gqmelo · Jun 23, 2026 · Jun 23, 2026 · May 21, 2026 · Jun 23, 2026 · Jun 22, 2026
diff --git a/.github/workflows/docker_build_and_test.yml b/.github/workflows/docker_build_and_test.yml
@@ -54,7 +54,7 @@ jobs:
       run: |
         python docker_build_test.py kafka/test -tag=test -type=$IMAGE_TYPE -u=$KAFKA_URL
     - name: Run CVE scan
-      uses: lhotari/sandboxed-trivy-action@555963036b2012b44c1071508a236e569db28ebb # v1.0.1
+      uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1.0.2
       with:
         scan-type: 'image'
         scan-ref: 'kafka/test:test'

diff --git a/.github/workflows/docker_official_image_build_and_test.yml b/.github/workflows/docker_official_image_build_and_test.yml
@@ -53,7 +53,7 @@ jobs:
       run: |
         python docker_official_image_build_test.py kafka/test -tag=test -type=$IMAGE_TYPE -v=$KAFKA_VERSION
     - name: Run CVE scan
-      uses: lhotari/sandboxed-trivy-action@555963036b2012b44c1071508a236e569db28ebb # v1.0.1
+      uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1.0.2
       with:
         scan-type: 'image'
         scan-ref: 'kafka/test:test'

diff --git a/.github/workflows/docker_promote.yml b/.github/workflows/docker_promote.yml
@@ -31,11 +31,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
     - name: Login to Docker Hub
-      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ secrets.DOCKERHUB_USER }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}

diff --git a/.github/workflows/docker_rc_release.yml b/.github/workflows/docker_rc_release.yml
@@ -47,11 +47,11 @@ jobs:
         python -m pip install --upgrade pip
         pip install -r docker/requirements.txt
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
     - name: Login to Docker Hub
-      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ secrets.DOCKERHUB_USER }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}

diff --git a/.github/workflows/docker_scan.yml b/.github/workflows/docker_scan.yml
@@ -29,7 +29,7 @@ jobs:
         supported_image_tag: ['latest', '3.9.2', '4.0.1', '4.1.2', '4.2.0']
     steps:
       - name: Run CVE scan
-        uses: lhotari/sandboxed-trivy-action@555963036b2012b44c1071508a236e569db28ebb # v1.0.1
+        uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1.0.2
         if: always()
         with:
           scan-type: 'image'

diff --git a/LICENSE-binary b/LICENSE-binary
@@ -213,35 +213,35 @@ License Version 2.0:
 - commons-validator-1.10.1
 - hash4j-0.22.0
 - jackson-annotations-2.21
-- jackson-core-2.21.2
-- jackson-databind-2.21.2
-- jackson-dataformat-csv-2.21.2
-- jackson-dataformat-yaml-2.21.2
-- jackson-datatype-jdk8-2.21.2
-- jackson-jakarta-rs-base-2.21.2
-- jackson-jakarta-rs-json-provider-2.21.2
-- jackson-module-blackbird-2.21.2
-- jackson-module-jakarta-xmlbind-annotations-2.21.2
+- jackson-core-2.21.7
+- jackson-databind-2.21.7
+- jackson-dataformat-csv-2.21.7
+- jackson-dataformat-yaml-2.21.7
+- jackson-datatype-jdk8-2.21.7
+- jackson-jakarta-rs-base-2.21.7
+- jackson-jakarta-rs-json-provider-2.21.7
+- jackson-module-blackbird-2.21.7
+- jackson-module-jakarta-xmlbind-annotations-2.21.7
 - jakarta.inject-api-2.0.1
 - jakarta.validation-api-3.0.2
 - javassist-3.30.2-GA
-- jetty-alpn-client-12.0.34
-- jetty-client-12.0.34
-- jetty-ee10-servlet-12.0.34
-- jetty-ee10-servlets-12.0.34
-- jetty-http-12.0.34
-- jetty-io-12.0.34
-- jetty-security-12.0.34
-- jetty-server-12.0.34
-- jetty-session-12.0.34
-- jetty-util-12.0.34
+- jetty-alpn-client-12.0.37
+- jetty-client-12.0.37
+- jetty-ee10-servlet-12.0.37
+- jetty-ee10-servlets-12.0.37
+- jetty-http-12.0.37
+- jetty-io-12.0.37
+- jetty-security-12.0.37
+- jetty-server-12.0.37
+- jetty-session-12.0.37
+- jetty-util-12.0.37
 - jose4j-0.9.6
 - jspecify-1.0.0
-- log4j-api-2.25.4
-- log4j-core-2.25.4
-- log4j-slf4j-impl-2.25.4
-- log4j-1.2-api-2.25.4
-- lz4-java-1.10.2
+- log4j-api-2.25.5
+- log4j-core-2.25.5
+- log4j-slf4j-impl-2.25.5
+- log4j-1.2-api-2.25.5
+- lz4-java-1.11.4
 - maven-artifact-3.9.15
 - metrics-core-2.2.0
 - opentelemetry-proto-1.3.2-alpha
@@ -250,7 +250,7 @@ License Version 2.0:
 - scala-library-2.13.18
 - scala-logging_2.13-3.9.6
 - scala-reflect-2.13.18
-- snappy-java-1.1.10.7
+- snappy-java-1.1.10.11
 - snakeyaml-2.5
 - swagger-annotations-2.2.39
 
@@ -259,13 +259,6 @@ This product bundles various third-party components under other open source
 licenses. This section summarizes those components and their licenses.
 See licenses/ for text of these licenses.
 
----------------------------------------
-Eclipse Distribution License - v 1.0
-see: licenses/eclipse-distribution-license-1.0
-
-- jakarta.activation-api-2.1.0
-- jakarta.xml.bind-api-3.0.1
-
 ---------------------------------------
 Eclipse Public License - v 2.0
 see: licenses/eclipse-public-license-2.0
@@ -288,9 +281,10 @@ see: licenses/eclipse-public-license-2.0
 CDDL 1.1 + GPLv2 with classpath exception
 see: licenses/CDDL+GPL-1.1
 
+- jakarta.activation-api-2.1.0
 - jakarta.servlet-api-6.0.0
+- jakarta.xml.bind-api-3.0.1
 - javax.activation-api-1.2.0
-- javax.annotation-api-1.3.2
 - jaxb-api-2.3.1
 - activation-1.1.1
 
@@ -312,7 +306,9 @@ BSD 2-Clause
 ---------------------------------------
 BSD 3-Clause
 
-- jline-3.30.4, see: licenses/jline-BSD-3-clause
+- jline-native-3.30.15, see: licenses/jline-BSD-3-clause
+- jline-reader-3.30.15, see: licenses/jline-BSD-3-clause
+- jline-terminal-3.30.15, see: licenses/jline-BSD-3-clause
 - protobuf-java-3.25.5, see: licenses/protobuf-java-BSD-3-clause
 - jakarta.activation-2.0.1, see: licenses/jakarta-BSD-3-clause
 

diff --git a/build.gradle b/build.gradle
@@ -4252,7 +4252,7 @@ project(':connect:basic-auth-extension') {
 
     implementation libs.slf4jApi
     implementation libs.jakartaRsApi
-    implementation libs.jaxAnnotationApi
+    implementation libs.jakartaAnnotationApi
 
     testImplementation libs.bcpkix
     testImplementation libs.mockitoCore

diff --git a/checkstyle/import-control.xml b/checkstyle/import-control.xml
@@ -529,7 +529,7 @@
       <allow pkg= "javax.security.auth"/>
       <subpackage name="basic">
         <allow pkg="org.apache.kafka.connect.rest"/>
-        <allow pkg="javax.annotation"/>
+        <allow pkg="jakarta.annotation"/>
       </subpackage>
     </subpackage>
 

diff --git a/checkstyle/suppressions.xml b/checkstyle/suppressions.xml
@@ -123,7 +123,7 @@
               files="LoggingResource.java" />
 
     <suppress checks="ClassDataAbstractionCoupling"
-              files="(RestServer|AbstractHerder|DistributedHerder|Worker(Test)?).java"/>
+              files="(RestServer|AbstractHerder(Test)?|DistributedHerder|Worker(Test)?).java"/>
 
     <suppress checks="BooleanExpressionComplexity"
               files="JsonConverter.java"/>
@@ -204,7 +204,7 @@
 
     <!-- Streams tests -->
     <suppress checks="ClassFanOutComplexity"
-              files="(RecordCollectorTest|StreamsPartitionAssignorTest|StreamThreadTest|StreamTaskTest|TaskManagerTest|TopologyTestDriverTest|KafkaStreamsTest|EosIntegrationTest|RestoreIntegrationTest).java"/>
+              files="(RecordCollectorTest|StreamsPartitionAssignorTest|StreamThreadTest|StreamTaskTest|TaskManagerTest|TopologyTestDriverTest|KafkaStreamsTest|EosIntegrationTest|RestoreIntegrationTest|StreamsGroupHeartbeatRequestManagerTest).java"/>
 
     <suppress checks="MethodLength"
               files="(EosIntegrationTest|KStreamKStreamJoinTest|KStreamKStreamLeftJoinTest|KStreamKStreamOuterJoinTest|KStreamSlidingWindowAggregateTest|KTableKTableForeignKeyJoinIntegrationTest|RocksDBWindowStoreTest|TopologyTestDriverTest).java"/>
@@ -219,7 +219,7 @@
               files="(KStreamKStreamJoinTest|KTableKTableForeignKeyJoinIntegrationTest|RocksDBGenericOptionsToDbOptionsColumnFamilyOptionsAdapterTest|RelationalSmokeTest|MockProcessorContextStateStoreTest|IQv2StoreIntegrationTest|StreamsConfigTest).java"/>
 
     <suppress checks="JavaNCSS"
-              files="(KStreamKStreamJoinTest|StreamTaskTest|StreamThreadTest|TaskManagerTest|TopologyTestDriverTest).java"/>
+              files="(KStreamKStreamJoinTest|StoreChangelogReaderTest|StreamTaskTest|StreamThreadTest|TaskManagerTest|TopologyTestDriverTest).java"/>
 
     <suppress checks="NPathComplexity"
               files="(KStreamKStreamJoinTest|KTableKTableForeignKeyJoinIntegrationTest|RelationalSmokeTest|MockProcessorContextStateStoreTest|TopologyTestDriverTest|IQv2StoreIntegrationTest).java"/>
@@ -317,9 +317,11 @@
               files="(LocalLog|LogLoader|LogValidator|RemoteLogManager|RemoteIndexCache|UnifiedLog).java"/>
     <suppress checks="ParameterNumber"
               files="(LogLoader|UnifiedLog).java"/>
+    <suppress checks="ParameterNumber"
+              files="[/\\]Cleaner\.java"/>
     <suppress checks="(ClassDataAbstractionCoupling|ClassFanOutComplexity)"
               files="(UnifiedLog|RemoteLogManager|RemoteLogManagerTest|UnifiedLogTest).java"/>
-    <suppress checks="MethodLength" files="RemoteLogManagerConfig.java"/>
+    <suppress checks="MethodLength" files="(RemoteLogManagerConfig|UnifiedLog).java"/>
     <suppress checks="JavaNCSS" files="(RemoteLogManagerTest|UnifiedLogTest).java"/>
 
     <!-- benchmarks -->

diff --git a/...ation-tests/src/test/java/org/apache/kafka/clients/admin/AlterConfigsIntegrationTest.java b/...ation-tests/src/test/java/org/apache/kafka/clients/admin/AlterConfigsIntegrationTest.java
@@ -0,0 +1,139 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.kafka.clients.admin;
+
+import org.apache.kafka.clients.CommonClientConfigs;
+import org.apache.kafka.common.config.AbstractConfig;
+import org.apache.kafka.common.config.ConfigResource;
+import org.apache.kafka.common.config.SaslConfigs;
+import org.apache.kafka.common.config.provider.FileConfigProvider;
+import org.apache.kafka.common.errors.ClusterAuthorizationException;
+import org.apache.kafka.common.errors.InvalidRequestException;
+import org.apache.kafka.common.security.auth.SecurityProtocol;
+import org.apache.kafka.common.security.plain.PlainLoginModule;
+import org.apache.kafka.common.test.ClusterInstance;
+import org.apache.kafka.common.test.JaasUtils;
+import org.apache.kafka.common.test.api.ClusterTest;
+import org.apache.kafka.server.config.ServerConfigs;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ExecutionException;
+
+import static org.apache.kafka.common.config.AbstractConfig.CONFIG_PROVIDERS_CONFIG;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class AlterConfigsIntegrationTest {
+
+    private final ClusterInstance clusterInstance;
+    private Path file;
+
+    AlterConfigsIntegrationTest(ClusterInstance clusterInstance) {
+        this.clusterInstance = clusterInstance;
+    }
+
+    @BeforeEach
+    public void setup() throws IOException {
+        file = Files.createTempFile("provider", ".properties");
+        Files.writeString(file, "key=token");
+    }
+
+    @AfterEach
+    public void teardown() throws IOException {
+        Files.deleteIfExists(file);
+    }
+
+    @ClusterTest
+    public void testAlterConfigsWithConfigProviders() {
+        checkAlterConfigs(Map.of(), InvalidRequestException.class, "token", true);
+    }
+
+    @ClusterTest
+    public void testAlterConfigsWithConfigProvidersAndValidatorRejection() throws IOException {
+        Files.writeString(file, "key=" + Long.MAX_VALUE);
+        checkAlterConfigs(Map.of(), InvalidRequestException.class, String.valueOf(Long.MAX_VALUE), true);
+    }
+
+    @ClusterTest
+    public void testAlterConfigsRespectsConfigProviderAllowlist() {
+        String previous = System.getProperty(AbstractConfig.AUTOMATIC_CONFIG_PROVIDERS_PROPERTY);
+        try {
+            System.setProperty(AbstractConfig.AUTOMATIC_CONFIG_PROVIDERS_PROPERTY, "none");
+            checkAlterConfigs(Map.of(), InvalidRequestException.class, "token", false);
+        } finally {
+            if (previous == null) {
+                System.clearProperty(AbstractConfig.AUTOMATIC_CONFIG_PROVIDERS_PROPERTY);
+            } else {
+                System.setProperty(AbstractConfig.AUTOMATIC_CONFIG_PROVIDERS_PROPERTY, previous);
+            }
+        }
+    }
+
+    @ClusterTest(
+            brokerSecurityProtocol = SecurityProtocol.SASL_PLAINTEXT,
+            controllerSecurityProtocol = SecurityProtocol.SASL_PLAINTEXT)
+    public void testAlterConfigsWithConfigProvidersWithoutAcls() {
+        Map<String, Object> adminConfig = Map.of(
+            CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, SecurityProtocol.SASL_PLAINTEXT.name,
+            SaslConfigs.SASL_MECHANISM, "PLAIN",
+            SaslConfigs.SASL_JAAS_CONFIG,
+                PlainLoginModule.class.getName() + " required username=\"" + JaasUtils.KAFKA_PLAIN_USER1 +
+                "\" password=\"" + JaasUtils.KAFKA_PLAIN_USER1_PASSWORD + "\";");
+        checkAlterConfigs(adminConfig, ClusterAuthorizationException.class, "token", true);
+    }
+
+    private void checkAlterConfigs(Map<String, Object> adminConfig, Class<? extends Throwable> expectedCause, String value, boolean placeholder) {
+        try (Admin admin = clusterInstance.admin(adminConfig)) {
+            ConfigResource brokerResource = new ConfigResource(ConfigResource.Type.BROKER, "");
+            Map<ConfigResource, Collection<AlterConfigOp>> alterations = Map.of(brokerResource, configProviderOps());
+            ExecutionException ee = assertThrows(ExecutionException.class,
+                    () -> admin.incrementalAlterConfigs(alterations).all().get());
+            assertInstanceOf(expectedCause, ee.getCause());
+            String message = ee.getCause().getMessage();
+            assertFalse(message.contains(value));
+            if (expectedCause == InvalidRequestException.class) {
+                if (placeholder) {
+                    assertTrue(message.contains("${file:"));
+                } else {
+                    assertTrue(message.contains(FileConfigProvider.class.getName() + " is not allowed"));
+                }
+            }
+        }
+    }
+
+    private Collection<AlterConfigOp> configProviderOps() {
+        return List.of(
+            new AlterConfigOp(new ConfigEntry(CONFIG_PROVIDERS_CONFIG, "file"),
+                    AlterConfigOp.OpType.SET),
+            new AlterConfigOp(new ConfigEntry(
+                CONFIG_PROVIDERS_CONFIG + ".file.class", FileConfigProvider.class.getName()),
+                    AlterConfigOp.OpType.SET),
+            new AlterConfigOp(new ConfigEntry(ServerConfigs.NUM_IO_THREADS_CONFIG, "${file:" + file.toAbsolutePath() + ":key}"),
+                    AlterConfigOp.OpType.SET)
+        );
+    }
+}
diff --git a/clients/src/main/java/org/apache/kafka/clients/NetworkClient.java b/clients/src/main/java/org/apache/kafka/clients/NetworkClient.java
@@ -1393,6 +1393,13 @@ public long maybeUpdate(long now) {
             if (timeToNextUpdate > 0)
                 return timeToNextUpdate;
 
+            // The node connection params can change while having the same node id hence check if the cached
+            // sticky node has not changed, if changed then reset the sticky node.
+            if (stickyNode != null && isNodeChanged(stickyNode)) {
+                log.debug("Telemetry stickyNode {} either is no longer in metadata or changed, clearing it.", stickyNode);
+                stickyNode = null;
+            }
+
             // Per KIP-714, let's continue to re-use the same broker for as long as possible.
             if (stickyNode == null) {
                 stickyNode = leastLoadedNode(now).node();
@@ -1442,6 +1449,13 @@ private long maybeUpdate(long now, Node node) {
             return Long.MAX_VALUE;
         }
 
+        private boolean isNodeChanged(Node node) {
+            Node newNode = metadataUpdater.fetchNodes().stream()
+                    .filter(n -> n.id() == node.id())
+                    .findFirst().orElse(null);
+            return newNode == null || !newNode.equals(node);
+        }
+
         public void handleResponse(GetTelemetrySubscriptionsResponse response) {
             clientTelemetrySender.handleResponse(response);
         }

diff --git a/clients/src/main/java/org/apache/kafka/clients/consumer/internals/AbstractCoordinator.java b/clients/src/main/java/org/apache/kafka/clients/consumer/internals/AbstractCoordinator.java
@@ -1561,6 +1561,7 @@ public void onFailure(RuntimeException e) {
             } catch (AuthenticationException e) {
                 log.error("An authentication error occurred in the heartbeat thread", e);
                 setFailureCause(e);
+                requestRejoin("authentication error in heartbeat thread");
             } catch (GroupAuthorizationException e) {
                 log.error("A group authorization error occurred in the heartbeat thread", e);
                 setFailureCause(e);