[pull] master from apache:master

.github/actions/setup-environment-action/action.yml

@@ -58,7 +58,7 @@ runs:
 
     - name: Cache tox environments
       if: ${{ inputs.python-version != '' && inputs.tox-cache == 'true' }}
-      uses: actions/cache@v3
+      uses: actions/cache@v6
       with:
         path: |
           sdks/python/target/.tox
@@ -71,7 +71,7 @@ runs:
 
     - name: Install Java
       if: ${{ inputs.java-version != '' }}
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         distribution: 'temurin'
         java-version: ${{ inputs.java-version == 'default' && '21' || inputs.java-version }}

.github/trigger_files/beam_PostCommit_Python_ValidatesRunner_Dataflow.json

@@ -1,4 +1,5 @@
 {
   "comment": "Modify this file in a trivial way to cause this test suite to run",
-  "modification": 5
+  "modification": 5,
+  "https://github.com/apache/beam/pull/38892": "UnboundedSource portable VR test"
 }

.github/trigger_files/beam_PostCommit_Python_ValidatesRunner_Flink.json

@@ -1,5 +1,6 @@
 {
   "https://github.com/apache/beam/pull/32648": "testing addition of Flink 1.19 support",
   "https://github.com/apache/beam/pull/34830": "testing",
-  "trigger-2026-04-04": "portable_runner expand_sdf opt-in"
+  "trigger-2026-04-04": "portable_runner expand_sdf opt-in",
+  "https://github.com/apache/beam/pull/38892": "UnboundedSource portable VR test"
 }

.github/trigger_files/beam_PostCommit_Python_ValidatesRunner_Spark.json

@@ -1,5 +1,6 @@
 {
   "https://github.com/apache/beam/pull/34830": "testing",
   "https://github.com/apache/beam/issues/35429": "testing",
-  "trigger-2026-04-04": "portable_runner expand_sdf opt-in"
+  "trigger-2026-04-04": "portable_runner expand_sdf opt-in",
+  "https://github.com/apache/beam/pull/38892": "UnboundedSource portable VR test"
 }

.github/trigger_files/beam_PostCommit_XVR_Spark3.json

@@ -1,3 +1,3 @@
 {
-  "trigger-2026-04-04": "portable_runner expand_sdf opt-in"
+  "trigger-2026-07-08": "portable_runner expand_sdf opt-in 2"
 }

.github/workflows/README.md

@@ -545,4 +545,5 @@ PostCommit Jobs run in a schedule against master branch and generally do not get
 | [ Infrastructure Policy Enforcer ](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_PolicyEnforcer.yml) | N/A | [![.github/workflows/beam_Infrastructure_PolicyEnforcer.yml](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_PolicyEnforcer.yml/badge.svg?event=schedule)](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_PolicyEnforcer.yml?query=event%3Aschedule) |
 | [ Modify the GCP User Roles according to the infra/users.yml file ](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_UsersPermissions.yml) | N/A | [![.github/workflows/beam_Infrastructure_UsersPermissions.yml](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_UsersPermissions.yml/badge.svg?event=schedule)](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_UsersPermissions.yml?query=event%3Aschedule) |
 | [ Service Account Keys Management ](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_ServiceAccountKeys.yml) | N/A | [![.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_ServiceAccountKeys.yml/badge.svg?event=schedule)](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_ServiceAccountKeys.yml?query=event%3Aschedule) |
+| [ Upgrade GCP Libraries BOM ](https://github.com/apache/beam/actions/workflows/beam_Upgrade_GCP_BOM.yml) | N/A | [![.github/workflows/beam_Upgrade_GCP_BOM.yml](https://github.com/apache/beam/actions/workflows/beam_Upgrade_GCP_BOM.yml/badge.svg?event=schedule)](https://github.com/apache/beam/actions/workflows/beam_Upgrade_GCP_BOM.yml?query=event%3Aschedule) |
 | [ Unmanaged Service Accounts Keys Audit ](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_AuditUnmanagedKeys.yml) | N/A | [![.github/workflows/beam_Infrastructure_AuditUnmanagedKeys.yml](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_AuditUnmanagedKeys.yml/badge.svg?event=schedule)](https://github.com/apache/beam/actions/workflows/beam_Infrastructure_AuditUnmanagedKeys.yml?query=event%3Aschedule) |

.github/workflows/beam_Upgrade_GCP_BOM.yml

@@ -0,0 +1,94 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Upgrade GCP Libraries BOM
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Weekly on Sundays at 00:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  checks: read
+  issues: read
+  statuses: read
+
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  upgrade_gcp_bom:
+    runs-on: [self-hosted, ubuntu-24.04, main]
+    name: Upgrade GCP BOM
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      - name: Setup environment
+        uses: ./.github/actions/setup-environment-action
+        with:
+          python-version: 3.11
+          java-version: default
+          go-version: default
+      - name: Check if new BOM is available
+        id: check_bom
+        run: python3 scripts/tools/bomupgrader.py --check
+      - name: Run bomupgrader
+        if: steps.check_bom.outputs.should_upgrade == 'true'
+        run: python3 scripts/tools/bomupgrader.py ${{ steps.check_bom.outputs.latest_version }}
+      - name: Install gh cli
+        if: steps.check_bom.outputs.should_upgrade == 'true'
+        uses: ./.github/actions/setup-gh-cli-linux
+      - name: Set git config
+        if: steps.check_bom.outputs.should_upgrade == 'true'
+        run: |
+          git config user.name $GITHUB_ACTOR
+          git config user.email actions@"$RUNNER_NAME".local
+      - name: Commit Changes and create PR
+        if: steps.check_bom.outputs.should_upgrade == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_EVENT: ${{ github.event_name }}
+          LATEST_VER: ${{ steps.check_bom.outputs.latest_version }}
+          CURRENT_VER: ${{ steps.check_bom.outputs.current_version }}
+        run: |
+          # Take the current date, subtract from a release cut date in the past (June 24, 2026),
+          # then get the num days % 42 (our release cadence is 42 days).
+          # This will ensure it only runs the week after a release branch has been cut.
+          days_diff=$(( ($(date +%s) - $(date --date="260624" +%s) )/(60*60*24)%42 ))
+          if [[ $GH_EVENT != 'workflow_dispatch' && $days_diff -gt 6 ]]; then
+            echo "Exiting early. We only update dependencies the week after we cut the release"
+            exit 0
+          fi
+          branchName=upgrade_gcp_bom_${LATEST_VER//./_}
+          git checkout -b $branchName
+          git add -A
+          git diff-index --quiet HEAD || gitdiff=$? || echo $?
+          if [[ $gitDiff != 0 ]]; then
+            echo "Changes are ready to commit"
+            git commit -m "Upgrade GCP Libraries BOM to ${LATEST_VER}" --quiet
+            git push origin $branchName --quiet
+
+            PR_BODY="This PR was created by automation. It upgrades the Google Cloud Platform Libraries BOM from **${CURRENT_VER}** to **${LATEST_VER}** and updates Netty, gRPC, Arrow, Gax, Protobuf, and OpenTelemetry versions to match.
+
+            Please review the changes and merge if all tests pass."
+
+            GITHUB_PR_URL=$(gh pr create --title "Upgrade GCP Libraries BOM to ${LATEST_VER}" --body "$PR_BODY" --label "dependencies" --base master)
+            echo "Link of the new PR: $GITHUB_PR_URL"
+          else
+            echo "No changes on the files"
+          fi

.github/workflows/build_release_candidate.yml

@@ -66,7 +66,7 @@ jobs:
           ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
           repository: apache/beam
       - name: Install Java 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: |
@@ -120,7 +120,7 @@ jobs:
             echo "Must provide an apache password to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
           fi
       - name: Install Java 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -277,7 +277,7 @@ jobs:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.1
       - name: Install Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: |
@@ -338,7 +338,7 @@ jobs:
         with:
           node-version: '16'
       - name: Install Java 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -573,7 +573,7 @@ jobs:
         with:
           python-version: '3.10'
       - name: Install Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '17'

.github/workflows/typescript_tests.yml

@@ -112,7 +112,7 @@ jobs:
         with:
           python-version: '3.10'
       - name: Install Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -180,7 +180,7 @@ jobs:
         with:
           python-version: '3.10'
       - name: Install Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '17'

contributor-docs/release-guide.md

@@ -1164,10 +1164,16 @@ At the end of the release, go to the GitHub milestones page and mark the recentl
 #### Update the Java BOM
 
 Google releases a BOM that pins compatible versions of their Java libraries.
-After the release, try updating the BOM to the latest version.
+After the release, an automated upgrade BOM PR is created or can be triggered manually.
 
-To do so, create a draft PR and run test suites following the instructions at
-https://github.com/apache/beam/blob/master/contributor-docs/java-dependency-upgrades.md.
+A PR should have already been created (and possibly merged) by github-actions bot, you should verify that this was done correctly
+by looking at open PRs from that bot - https://github.com/apache/beam/pulls/app%2Fgithub-actions
+
+If a PR has not been merged, drive it to completion.
+If no PR was created, triage any failures in https://github.com/apache/beam/actions/workflows/beam_Upgrade_GCP_BOM.yml and manually update the BOM,
+following https://github.com/apache/beam/blob/master/contributor-docs/java-dependency-upgrades.md or simply trigger the workflow again.
+
+##### Troubleshooting
 
 Triage the test failures and rerun any tests that seem potentially unrelated to the upgrade.
 If there are no test failures due to the BOM upgrade, request review and merge the PR as normal.

runners/spark/job-server/spark_job_server.gradle

@@ -267,13 +267,28 @@ tasks.register("validatesRunnerSickbay", Test) {
 def jobPort = BeamModulePlugin.getRandomPort()
 def artifactPort = BeamModulePlugin.getRandomPort()
 
+def sparkJobServerJvmArgs() {
+  def testJavaVer = project.findProperty('testJavaVersion') ? (project.property('testJavaVersion') as int) : JavaVersion.current().majorVersion.toInteger()
+  if (testJavaVer >= 17) {
+    return [
+      "--add-opens=java.base/sun.nio.ch=ALL-UNNAMED",
+      "--add-opens=java.base/java.nio=ALL-UNNAMED",
+      "--add-opens=java.base/java.util=ALL-UNNAMED",
+      "--add-opens=java.base/java.lang.invoke=ALL-UNNAMED"
+    ]
+  }
+  return []
+}
+
 def setupTask = project.tasks.register("sparkJobServerSetup", Exec) {
   dependsOn shadowJar
   def pythonDir = project.project(":sdks:python").projectDir
   def sparkJobServerJar = shadowJar.archivePath
+  def jvmArgs = sparkJobServerJvmArgs().join(' ')
+  def jvmArgsOpt = jvmArgs ? "--jvm_args \"${jvmArgs}\"" : ""
 
   executable 'sh'
-  args '-c', "$pythonDir/scripts/run_job_server.sh stop --group_id ${project.name} && $pythonDir/scripts/run_job_server.sh start --group_id ${project.name} --job_port ${jobPort} --artifact_port ${artifactPort} --job_server_jar ${sparkJobServerJar}"
+  args '-c', "$pythonDir/scripts/run_job_server.sh stop --group_id ${project.name} && $pythonDir/scripts/run_job_server.sh start --group_id ${project.name} --job_port ${jobPort} --artifact_port ${artifactPort} --job_server_jar ${sparkJobServerJar} ${jvmArgsOpt}"
 }
 
 def cleanupTask = project.tasks.register("sparkJobServerCleanup", Exec) {

scripts/tools/bomupgrader.py

@@ -20,6 +20,7 @@
 import re
 import subprocess
 import sys
+import urllib.request
 """
 This Python script is used for upgrading the GCP-BOM in BeamModulePlugin.
 Specifically, it
@@ -43,6 +44,59 @@
 # To format: yapf --style sdks/python/setup.cfg --in-place scripts/tools/bomupgrader.py
 
 
+def get_latest_bom():
+  url = "https://repo1.maven.org/maven2/com/google/cloud/libraries-bom/maven-metadata.xml"
+  with urllib.request.urlopen(url, timeout=15) as response:
+    xml = response.read().decode('utf-8')
+  match = re.search(r'<release>([^<]+)</release>', xml)
+  if match:
+    return match.group(1)
+  raise RuntimeError("Could not find latest release in Maven metadata")
+
+
+def get_current_bom():
+  path = "buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy"
+  with open(path) as f:
+    content = f.read()
+  match = re.search(
+      r'google_cloud_platform_libraries_bom\s*:\s*[\"\']com\.google\.cloud:libraries-bom:([0-9.]+)[\"\']',
+      content)
+  if match:
+    return match.group(1)
+  raise RuntimeError(
+      "Could not find current libraries-bom in BeamModulePlugin.groovy")
+
+
+def to_tuple(version_str):
+  parts = []
+  for part in version_str.split('.'):
+    match = re.match(r'^(\d+)', part)
+    parts.append(int(match.group(1)) if match else 0)
+  return tuple(parts)
+
+
+def check_bom():
+  latest = get_latest_bom()
+  current = get_current_bom()
+  print(f"Latest libraries-bom version: {latest}")
+  print(f"Current libraries-bom version: {current}")
+
+  should_upgrade = to_tuple(latest) > to_tuple(current)
+
+  github_output = os.getenv('GITHUB_OUTPUT')
+  if github_output:
+    with open(github_output, 'a') as f:
+      f.write(f"should_upgrade={str(should_upgrade).lower()}\n")
+      f.write(f"latest_version={latest}\n")
+      f.write(f"current_version={current}\n")
+
+  if should_upgrade:
+    print("A newer version of libraries-bom is available. Upgrade needed.")
+  else:
+    print("libraries-bom is up-to-date.")
+  return should_upgrade, latest
+
+
 class BeamModulePluginProcessor:
   # Known dependencies managed by GCP BOM and also used by Beam.
   # We only need to have one dependency for each project to figure out the target version
@@ -313,7 +367,16 @@ def run(self):
 if __name__ == '__main__':
   logging.getLogger().setLevel(logging.INFO)
   if len(sys.argv) < 2:
-    print("Usage: python scripts/tools/bomupgrader.py target_version")
+    print("Usage: python scripts/tools/bomupgrader.py [--check | latest | target_version]")
     exit(1)
-  processor = BeamModulePluginProcessor(sys.argv[1])
-  processor.run()
+
+  arg = sys.argv[1]
+  if arg in ['--check', '--check-only']:
+    check_bom()
+  else:
+    if arg in ['latest', '--latest']:
+      _, target_ver = check_bom()
+    else:
+      target_ver = arg
+    processor = BeamModulePluginProcessor(target_ver)
+    processor.run()

sdks/go.mod

@@ -29,7 +29,7 @@ require (
 	cloud.google.com/go/bigtable v1.50.0
 	cloud.google.com/go/datastore v1.24.0
 	cloud.google.com/go/profiler v0.6.0
-	cloud.google.com/go/pubsub v1.50.2
+	cloud.google.com/go/pubsub v1.50.3
 	cloud.google.com/go/spanner v1.92.0
 	cloud.google.com/go/storage v1.63.0
 	github.com/aws/aws-sdk-go-v2 v1.42.1
@@ -60,7 +60,7 @@ require (
 	golang.org/x/sync v0.21.0
 	golang.org/x/sys v0.46.0
 	golang.org/x/text v0.39.0
-	google.golang.org/api v0.287.0
+	google.golang.org/api v0.287.1
 	google.golang.org/genproto v0.0.0-20260523011958-0a33c5d7ca68
 	google.golang.org/grpc v1.82.0
 	google.golang.org/protobuf v1.36.11
@@ -204,5 +204,5 @@ require (
 	golang.org/x/tools v0.47.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect
 )