apache#3613
### Any related issues, documentation, discussions?
Closes: apache#5841
### How was this PR tested?
- Run `yarn install` in `frontend/`, expect the only `yarn.lock` change
to be removal of the direct `fs-extra@npm:10.0.1` block plus the
project's reference (verify with `git diff frontend/yarn.lock`).
- Run `yarn build` in `frontend/` (production `ng build`), expect exit
code 0 with no new errors; this confirms nothing in the source or build
pipeline depends on the direct `fs-extra` dependency.
- Run `grep -rn "fs-extra" frontend/src frontend/build-version.js
frontend/custom-webpack.config.js`, expect no matches.
### Was this PR authored or co-authored using generative AI tooling?
Co-authored with Claude Opus 4.8 in compliance with ASF
…criptors (CarpetPlot, DumbbellPlot, ParallelCoordinatesPlot) (apache#5844)

### What changes were proposed in this PR?

Pin behavior of three more previously-untested visualization
`PythonOperatorDescriptor`s in `common/workflow-operator/`. No
production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `CarpetPlotOpDescSpec` | `CarpetPlotOpDesc` | 5 |
| `DumbbellPlotOpDescSpec` | `DumbbellPlotOpDesc` | 5 |
| `ParallelCoordinatesPlotOpDescSpec` | `ParallelCoordinatesPlotOpDesc`
| 5 |

**Behavior pinned (each descriptor)**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | exact name + visualization group (`Scientific` /
`Basic` / `Scientific`); one input / one output |
| `getOutputSchemas` | single `html-content` STRING column, asserted as
the full map keyed by `operatorInfo.outputPorts.head.id` |
| Field defaults | Carpet `a`/`b`/`y == ""`; Dumbbell column fields `==
""` + `showLegends == false`; ParallelCoordinates `dimensions` empty |
| `generatePythonCode` | Carpet `go.Carpet(`; Dumbbell `go.Scatter(`;
ParallelCoordinates `px.parallel_coordinates(` (structural Python only)
|
| Round-trip | config fields preserved through the polymorphic base |

**Note for reviewers:** `ParallelCoordinatesPlotOpDesc.color` defaults
to `null` and `dimensions` to empty — both are null/empty-guarded in
`generatePythonCode`, so codegen on a fresh instance is exercised
safely. Codegen assertions pin only structural Python, never the
base64-encoded `EncodableString` values.

### Any related issues, documentation, discussions?

Closes apache#5839.

### How was this PR tested?

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.visualization.carpetPlot.CarpetPlotOpDescSpec
org.apache.texera.amber.operator.visualization.dumbbellPlot.DumbbellPlotOpDescSpec
org.apache.texera.amber.operator.visualization.parallelCoordinatesPlot.ParallelCoordinatesPlotOpDescSpec"`
— 15 tests, all green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
…criptors (GaugeChart, RangeSlider, SankeyDiagram) (apache#5843)

### What changes were proposed in this PR?

Pin behavior of three previously-untested visualization
`PythonOperatorDescriptor`s in `common/workflow-operator/`. No
production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `GaugeChartOpDescSpec` | `GaugeChartOpDesc` | 5 |
| `RangeSliderOpDescSpec` | `RangeSliderOpDesc` | 5 |
| `SankeyDiagramOpDescSpec` | `SankeyDiagramOpDesc` | 5 |

**Behavior pinned (each descriptor)**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | exact name + visualization group (`Financial` /
`Basic` / `Basic`); one input / one output |
| `getOutputSchemas` | single `html-content` STRING column, asserted as
the **full map keyed by `operatorInfo.outputPorts.head.id`** (input
ignored — `Map.empty` proves it) |
| Field defaults | Gauge `value`/`delta`/`threshold == ""` + empty
`steps`; RangeSlider `xAxis`/`yAxis == ""`; Sankey
`source`/`target`/`value == ""` |
| `generatePythonCode` | Gauge `go.Indicator(`; RangeSlider
`go.Scatter(`; Sankey `go.Sankey(` (structural Python only) |
| Round-trip | config fields preserved through the polymorphic base |

Codegen assertions check only structural Python (class def / import /
plotly call) — never the interpolated `EncodableString` values, which
are base64-encoded at `.encode` time and do not appear literally.

### Any related issues, documentation, discussions?

Closes apache#5838.

### How was this PR tested?

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.visualization.gaugeChart.GaugeChartOpDescSpec
org.apache.texera.amber.operator.visualization.rangeSlider.RangeSliderOpDescSpec
org.apache.texera.amber.operator.visualization.sankeyDiagram.SankeyDiagramOpDescSpec"`
— 15 tests, all green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
…fig key (apache#5545)

### What changes were proposed in this PR?

The default data-transfer batch size was controlled by **two** separate
config keys, each with its own env var, both defaulting to `400`:

- `network-buffering.default-data-transfer-batch-size`
(`NETWORK_BUFFERING_DEFAULT_DATA_TRANSFER_BATCH_SIZE`), read by the
backend (`ApplicationConfig.defaultDataTransferBatchSize`).
- `gui.workflow-workspace.default-data-transfer-batch-size`
(`GUI_WORKFLOW_WORKSPACE_DEFAULT_DATA_TRANSFER_BATCH_SIZE`), read by
`GuiConfig` and sent to the frontend via `ConfigResource`.

Having two keys for one value meant an operator could set one env var
and forget the other, leaving the backend and GUI out of sync.

This PR makes the `network-buffering` key the single source of truth:

- `ConfigResource` now surfaces
`ApplicationConfig.defaultDataTransferBatchSize` directly.
- Removed the duplicate
`guiWorkflowWorkspaceDefaultDataTransferBatchSize` field from
`GuiConfig`.
- Removed the duplicate key (and its env override) from `gui.conf`.

The frontend is unchanged: the JSON field name
(`defaultDataTransferBatchSize`) it consumes stays the same.

### Any related issues, documentation, discussions?

Closes apache#5544

### How was this PR tested?

- `sbt Config/compile ConfigService/compile` both succeed.
- Repo-wide grep confirms no remaining references to the old key or
`GUI_WORKFLOW_WORKSPACE_DEFAULT_DATA_TRANSFER_BATCH_SIZE` (outside
generated `dist/` artifacts).
- The backend reader of the canonical key is untouched, so existing
tests (e.g. `NetworkOutputBufferSpec`) are unaffected.
- Also tested that the application performs as normal on all services
(e.g., running workflows, uploading data, creating workflows, etc..)

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8)
…ache#5847)

### What changes were proposed in this PR?
- Add GlobalErrorHandler (implements Angular ErrorHandler), registered
as the global ErrorHandler in app.module.ts.
- handleError reloads the page once on a chunk-load failure
(ChunkLoadError, "Loading chunk ... failed", or a failed dynamic
import), guarded by a sessionStorage timestamp (10s window) so a
genuinely missing chunk cannot cause a reload loop; all other errors
delegate to Angular's default handler.
- Chunk detection lives in a pure exported isChunkLoadError(error)
function so it is unit-testable in isolation.
### Any related issues, documentation, discussions?
Closes: apache#5837
### How was this PR tested?
- Run `yarn test --include='**/global-error-handler.service.spec.ts'`
from frontend/, expect 5 passing cases: isChunkLoadError true for chunk
errors and false for generic/TypeError/null; handleError reloads once
and records the guard, does not reload again within the window, and does
not reload on a non-chunk error.
- Manual: load the app, in DevTools block a chunk request URL (Network,
Block request URL) and trigger a navigation that loads it, expect a
single automatic reload rather than a broken view; trigger it again
immediately and expect no reload loop.
### Was this PR authored or co-authored using generative AI tooling?
Co-authored with Claude Opus 4.8 in compliance with ASF
…ed by the scheduler (apache#5720)

### What changes were proposed in this PR?

Lets an operator declare it can only run under a fully-materialized
schedule, and has the scheduler honor it:

- `PhysicalOp` gains `requiresMaterializedExecution: Boolean = false` (+
a `withRequiresMaterializedExecution` builder). It is a
physical-execution property, so it lives on the physical op.
- `CostBasedScheduleGenerator` consumes it: when any physical op
requires materialized execution it forces a fully-materialized schedule
regardless of the requested execution mode; otherwise the existing
PIPELINED/MATERIALIZED logic runs unchanged.

Default `false` ⇒ dormant and behavior-preserving: no operator requires
it yet, so the scheduler's effective mode is unchanged today. The loop
operators set the flag on their physical op.

### Any related issues, documentation, discussions?

Resolves apache#5719 (sub-issue of apache#4442 "Introduce for loop"). Split out of
apache#5700. Reflects the review discussion with @Yicong-Huang: the property
belongs on `PhysicalOp`, and it is consumed by the scheduler.

### How was this PR tested?

`WorkflowCoreTypesSpec` covers the
`PhysicalOp.requiresMaterializedExecution` default + builder.
`WorkflowExecutionService/Test/compile`, `scalafixAll --check`, and
`scalafmtCheckAll` pass locally. The scheduler consumer is exercised
end-to-end by the loop integration tests once the loop operators (which
set the flag) land.

### Was this PR authored or co-authored using generative AI tooling?

Co-authored with Claude Opus 4.8 in compliance with ASF.
…che#5783)

### What changes were proposed in this PR?

`DataProcessor` built the operator-facing ERROR console message for an
uncaught UDF exception inline (`_report_exception`). This moves that
construction into a small factory —
`core.util.console_message.error_message.create_error_console_message(worker_id,
exc_info) -> ConsoleMessage`. `DataProcessor` builds the message via the
factory and queues it through the existing
`ConsoleMessageManager.put_message`.

Per review, `ConsoleMessageManager` stays purely about **message
management** (its interfaces are all at the `msg: ConsoleMessage`
level); message *construction* lives in the util.

Behavior-preserving: the same ERROR `ConsoleMessage` is produced —

| field | value |
|---|---|
| `msg_type` | `ConsoleMessageType.ERROR` |
| `title` | the exception's final line (e.g. `ValueError: ...`) |
| `message` | the full formatted traceback |
| `source` | `module:func:line` of the raising frame |

Centralizing the factory lets other uncaught-exception paths report
identically (the loop operators' main-loop condition evaluation reuses
it in a follow-up).

### Any related issues, documentation, discussions?

Split out of apache#5700 (loop operators) to keep that PR focused; the
refactor is independent and behavior-preserving on `main`.

### How was this PR tested?

- New
`test_error_message.py::test_builds_error_console_message_from_exc_info`
pins the factory output (worker id, ERROR type, title, traceback body,
`module:func:line` source) — written test-first.
- The existing `test_data_processor.py` (asserts console messages after
a UDF raises) still passes unchanged, confirming the delegation
preserves behavior.
- `cd amber && pytest -m "not integration"` on the affected files: 12
passed; `black --check` clean.

### Was this PR authored or co-authored using generative AI tooling?

Co-authored with Claude Opus 4.8 in compliance with ASF.
…or descriptors (apache#5876)

### What changes were proposed in this PR?

Pin behavior of three previously-untested Python-UDF descriptors in
`common/workflow-operator/udf/python/`. No production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `PythonUDFOpDescV2Spec` | `PythonUDFOpDescV2` | 7 |
| `PythonUDFSourceOpDescV2Spec` | `PythonUDFSourceOpDescV2` | 5 |
| `PythonTableReducerOpDescSpec` | `PythonTableReducerOpDesc` | 6 |

**Behavior pinned**

| Surface | Contract |
| --- | --- |
| `operatorInfo` | exact name + `PYTHON_GROUP`; `PythonUDFOpDescV2`
dynamic 1-in/1-out; `PythonUDFSourceOpDescV2` zero inputs / one output +
`supportReconfiguration` |
| `getPhysicalOp` | wires `OpExecWithCode(code, "python")`; port
identities carried; rejects `workers <= 0` (`IllegalArgumentException`)
|
| Schema propagation | `PythonUDFOpDescV2`: `retainInputColumns=false` →
only the output columns, `true` → input + output columns (full map keyed
by the declared output port); `PythonUDFSourceOpDescV2`:
`sourceSchema()` from the `columns` field; `PythonTableReducerOpDesc`:
`getOutputSchemas` folds the lambda units and rejects the empty default
|
| Round-trip | config fields preserved through the polymorphic base |

### Any related issues, documentation, discussions?

Closes apache#5873.

### How was this PR tested?

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.udf.python.PythonUDFOpDescV2Spec
org.apache.texera.amber.operator.udf.python.source.PythonUDFSourceOpDescV2Spec
org.apache.texera.amber.operator.udf.python.PythonTableReducerOpDescSpec"`
— 18 tests, all green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
…ants (apache#5739)

### What changes were proposed in this PR?

Adds a unit-test spec for `PropertyNameConstants` (the `@JsonProperty`
wire-key constants shared across `LogicalOp` serialization). No
production-code changes.

| Spec | Source class | Tests |
| --- | --- | --- |
| `PropertyNameConstantsSpec` | `PropertyNameConstants` | 5 |

> **Scope note:** this PR originally also bundled
`OperatorDescriptorUtils` and `PortDescriptor`/`PortDescription` specs.
Both have since been covered on `main` / by other open PRs:
> - `OperatorDescriptorUtilsSpec` already merged via apache#5798 — dropped
here (it was the merge conflict).
> - `PortDescriptor` + `PortDescription` are covered by apache#5832 with one
spec file per source class (the repo convention) — dropped here to avoid
a duplicate `PortDescriptorSpec.scala`.
>
> This PR is now scoped to its unique contribution,
`PropertyNameConstants`, and is rebased on current `main`.

### Any related issues, documentation, discussions?

Follow-up test coverage; see apache#5798 and apache#5832 for the de-duplicated
specs.

### How was this PR tested?

- `sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.metadata.PropertyNameConstantsSpec"` —
5 tests, all green
- `sbt "WorkflowOperator/Test/scalafmtCheck"` and `sbt
"WorkflowOperator/Test/scalafix --check"` — clean
- CI to confirm

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.8 [1M context])
)

### What changes were proposed in this PR?
- Add `awaitDependency` to `FileService`, an exponential-backoff retry
(6 attempts from 200ms, ~6s total) with an injectable sleep, mirroring
`LakeFSStorageClient.retryWithBackoff`.
- Wrap the two `S3StorageClient.createBucketIfNotExist` calls in
`FileService.run` with it, so a slow-to-start MinIO/S3 no longer aborts
file-service startup.
- Handle `InterruptedException` consistently: an interrupt arriving
during the backoff `sleep` (not just during the bucket operation) now
restores the thread's interrupt status and fails fast, instead of
escaping as a raw `InterruptedException` with the interrupt flag lost.
- Leave `LakeFSStorageClient.healthCheck()` on its existing inner retry
(unchanged).
- Add `FileServiceSpec` (8 tests) covering immediate success,
default-argument success, retry-then-success, the full backoff
progression to give-up, give-up preserving the cause, `maxAttempts ==
1`, and interrupt-fails-fast for both interrupt points.

### Any related issues, documentation, discussions?
Closes: apache#5852

Note: `awaitDependency` is a near-duplicate of
`LakeFSStorageClient.retryWithBackoff` in `common/workflow-core`.
Extracting a single shared helper that both delegate to is the cleaner
end state, but it would refactor a stable, separately-tested class in
another module, so it is deferred to a follow-up rather than widening
the scope of this startup-race fix.

### How was this PR tested?
- Run `sbt "FileService/testOnly
org.apache.texera.service.FileServiceSpec"` and expect 8 passing tests:
  - immediate success runs the operation once and never sleeps;
- default-argument success returns on the first try without invoking the
default `Thread.sleep` backoff;
- retry-then-success records delays `List(200, 400)` before succeeding
on the 3rd try;
- exhausting all 6 attempts records the full progression `List(200, 400,
800, 1600, 3200)` before giving up;
- give-up rethrows after `maxAttempts` with the original exception as
`getCause` and the dependency name in the message;
  - `maxAttempts == 1` gives up after a single attempt without sleeping;
- an interrupt while running the operation restores the interrupt flag
and fails fast;
- an interrupt while sleeping between attempts likewise restores the
interrupt flag and fails fast.
- This environment hits a pre-existing JaCoCo instrumentation error
(`Unsupported class file major version 69`) because JaCoCo 0.8.11 cannot
instrument JDK 25 class files; this is unrelated to the change. The spec
was verified locally against a JDK 17 toolchain (`sbt -java-home
<jdk17>`, 8/8 pass) and relies on CI's JDK/JaCoCo combo for the standard
instrumented run. `scalafmtCheck` is clean for both main and test
sources.

### Was this PR authored or co-authored using generative AI tooling?
Co-authored with Claude Opus 4.8 in compliance with ASF
## What changes were proposed in this PR?

Adds the audio and media-generation task families — 5 HF pipeline tasks
— as new `TaskCodegen`s plugged into the dispatcher established by the
text-generation PR:

audio tasks: `automatic-speech-recognition`, `audio-classification`,
`text-to-speech`

media-generation tasks: `text-to-image`, `text-to-video`

`codegen/AudioTaskCodegen.scala` supplies the per-task payload + parse
Python branches for the 3 audio tasks.

`codegen/MediaGenCodegen.scala` supplies the per-task payload + parse
Python branches for the 2 media-generation tasks.

`CodegenContext` is extended with `audioInput` + `inputAudioColumn`
(`EncodableString`).

`HuggingFaceInferenceOpDesc.scala` gains 2 new `@JsonProperty` fields
and registers `AudioTaskCodegen` + `MediaGenCodegen` in the dispatcher.

`PythonCodegenBase.scala` grows to host the shared audio/media
infrastructure:

- Audio task-family tuple (`audio_only_tasks`) in `process_table`.
- Per-row audio-byte resolution from upload or column input.
- Raw binary request handling for `automatic-speech-recognition` and
`audio-classification`.
- JSON payload handling for `text-to-speech`.
- Provider-specific routing for media generation and audio generation
through `_call_provider`, including OpenAI-compatible image/audio
endpoints where supported.
- Response parsing for audio/media outputs, including data-URL
conversion for generated media URLs.
- Media helper support for converting remote URLs into `data:image/...`,
`data:audio/...`, or `data:video/...` URLs where needed.
- Hardened audio input loading to match the image-input path: uploaded
audio is accepted as a data URL, remote audio is fetched through the
existing HTTPS-only `_fetch_remote_url` helper, and arbitrary
worker-local file paths are no longer read.

User-input strings continue to flow through `pyb"..."` +
`EncodableString` so they reach Python as
`self.decode_python_template('<base64>')` rather than raw literals.
`PythonCodeRawInvalidTextSpec` still passes with 117/117 descriptors
py_compile cleanly.

## Any related issues, documentation, or discussions?

Tracking issue: Add audio and media-generation task families to
HuggingFace operator apache#5288

Closes apache#5288

Stacked on: Add image task family (`ImageTaskCodegen`) to HuggingFace
operator / `hf/03-image-tasks`

Parent issue: Add Hugging Face inference operator apache#5041

Closed sibling issue: Add HuggingFaceModelResource REST endpoints for HF
operator UI apache#5134

## How was this PR tested?

`sbt "WorkflowOperator/compile; WorkflowOperator/Test/compile"` clean.

`sbt scalafmtCheck` clean.

`sbt "WorkflowOperator/testOnly
org.apache.texera.amber.operator.huggingFace.HuggingFaceInferenceOpDescSpec
org.apache.texera.amber.util.PythonCodeRawInvalidTextSpec"` — 26 focused
tests pass, including HuggingFace audio/media task coverage and the raw
Python descriptor scan.

`sbt "WorkflowOperator/testOnly
org.apache.texera.amber.util.PythonCodeRawInvalidTextSpec"` — 117/117
descriptors py_compile cleanly with the new operator code paths, no
marker leaks.

- Added regression coverage that audio remote input routes through
`_fetch_remote_url(audio_input)` and no longer uses raw
`requests.get(audio_input)` or local file reads.

## Was this PR authored or co-authored using generative AI tooling?

Yes, co-authored with generative AI tooling (Codex).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants