upgrade org.apache.parquet:parquet-avro to to 1.15.2

.github/trigger_files/IO_Iceberg_Integration_Tests.json

@@ -1,4 +1,4 @@
 {
     "comment": "Modify this file in a trivial way to cause this test suite to run.",
-    "modification": 1
+    "modification": 6
 }

.github/trigger_files/IO_Iceberg_Integration_Tests_Dataflow.json

@@ -1,5 +1,5 @@
 {
   "comment": "Modify this file in a trivial way to cause this test suite to run.",
-  "modification": 2,
+  "modification": 3,
   "https://github.com/apache/beam/pull/35159": "moving WindowedValue and making an interface"
 }

.github/trigger_files/IO_Iceberg_Managed_Integration_Tests_Dataflow.json

@@ -1,4 +1,4 @@
 {
   "comment": "Modify this file in a trivial way to cause this test suite to run.",
-  "modification": 1
+  "modification": 3
 }

it/google-cloud-platform/build.gradle

@@ -47,9 +47,9 @@ dependencies {
     implementation library.java.jackson_databind
     implementation 'org.apache.hadoop:hadoop-common:3.3.5'
     implementation 'org.apache.avro:avro:1.11.1'
-    implementation 'org.apache.parquet:parquet-avro:1.12.0'
-    implementation 'org.apache.parquet:parquet-common:1.12.0'
-    implementation 'org.apache.parquet:parquet-hadoop:1.12.0'
+    implementation 'org.apache.parquet:parquet-avro:1.15.2'
+    implementation 'org.apache.parquet:parquet-common:1.15.2'
+    implementation 'org.apache.parquet:parquet-hadoop:1.15.2'
     implementation 'org.apache.commons:commons-lang3:3.9'
     implementation library.java.gax
     implementation library.java.google_api_common

sdks/java/io/expansion-service/build.gradle

@@ -36,6 +36,8 @@ configurations.runtimeClasspath {
   // Pin avro to 1.11.4 due to https://github.com/apache/beam/issues/34968
   // cannot upgrade this to the latest version due to https://github.com/apache/beam/issues/34993
   resolutionStrategy.force 'org.apache.avro:avro:1.11.4'
+  // force parquet-avro:1.15.2 to fix CVE-2025-46762
+  resolutionStrategy.force 'org.apache.parquet:parquet-avro:1.15.2'
 
   // Pin Jetty version due to hadoop 3.4.1 using 9.4.53.v20231009, which had
   // two direct vulnerabilities.  There is one dependency vulnerability left

sdks/java/io/file-schema-transform/build.gradle

@@ -32,7 +32,7 @@ configurations.implementation {
     }
 }
 
-def parquet_version = "1.15.1"
+def parquet_version = "1.15.2"
 
 dependencies {
     implementation library.java.avro

sdks/java/io/iceberg/build.gradle

@@ -37,8 +37,11 @@ def hadoopVersions = [
 
 hadoopVersions.each {kv -> configurations.create("hadoopVersion$kv.key")}
 
+// we cannot upgrade this since the newer iceberg requires Java 11
+// many other modules like examples/expansion use Java 8 and have the iceberg dependency
+// def iceberg_version = "1.9.0"
 def iceberg_version = "1.6.1"
-def parquet_version = "1.15.1"
+def parquet_version = "1.15.2"
 def orc_version = "1.9.2"
 def hive_version = "3.1.3"
 

sdks/java/io/iceberg/src/main/java/org/apache/beam/sdk/io/iceberg/IcebergUtils.java

@@ -111,8 +111,9 @@ private static Schema.FieldType icebergTypeToBeamFieldType(final Type type) {
         return Schema.FieldType.map(
             icebergTypeToBeamFieldType(type.asMapType().keyType()),
             icebergTypeToBeamFieldType(type.asMapType().valueType()));
+      default:
+        throw new RuntimeException("Unrecognized Iceberg Type: " + type.typeId());
     }
-    throw new RuntimeException("Unrecognized IcebergIO Type");
   }
 
   private static Schema.Field icebergFieldToBeamField(final Types.NestedField field) {
@@ -379,6 +380,9 @@ private static void copyFieldIntoRecord(Record rec, Types.NestedField field, Row
         }
         Optional.ofNullable(icebergMap).ifPresent(v -> rec.setField(name, v));
         break;
+      default:
+        // Do nothing for unsupported types
+        break;
     }
   }
 

sdks/java/io/parquet/build.gradle

@@ -35,7 +35,7 @@ def hadoopVersions = [
 
 hadoopVersions.each {kv -> configurations.create("hadoopVersion$kv.key")}
 
-def parquet_version = "1.15.1"
+def parquet_version = "1.15.2"
 
 dependencies {
   implementation library.java.vendored_guava_32_1_2_jre