Merge upstream apache/cassandra-java-driver 4.19.2 and bump version to 4.19.2.0 - #895

Two upstream syncs were squash-merged: scylladb#467 (4.19.0) and scylladb#895 (4.19.2).
Their content is on scylla-4.x, but the apache tags are not ancestors, so
merge-base still points at 4.18.1. Merge 4.19.2 with the ours strategy:
no file changes, only the missing parent, which makes 4.19.0 through
4.19.2 reachable again.

Refs: DRIVER-1129

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Two upstream syncs were squash-merged: #467 (4.19.0) and #895 (4.19.2).
#1280 attempted this repair but was squash-merged too, so it landed as
an empty commit. Merge 4.19.2 with the ours strategy: no file changes,
only the missing parent, which makes 4.19.0 through 4.19.2 reachable.

Refs: DRIVER-1129

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

osgi-tests depends on com.scylladb:java-driver-guava-shaded, so
versionAsInProject() could never resolve the org.apache.cassandra
coordinate kept since scylladb#895, and every OSGi IT failed at configuration.
No CI lane runs the module; scylladb#1293 tracks that.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

osgi-tests depends on com.scylladb:java-driver-guava-shaded, so
versionAsInProject() could never resolve the org.apache.cassandra
coordinate kept since scylladb#895, and every OSGi IT failed at configuration.
No CI lane runs the module; scylladb#1293 tracks that.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

Two slips in BundleOptions. The shaded guava bundle kept the
org.apache.cassandra groupId from scylladb#895, which versionAsInProject()
cannot resolve through our dependencies.properties. The 4.19.3 merge
resolved the lz4Bundle() conflict to our side and dropped upstream's
CASSJAVA-122 sun.misc extension bundle, which lz4-java imports. Every
Osgi*IT is @ignore'd and no lane runs them (scylladb#1293), so neither showed.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

Two slips in BundleOptions. The shaded guava bundle kept the
org.apache.cassandra groupId from scylladb#895, which versionAsInProject()
cannot resolve through our dependencies.properties. The 4.19.3 merge
resolved the lz4Bundle() conflict to our side and dropped upstream's
CASSJAVA-122 sun.misc extension bundle, which lz4-java imports. Every
Osgi*IT is @ignore'd and no lane runs them (scylladb#1293), so neither showed.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

Two slips in BundleOptions. The shaded guava bundle kept the
org.apache.cassandra groupId from scylladb#895, which versionAsInProject()
cannot resolve through our dependencies.properties. The 4.19.3 merge
resolved the lz4Bundle() conflict to our side and dropped upstream's
CASSJAVA-122 sun.misc extension bundle, which lz4-java imports. Every
Osgi*IT is @ignore'd and no lane runs them (scylladb#1293), so neither showed.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* [maven-release-plugin] prepare for next development iteration

* Removing interface to Travis CI

Patch by Bret McGuire; reviewed by Andy Tolbert and Bret McGuire
reference: apache#2066

* Replace outdated link in README

patch by April Murphy; reviewed by Bret McGuire and Lukasz Antoniak
reference: apache#2064

* ninja-fix: Remove ASF donation message

* Update LZ4 and Netty dependencies for CVE response

The primary goal here is to address CVE-2025-12183. Netty includes a
dependency on vulnerable versions of lz4-java, so update to a fixed
version of Netty as well. On the C* server side, we opted to move to the
new community fork of lz4-java, so match that decision here
(CASSANDRA-21052).

patch by Abe Ratnofsky; reviewed by Francisco Guerrero for CASSJAVA-113

* Bump logback to most recent Java8-compatible version

patch by Bret McGuire; reviewed by Bret McGuire and Lukasz Antoniak
reference: apache#2051

* ninja-fix - adding an extra space to render the page correctly with mkdocs

I've been looking into details on custom codes and noticed that the there is an issue with rendering bullet points on the following page: https://apache.github.io/cassandra-java-driver/4.19.0/core/custom_codecs/

* ninja-fix Updating a few indented lists that were observed to not render correctly while working on the previous ninja-fix

* Re-work ordering clause support in query builder behind a single OrderingClause abstraction.  This allows for
custom impls to define their own logic for managing "ORDER BY" clauses.

patch by Bret McGuire; reviewed by Bret McGuire and Lukasz Antoniak
reference: apache#2047

* ninja-fix We apparently had some unformatted files slip in in the last commit

* CASSJAVA-122 Fix OSGi LZ4 test

patch by Lukasz Antoniak; reviewed by Bret McGuire and Lukasz Antoniak
reference: apache#2075

* Bump Jackson to 2.20.1

patch by Bret McGuire: reviewed by Bret McGuire and Lukasz Antoniak
reference: apache#2076

* CASSJAVA-108 Update ESRI (and remove org.json) dependencies

patch by Bret McGuire; reviewed by Bret McGuire and Lukasz Antoniak
reference: apache#2052

* ninja-fix Update Jenkins label to Jammy

* Revert "ninja-fix Update Jenkins label to Jammy"

This reverts commit de96ce8.

* Fix race condition in ClockSeqAndNodeContainer

patch by Jason Koch; reviewed by Lukasz Antoniak and Bret McGuire
reference: apache#2050

* CASSJAVA-3: Fix ordering of LIMIT and PER PARTITION LIMIT clauses

patch by David Stringer; reviewed by Lukasz Antoniak and Bret McGuire
reference: apache#2022

* CASSJAVA-30: Update CONTRIBUTING.md
patch by Jane He; reviewed by Bret McGuire and Andy Tolbert

* CASSJAVA-104: Fix Flaky tests
patch by Jane He; review by
Bret McGuire and Andy Tolbert

* CASSJAVA-109, CASSJAVA-117: Manual and API References after donation, Build CI for Java Driver Doc
Patch by Jane He and
Łukasz Antoniak; Reviewed by Bret McGuire

* [maven-release-plugin] prepare release 4.19.3

* [maven-release-plugin] prepare for next development iteration

* Revert "[maven-release-plugin] prepare for next development iteration"

This reverts commit 342088c.

* Revert "[maven-release-plugin] prepare release 4.19.3"

This reverts commit 375e4b5.

* Revert apache#2051 and replace it with something closer to the intent of the original PR (apache#1901).

The change that was actually merged attempted to bump us up to the most recent Java8-compatible
logback impl.  This moved us from 1.2.x to 1.3.x which in turn brought some dependency changes
that were excessive, especially for a patch release.

patch by Bret McGuire; reviewed by Andy Tolbert and Abe Ratnofsky
reference: apache#2088

* Add changelog for 4.19.3

* [maven-release-plugin] prepare release 4.19.3

* Revert "[maven-release-plugin] prepare release 4.19.3"

This reverts commit 8e2e70c.

* [maven-release-plugin] prepare release 4.19.3

* [maven-release-plugin] prepare for next development iteration

* Add security-model discoverability (AGENTS.md -> SECURITY.md -> security model)

Wires the conventional AGENTS.md -> SECURITY.md -> security model chain so automated tooling can mechanically discover the project's security model. No model content is changed.

Generated-by: Claude Opus 4.8 (1M context)

patch by Jarek Potiuk; reviewed by Bret McGuire
reference: apache#2092

* ninja-fix Fix equality operation for Geometry subclasses

* CASSJAVA-131: Add Retention Requirement to Jenkinsfile-asf
patch by Jane He; reviewed by Michael Semb Wever

* CASSJAVA-136 Ninja fix to correct geometry equality actually broke geometry equality

patch by Bret McGuire; reviewed by Jane He

* CASSJAVA-137 Bump Netty to 4.1.138

patch by Bret McGuire; reviewed by Andy Tolbert

* ninja-fix Changelog entries for 4.19.4

* ninja-fix Update scm entry in root pom.xml to match what was done for 3.x

* ninja-fix XML formatting fix for pom.xml

* [maven-release-plugin] prepare release 4.19.4

* docs: restore Sphinx link style in merged manual pages

Upstream rewrote manual links to mkdocs' dir/README.md form, and the
lines without conflicts merged that way. Put them back to our ../dir/
form: the docs hook rewrites both forms and GitHub renders both, so
this is source consistency rather than a build requirement. Record the
rule in CONTRIBUTING so the next sync does not rediscover it.
Upstream's anchor and typo fixes stay.

Refs: DRIVER-1126
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* build: keep the mapper-runtime revapi baseline

Upstream 4.19.3 reset its revapi baselines after its release; the
other modules kept ours through conflicts, but mapper-runtime merged
cleanly and lost its entries. They are DataStax-era ignores (JAVA-2369,
JAVA-2633, JAVA-2792), inert against the 4.19.2.3 baseline revapi
resolves, so this only keeps the file identical to the line.

Refs: DRIVER-1126
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* docs: fix anchors, nesting and a stale version from the merge

Upstream's link to #inflighthandler was dead because the fork had
renamed the heading to match its own broken link; restore upstream's
heading. Re-indent the custom codecs list so the runtime snippet stays
inside its item, and lift the lz4-java example to the pinned version.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* fix: compare geometries by the wrapped ESRI geometry

Since 4.19.3 equals() bound to OGCGeometry.equals(Object), which ESRI
1.x does not declare, so an application still on 1.x silently fell
back to identity comparison. Compare what that method compares, the
wrapped com.esri.core.geometry.Geometry and the spatial reference,
through API both 1.x and 2.x have; hashCode() already hashes the
geometry. The upgrade note no longer needs the 2.2.4 requirement.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* test: restore the OSGi bundle provisioning the merge broke

Two slips in BundleOptions. The shaded guava bundle kept the
org.apache.cassandra groupId from #895, which versionAsInProject()
cannot resolve through our dependencies.properties. The 4.19.3 merge
resolved the lz4Bundle() conflict to our side and dropped upstream's
CASSJAVA-122 sun.misc extension bundle, which lz4-java imports. Every
Osgi*IT is @ignore'd and no lane runs them (#1293), so neither showed.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* test: drop the prepared-cache retention the merge made redundant

Upstream 4.19.3 moved weakValues() from the protected constructor's
base builder into the public constructor's decorator, so a subclass
that passes its own decorator now gets a strong cache. Our
TestCqlPrepareAsyncProcessor only retained the cached futures to stop
them being collected mid-test. Take upstream's comment, drop the
retention set and the process() override, and require the removal
event again instead of checking it only when present.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* docs: correct the ordering javadoc taken from upstream

Select.orderBy() still promises to append to the current list, but
since the OrderingClause rework an ANN ordering is replaced instead,
and orderByAnnOf() replaces any column ordering; say so. ANN stands
for approximate, not adjacent, nearest neighbor.

Refs: DRIVER-1126
Co-Authored-By: Claude Fable 5.1 <[email protected]>

* docs: drop fork entries from the upstream changelog

changelog/README.md tracks upstream releases only. The 4.19.2.3 section
came in with feature PRs; the same changes are described in the upgrade
guide and the GitHub release notes.

Refs: DRIVER-1126
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* build: bump version to 4.19.4.0-SNAPSHOT

The line now carries upstream 4.19.4, so the next fork release
restarts the fourth component at 4.19.4.0, as 4.19.2.0 did after the
4.19.2 sync.

Refs: DRIVER-1126
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* test: await the prepared-cache removal event

Guava lowers the cache size before it calls the removal listener, so the
size wait alone left the removed-query-id assertion racing the event.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* fix: keep ANN ordering on an empty orderByIds map

The ordering-clause rework made orderByIds(emptyMap) replace an ANN
ordering with nothing; 4.19.2.x kept it. Document the map overloads'
replace behaviour and fix a typo in CqlPrepareAsyncProcessor.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: absurdfarce <[email protected]>
Co-authored-by: April I. Murphy <[email protected]>
Co-authored-by: Lukasz Antoniak <[email protected]>
Co-authored-by: Abe Ratnofsky <[email protected]>
Co-authored-by: absurdfarce <[email protected]>
Co-authored-by: Mikhail Laptev <[email protected]>
Co-authored-by: jasonk000 <[email protected]>
Co-authored-by: David Stringer <[email protected]>
Co-authored-by: janehe <[email protected]>
Co-authored-by: janehe <[email protected]>
Co-authored-by: Abe Ratnofsky <[email protected]>
Co-authored-by: Abe Ratnofsky <[email protected]>
Co-authored-by: Jarek Potiuk <[email protected]>
Co-authored-by: Jane He <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>