Master merge scala 213 support

[huiyongwang]

his pr is merging the branch of this combust#887 which implemented scala 2.13 support into master

---

Note

Major platform upgrades and compatibility adjustments across the codebase.

• Bump to Scala 2.13.16, Java 17, Spark 4.0.1, Hadoop 3.4.0, XGBoost 2.0.3, Spring Boot 3.2, Logback 1.4.14; update README matrix and usage examples to 0.24.0
• Refactor for Scala 2.13 collections/API changes (widespread .toSeq, ArraySeq, JavaConverters -> CollectionConverters), minor API tweaks (e.g., dataset.sparkSession.sqlContext), and constructor signature fixes in serializers
• Runtime/frame changes: normalize row seq handling, ArrayRow uses ArraySeq, adjust UDF arg normalization and row transformers; Avro/JSON converters return strict Seq/Map
• Spark integration: context/HDFS registration uses Spark 4 APIs; OneVsRest training loop de-parallelized; benchmark config simplified
• CI/devcontainer: JDK 17 image, Scala 2.13 toolchain; test matrix updated to Python 3.9-3.13; publish step invokes aggregated sbt/docker targets
• Python: require >=3.9, tox envs updated, pyspark==4.0.1

^{Written by Cursor Bugbot for commit ea83d54. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

[cursor]

Benchmark configuration value read but never used

Low Severity

The benchRuns variable is read from configuration on line 37 but is never used anywhere in the code. The config(exec.benchRuns -> benchRuns) syntax that previously applied this configuration to the scalameter benchmark was removed on line 44, making benchRuns dead code. The benchmark will now ignore the user-configured number of runs and use scalameter's default instead.

Additional Locations (1)

• mleap-benchmark/src/main/scala/ml/combust/mleap/benchmark/SparkTransformBenchmark.scala#L43-L44

 

[cursor]

Publish workflow uses incompatible Travis CI scripts

High Severity

The publish command was changed to source travis/extract.sh before running sbt. This script requires Travis CI-specific encrypted environment variables ($encrypted_21bd84d1dece_key and $encrypted_21bd84d1dece_iv) that aren't configured or passed to the Docker container in the GitHub Actions workflow. The workflow only passes GPG_SECRET_KEY, GPG_PASSPHRASE, and Sonatype/Twine credentials. When a release is published, the job will fail because the openssl decryption in travis/extract.sh will error due to missing key/iv variables.

 

[cursor]

Missing venv package for Python 3.11 tests

Medium Severity

The Dockerfile installs python3.9-venv and python3.10-venv packages but omits python3.11-venv. On Ubuntu with deadsnakes PPA, the -venv package provides the ensurepip module required for virtual environment creation. When the python311-tests workflow runs tox -e py311, tox will fail to create the virtual environment with "ensurepip is not available" error. This inconsistency (3.9 and 3.10 have venv packages, 3.11 doesn't) appears to be an oversight.