From 34c1d590ad1cbebd234415de6f01460ee03aa5cb Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 25 Aug 2025 20:10:06 +0200
Subject: [PATCH 01/23] Update sbt, scripted-plugin to 1.11.4 (#910)

---
 project/build.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/project/build.properties b/project/build.properties
index 138bc7a5..aced3065 100755
--- a/project/build.properties
+++ b/project/build.properties
@@ -1,2 +1,2 @@
-sbt.version=1.11.3
+sbt.version=1.11.4
 

From d8d81aa32c3ac92849291c14bd1000b2fc6bb275 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 25 Aug 2025 11:10:15 -0700
Subject: [PATCH 02/23] Bump actions/checkout from 4 to 5 (#909)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/CI.yml       | 6 +++---
 .github/workflows/release.yml  | 2 +-
 .github/workflows/snapshot.yml | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 4c49c411..a61fb3fa 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -15,7 +15,7 @@ jobs:
       docs: ${{ steps.changes.outputs.docs }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - uses: dorny/paths-filter@v3
         id: changes
         with:
@@ -39,7 +39,7 @@ jobs:
     needs: changes
     if: ${{ needs.changes.outputs.code == 'true' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: jcheckstyle
         run: ./sbt jcheckStyle
       - name: scalafmtCheckAll
@@ -54,7 +54,7 @@ jobs:
       matrix:
         java: ['8', '11', '17', '21', '24']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: actions/setup-java@v4
         with:
           distribution: 'zulu'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c3dca7c2..6d1aa99f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 10000
       # Fetch all tags so that sbt-dynver can find the previous release version
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 4cc85866..eac8cfbb 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -16,7 +16,7 @@ jobs:
     name: Publish snapshots
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 10000
       # Fetch all tags so that sbt-dynver can find the previous release version

From 75482c5aec6bfafad7e17ce4e75c7abff682eec8 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 25 Aug 2025 20:10:50 +0200
Subject: [PATCH 03/23] Update airframe-json, airspec to 2025.1.16 (#912)

---
 build.sbt | 184 +++++++++++++++++++++++++++++++-----------------------
 1 file changed, 107 insertions(+), 77 deletions(-)

diff --git a/build.sbt b/build.sbt
index 135145fd..547e1ebe 100644
--- a/build.sbt
+++ b/build.sbt
@@ -1,11 +1,9 @@
 Global / onChangedBuildSource := ReloadOnSourceChanges
 
 // For performance testing, ensure each test run one-by-one
-Global / concurrentRestrictions := Seq(
-  Tags.limit(Tags.Test, 1)
-)
+Global / concurrentRestrictions := Seq(Tags.limit(Tags.Test, 1))
 
-val AIRFRAME_VERSION = "2025.1.14"
+val AIRFRAME_VERSION = "2025.1.16"
 
 // Use dynamic snapshot version strings for non tagged versions
 ThisBuild / dynverSonatypeSnapshots := true
@@ -15,37 +13,65 @@ ThisBuild / dynverSeparator := "-"
 // Publishing metadata
 ThisBuild / homepage := Some(url("https://msgpack.org/"))
 ThisBuild / licenses := Seq("Apache-2.0" -> url("http://www.apache.org/licenses/LICENSE-2.0.txt"))
-ThisBuild / scmInfo := Some(
-  ScmInfo(
-    url("https://github.com/msgpack/msgpack-java"),
-    "scm:git@github.com:msgpack/msgpack-java.git"
+ThisBuild / scmInfo  :=
+  Some(
+    ScmInfo(
+      url("https://github.com/msgpack/msgpack-java"),
+      "scm:git@github.com:msgpack/msgpack-java.git"
+    )
   )
-)
-ThisBuild / developers := List(
-  Developer(id = "frsyuki", name = "Sadayuki Furuhashi", email = "frsyuki@users.sourceforge.jp", url = url("https://github.com/frsyuki")),
-  Developer(id = "muga", name = "Muga Nishizawa", email = "muga.nishizawa@gmail.com", url = url("https://github.com/muga")),
-  Developer(id = "oza", name = "Tsuyoshi Ozawa", email = "ozawa.tsuyoshi@gmail.com", url = url("https://github.com/oza")),
-  Developer(id = "komamitsu", name = "Mitsunori Komatsu", email = "komamitsu@gmail.com", url = url("https://github.com/komamitsu")),
-  Developer(id = "xerial", name = "Taro L. Saito", email = "leo@xerial.org", url = url("https://github.com/xerial"))
-)
 
+ThisBuild / developers :=
+  List(
+    Developer(
+      id = "frsyuki",
+      name = "Sadayuki Furuhashi",
+      email = "frsyuki@users.sourceforge.jp",
+      url = url("https://github.com/frsyuki")
+    ),
+    Developer(
+      id = "muga",
+      name = "Muga Nishizawa",
+      email = "muga.nishizawa@gmail.com",
+      url = url("https://github.com/muga")
+    ),
+    Developer(
+      id = "oza",
+      name = "Tsuyoshi Ozawa",
+      email = "ozawa.tsuyoshi@gmail.com",
+      url = url("https://github.com/oza")
+    ),
+    Developer(
+      id = "komamitsu",
+      name = "Mitsunori Komatsu",
+      email = "komamitsu@gmail.com",
+      url = url("https://github.com/komamitsu")
+    ),
+    Developer(
+      id = "xerial",
+      name = "Taro L. Saito",
+      email = "leo@xerial.org",
+      url = url("https://github.com/xerial")
+    )
+  )
 
-val buildSettings = Seq[Setting[_]](
-  organization := "org.msgpack",
-  organizationName := "MessagePack",
+val buildSettings = Seq[Setting[?]](
+  organization         := "org.msgpack",
+  organizationName     := "MessagePack",
   organizationHomepage := Some(url("http://msgpack.org/")),
-  description := "MessagePack for Java",
-  scalaVersion := "3.7.1",
-  Test / logBuffered := false,
+  description          := "MessagePack for Java",
+  scalaVersion         := "3.7.1",
+  Test / logBuffered   := false,
   // msgpack-java should be a pure-java library, so remove Scala specific configurations
-  autoScalaLibrary := false,
-  crossPaths := false,
+  autoScalaLibrary  := false,
+  crossPaths        := false,
   publishMavenStyle := true,
   // JVM options for building
   scalacOptions ++= Seq("-encoding", "UTF-8", "-deprecation", "-unchecked", "-feature"),
   Test / javaOptions ++= Seq("-ea"),
   javacOptions ++= Seq("-source", "1.8", "-target", "1.8"),
-  Compile / compile / javacOptions ++= Seq("-encoding", "UTF-8", "-Xlint:unchecked", "-Xlint:deprecation"),
+  Compile / compile / javacOptions ++=
+    Seq("-encoding", "UTF-8", "-Xlint:unchecked", "-Xlint:deprecation"),
   // Use lenient validation mode when generating Javadoc (for Java8)
   doc / javacOptions := {
     val opts = Seq("-source", "1.8")
@@ -58,17 +84,21 @@ val buildSettings = Seq[Setting[_]](
   // Add sonatype repository settings
   publishTo := {
     val centralSnapshots = "https://central.sonatype.com/repository/maven-snapshots/"
-    if (isSnapshot.value) Some("central-snapshots" at centralSnapshots)
-    else localStaging.value
+    if (isSnapshot.value)
+      Some("central-snapshots" at centralSnapshots)
+    else
+      localStaging.value
   },
   // Style check config: (sbt-jchekcstyle)
   jcheckStyleConfig := "facebook",
   // Run jcheckstyle both for main and test codes
-  Compile / compile := ((Compile / compile) dependsOn (Compile / jcheckStyle)).value,
-  Test / compile := ((Test / compile) dependsOn (Test / jcheckStyle)).value
+  Compile / compile :=
+    ((Compile / compile) dependsOn (Compile / jcheckStyle)).value,
+  Test / compile :=
+    ((Test / compile) dependsOn (Test / jcheckStyle)).value
 )
 
-val junitJupiter = "org.junit.jupiter" % "junit-jupiter" % "5.11.4" % "test"
+val junitJupiter = "org.junit.jupiter" % "junit-jupiter"        % "5.11.4" % "test"
 val junitVintage = "org.junit.vintage" % "junit-vintage-engine" % "5.11.4" % "test"
 
 // Project settings
@@ -77,8 +107,8 @@ lazy val root = Project(id = "msgpack-java", base = file("."))
     buildSettings,
     // Do not publish the root project
     publishArtifact := false,
-    publish := {},
-    publishLocal := {}
+    publish         := {},
+    publishLocal    := {}
   )
   .aggregate(msgpackCore, msgpackJackson)
 
@@ -86,58 +116,58 @@ lazy val msgpackCore = Project(id = "msgpack-core", base = file("msgpack-core"))
   .enablePlugins(SbtOsgi)
   .settings(
     buildSettings,
-    description := "Core library of the MessagePack for Java",
+    description                 := "Core library of the MessagePack for Java",
     OsgiKeys.bundleSymbolicName := "org.msgpack.msgpack-core",
-    OsgiKeys.exportPackage := Seq(
-      // TODO enumerate used packages automatically
-      "org.msgpack.core",
-      "org.msgpack.core.annotations",
-      "org.msgpack.core.buffer",
-      "org.msgpack.value",
-      "org.msgpack.value.impl"
-    ),
+    OsgiKeys.exportPackage      :=
+      Seq(
+        // TODO enumerate used packages automatically
+        "org.msgpack.core",
+        "org.msgpack.core.annotations",
+        "org.msgpack.core.buffer",
+        "org.msgpack.value",
+        "org.msgpack.value.impl"
+      ),
     testFrameworks += new TestFramework("wvlet.airspec.Framework"),
-    Test / javaOptions ++= Seq(
-      // --add-opens is not available in JDK8
-      "-XX:+IgnoreUnrecognizedVMOptions",
-      "--add-opens=java.base/java.nio=ALL-UNNAMED",
-      "--add-opens=java.base/sun.nio.ch=ALL-UNNAMED"
-    ),
+    Test / javaOptions ++=
+      Seq(
+        // --add-opens is not available in JDK8
+        "-XX:+IgnoreUnrecognizedVMOptions",
+        "--add-opens=java.base/java.nio=ALL-UNNAMED",
+        "--add-opens=java.base/sun.nio.ch=ALL-UNNAMED"
+      ),
     Test / fork := true,
-    libraryDependencies ++= Seq(
-      // msgpack-core should have no external dependencies
-      junitJupiter,
-      junitVintage,
-      "org.wvlet.airframe" %% "airframe-json" % AIRFRAME_VERSION % "test",
-      "org.wvlet.airframe" %% "airspec"       % AIRFRAME_VERSION % "test",
-      // Add property testing support with forAll methods
-      "org.scalacheck" %% "scalacheck" % "1.18.1" % "test",
-      // For performance comparison with msgpack v6
-      "org.msgpack" % "msgpack" % "0.6.12" % "test",
-      // For integration test with Akka
-      "com.typesafe.akka"      %% "akka-actor"              % "2.6.20" % "test",
-      "org.scala-lang.modules" %% "scala-collection-compat" % "2.13.0" % "test"
-    )
+    libraryDependencies ++=
+      Seq(
+        // msgpack-core should have no external dependencies
+        junitJupiter,
+        junitVintage,
+        "org.wvlet.airframe" %% "airframe-json" % AIRFRAME_VERSION % "test",
+        "org.wvlet.airframe" %% "airspec"       % AIRFRAME_VERSION % "test",
+        // Add property testing support with forAll methods
+        "org.scalacheck" %% "scalacheck" % "1.18.1" % "test",
+        // For performance comparison with msgpack v6
+        "org.msgpack" % "msgpack" % "0.6.12" % "test",
+        // For integration test with Akka
+        "com.typesafe.akka"      %% "akka-actor"              % "2.6.20" % "test",
+        "org.scala-lang.modules" %% "scala-collection-compat" % "2.13.0" % "test"
+      )
   )
 
-lazy val msgpackJackson =
-  Project(id = "msgpack-jackson", base = file("msgpack-jackson"))
-    .enablePlugins(SbtOsgi)
-    .settings(
-      buildSettings,
-      name := "jackson-dataformat-msgpack",
-      description := "Jackson extension that adds support for MessagePack",
-      OsgiKeys.bundleSymbolicName := "org.msgpack.msgpack-jackson",
-      OsgiKeys.exportPackage := Seq(
-        "org.msgpack.jackson",
-        "org.msgpack.jackson.dataformat"
-      ),
-      libraryDependencies ++= Seq(
+lazy val msgpackJackson = Project(id = "msgpack-jackson", base = file("msgpack-jackson"))
+  .enablePlugins(SbtOsgi)
+  .settings(
+    buildSettings,
+    name                        := "jackson-dataformat-msgpack",
+    description                 := "Jackson extension that adds support for MessagePack",
+    OsgiKeys.bundleSymbolicName := "org.msgpack.msgpack-jackson",
+    OsgiKeys.exportPackage      := Seq("org.msgpack.jackson", "org.msgpack.jackson.dataformat"),
+    libraryDependencies ++=
+      Seq(
         "com.fasterxml.jackson.core" % "jackson-databind" % "2.18.4",
         junitJupiter,
         junitVintage,
         "org.apache.commons" % "commons-math3" % "3.6.1" % "test"
       ),
-      testOptions += Tests.Argument(TestFrameworks.JUnit, "-v")
-    )
-    .dependsOn(msgpackCore)
+    testOptions += Tests.Argument(TestFrameworks.JUnit, "-v")
+  )
+  .dependsOn(msgpackCore)

From 12062270a5ee2a0c754a11cef4b0a03e0f0078e9 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 25 Aug 2025 20:11:04 +0200
Subject: [PATCH 04/23] Update scalafmt-core to 3.9.9 (#907)

* Update scalafmt-core to 3.9.9

* Reformat with scalafmt 3.9.9

Executed command: scalafmt --non-interactive

* Add 'Reformat with scalafmt 3.9.9' to .git-blame-ignore-revs
---
 .git-blame-ignore-revs | 2 ++
 .scalafmt.conf         | 2 +-
 project/plugins.sbt    | 8 ++++----
 3 files changed, 7 insertions(+), 5 deletions(-)
 create mode 100644 .git-blame-ignore-revs

diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 00000000..285ed6f4
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,2 @@
+# Scala Steward: Reformat with scalafmt 3.9.9
+424ec59eb4865feb383ca53b4278dfb8b9b6c36c
diff --git a/.scalafmt.conf b/.scalafmt.conf
index e8563baf..a4b995aa 100644
--- a/.scalafmt.conf
+++ b/.scalafmt.conf
@@ -1,4 +1,4 @@
-version = 3.9.8
+version = 3.9.9
 project.layout = StandardConvention
 runner.dialect = scala3
 maxColumn = 100
diff --git a/project/plugins.sbt b/project/plugins.sbt
index 5bc49937..18f414ea 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -1,10 +1,10 @@
-addSbtPlugin("com.github.sbt" % "sbt-pgp"      % "2.3.1")
+addSbtPlugin("com.github.sbt" % "sbt-pgp" % "2.3.1")
 // TODO: Fixes jacoco error:
 // java.lang.NoClassDefFoundError: Could not initialize class org.jacoco.core.internal.flow.ClassProbesAdapter
 //addSbtPlugin("com.github.sbt"   % "sbt-jacoco"      % "3.3.0")
-addSbtPlugin("org.xerial.sbt"   % "sbt-jcheckstyle" % "0.2.1")
+addSbtPlugin("org.xerial.sbt" % "sbt-jcheckstyle" % "0.2.1")
 addSbtPlugin("com.github.sbt" % "sbt-osgi"        % "0.10.0")
-addSbtPlugin("org.scalameta"    % "sbt-scalafmt"    % "2.5.5")
-addSbtPlugin("com.github.sbt"     % "sbt-dynver"      % "5.1.1")
+addSbtPlugin("org.scalameta"  % "sbt-scalafmt"    % "2.5.5")
+addSbtPlugin("com.github.sbt" % "sbt-dynver"      % "5.1.1")
 
 scalacOptions ++= Seq("-deprecation", "-feature")

From e93fb75eed2d8ca6e41993d4dad3f9c68d33be29 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 30 Aug 2025 18:24:48 -0700
Subject: [PATCH 05/23] Bump actions/setup-java from 4 to 5 (#914)

Bumps [actions/setup-java](https://github.com/actions/setup-java) from 4 to 5.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/CI.yml       | 2 +-
 .github/workflows/release.yml  | 2 +-
 .github/workflows/snapshot.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index a61fb3fa..091ca0de 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -55,7 +55,7 @@ jobs:
         java: ['8', '11', '17', '21', '24']
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
           java-version: ${{ matrix.java }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6d1aa99f..16adf80f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
       # Fetch all tags so that sbt-dynver can find the previous release version
       - run: git fetch --tags -f
       # Install OpenJDK 8
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           # We need to use JDK8 for Android compatibility https://github.com/msgpack/msgpack-java/issues/516
           java-version: 8
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index eac8cfbb..749e6175 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 10000
       # Fetch all tags so that sbt-dynver can find the previous release version
       - run: git fetch --tags
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           java-version: 11
           distribution: adopt

From be6f0160119eb1214449e7b8470c162df39193dc Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Sun, 31 Aug 2025 03:24:57 +0200
Subject: [PATCH 06/23] Update sbt, scripted-plugin to 1.11.5 (#913)

---
 project/build.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/project/build.properties b/project/build.properties
index aced3065..d05ee025 100755
--- a/project/build.properties
+++ b/project/build.properties
@@ -1,2 +1,2 @@
-sbt.version=1.11.4
+sbt.version=1.11.5
 

From cab44596bf6ebe3b74198897cc77e5e7ed91bccb Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 1 Sep 2025 23:16:30 +0200
Subject: [PATCH 07/23] Update junit-jupiter to 5.13.4 (#905)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index 547e1ebe..143ef7e1 100644
--- a/build.sbt
+++ b/build.sbt
@@ -98,7 +98,7 @@ val buildSettings = Seq[Setting[?]](
     ((Test / compile) dependsOn (Test / jcheckStyle)).value
 )
 
-val junitJupiter = "org.junit.jupiter" % "junit-jupiter"        % "5.11.4" % "test"
+val junitJupiter = "org.junit.jupiter" % "junit-jupiter"        % "5.13.4" % "test"
 val junitVintage = "org.junit.vintage" % "junit-vintage-engine" % "5.11.4" % "test"
 
 // Project settings

From 17dc837745ef3be60aa3f37b44230ce92fffd5e4 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Thu, 18 Sep 2025 17:18:08 +0200
Subject: [PATCH 08/23] Update sbt, scripted-plugin to 1.11.6 (#918)

---
 project/build.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/project/build.properties b/project/build.properties
index d05ee025..73840fdd 100755
--- a/project/build.properties
+++ b/project/build.properties
@@ -1,2 +1,2 @@
-sbt.version=1.11.5
+sbt.version=1.11.6
 

From 06cf66d77ba85ef4ad76e7a65da4b6d6b2672bbd Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Thu, 18 Sep 2025 17:18:17 +0200
Subject: [PATCH 09/23] Update airframe-json, airspec to 2025.1.18 (#920)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index 143ef7e1..5e89ef1e 100644
--- a/build.sbt
+++ b/build.sbt
@@ -3,7 +3,7 @@ Global / onChangedBuildSource := ReloadOnSourceChanges
 // For performance testing, ensure each test run one-by-one
 Global / concurrentRestrictions := Seq(Tags.limit(Tags.Test, 1))
 
-val AIRFRAME_VERSION = "2025.1.16"
+val AIRFRAME_VERSION = "2025.1.18"
 
 // Use dynamic snapshot version strings for non tagged versions
 ThisBuild / dynverSonatypeSnapshots := true

From 918a396fcde16987abc8a26edb126248c868c9aa Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Thu, 18 Sep 2025 17:18:36 +0200
Subject: [PATCH 10/23] Update scalacheck to 1.19.0 (#919)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index 5e89ef1e..3f8c9813 100644
--- a/build.sbt
+++ b/build.sbt
@@ -144,7 +144,7 @@ lazy val msgpackCore = Project(id = "msgpack-core", base = file("msgpack-core"))
         "org.wvlet.airframe" %% "airframe-json" % AIRFRAME_VERSION % "test",
         "org.wvlet.airframe" %% "airspec"       % AIRFRAME_VERSION % "test",
         // Add property testing support with forAll methods
-        "org.scalacheck" %% "scalacheck" % "1.18.1" % "test",
+        "org.scalacheck" %% "scalacheck" % "1.19.0" % "test",
         // For performance comparison with msgpack v6
         "org.msgpack" % "msgpack" % "0.6.12" % "test",
         // For integration test with Akka

From a7a54ea6ed5710391f6f4222189690b0cc630103 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 24 Nov 2025 19:47:13 +0100
Subject: [PATCH 11/23] Update sbt-scalafmt to 2.5.6 (#932)

---
 project/plugins.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/project/plugins.sbt b/project/plugins.sbt
index 18f414ea..a7594c7a 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -4,7 +4,7 @@ addSbtPlugin("com.github.sbt" % "sbt-pgp" % "2.3.1")
 //addSbtPlugin("com.github.sbt"   % "sbt-jacoco"      % "3.3.0")
 addSbtPlugin("org.xerial.sbt" % "sbt-jcheckstyle" % "0.2.1")
 addSbtPlugin("com.github.sbt" % "sbt-osgi"        % "0.10.0")
-addSbtPlugin("org.scalameta"  % "sbt-scalafmt"    % "2.5.5")
+addSbtPlugin("org.scalameta"  % "sbt-scalafmt"    % "2.5.6")
 addSbtPlugin("com.github.sbt" % "sbt-dynver"      % "5.1.1")
 
 scalacOptions ++= Seq("-deprecation", "-feature")

From 78e5b7e2cb3d50e86e276e771e5fc9f794f8240f Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 24 Nov 2025 19:47:24 +0100
Subject: [PATCH 12/23] Update airframe-json, airspec to 2025.1.21 (#929)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index 3f8c9813..6e3d753d 100644
--- a/build.sbt
+++ b/build.sbt
@@ -3,7 +3,7 @@ Global / onChangedBuildSource := ReloadOnSourceChanges
 // For performance testing, ensure each test run one-by-one
 Global / concurrentRestrictions := Seq(Tags.limit(Tags.Test, 1))
 
-val AIRFRAME_VERSION = "2025.1.18"
+val AIRFRAME_VERSION = "2025.1.21"
 
 // Use dynamic snapshot version strings for non tagged versions
 ThisBuild / dynverSonatypeSnapshots := true

From bfa9fd4674a3f7e92922debbf1cc04c3670243c9 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 24 Nov 2025 19:48:12 +0100
Subject: [PATCH 13/23] Update scala-collection-compat to 2.14.0 (#926)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index 6e3d753d..d70268a0 100644
--- a/build.sbt
+++ b/build.sbt
@@ -149,7 +149,7 @@ lazy val msgpackCore = Project(id = "msgpack-core", base = file("msgpack-core"))
         "org.msgpack" % "msgpack" % "0.6.12" % "test",
         // For integration test with Akka
         "com.typesafe.akka"      %% "akka-actor"              % "2.6.20" % "test",
-        "org.scala-lang.modules" %% "scala-collection-compat" % "2.13.0" % "test"
+        "org.scala-lang.modules" %% "scala-collection-compat" % "2.14.0" % "test"
       )
   )
 

From f6427b4aa757aba58fd6f9788a3db0b789342e52 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 24 Nov 2025 19:48:23 +0100
Subject: [PATCH 14/23] Update sbt, scripted-plugin to 1.11.7 (#925)

---
 project/build.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/project/build.properties b/project/build.properties
index 73840fdd..b1b10405 100755
--- a/project/build.properties
+++ b/project/build.properties
@@ -1,2 +1,2 @@
-sbt.version=1.11.6
+sbt.version=1.11.7
 

From 81a9f0d80c81a24229a2641075a9e802c0843ec2 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 24 Nov 2025 19:49:33 +0100
Subject: [PATCH 15/23] Update junit-jupiter to 5.14.1 (#930)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index d70268a0..f8600c56 100644
--- a/build.sbt
+++ b/build.sbt
@@ -98,7 +98,7 @@ val buildSettings = Seq[Setting[?]](
     ((Test / compile) dependsOn (Test / jcheckStyle)).value
 )
 
-val junitJupiter = "org.junit.jupiter" % "junit-jupiter"        % "5.13.4" % "test"
+val junitJupiter = "org.junit.jupiter" % "junit-jupiter"        % "5.14.1" % "test"
 val junitVintage = "org.junit.vintage" % "junit-vintage-engine" % "5.11.4" % "test"
 
 // Project settings

From 9c27ee586204993dbb6348024f72405945c82108 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Fri, 2 Jan 2026 18:29:33 +0100
Subject: [PATCH 16/23] Update airframe-json, airspec to 2025.1.22 (#938)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index f8600c56..43536584 100644
--- a/build.sbt
+++ b/build.sbt
@@ -3,7 +3,7 @@ Global / onChangedBuildSource := ReloadOnSourceChanges
 // For performance testing, ensure each test run one-by-one
 Global / concurrentRestrictions := Seq(Tags.limit(Tags.Test, 1))
 
-val AIRFRAME_VERSION = "2025.1.21"
+val AIRFRAME_VERSION = "2025.1.22"
 
 // Use dynamic snapshot version strings for non tagged versions
 ThisBuild / dynverSonatypeSnapshots := true

From c9864c5e08ff34acb1831e42b63ac558ef86c670 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 2 Jan 2026 09:29:42 -0800
Subject: [PATCH 17/23] Bump actions/cache from 4 to 5 (#937)

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/CI.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 091ca0de..86936f65 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -59,7 +59,7 @@ jobs:
         with:
           distribution: 'zulu'
           java-version: ${{ matrix.java }}
-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
         with:
           path: ~/.cache
           key: ${{ runner.os }}-jdk${{ matrix.java }}-${{ hashFiles('**/*.sbt') }}

From 56e7bc6879b2d2184896c13046ba7ea61528ae8f Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Fri, 2 Jan 2026 18:29:53 +0100
Subject: [PATCH 18/23] Update junit-vintage-engine to 5.14.1 (#931)

---
 build.sbt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.sbt b/build.sbt
index 43536584..4d72279e 100644
--- a/build.sbt
+++ b/build.sbt
@@ -99,7 +99,7 @@ val buildSettings = Seq[Setting[?]](
 )
 
 val junitJupiter = "org.junit.jupiter" % "junit-jupiter"        % "5.14.1" % "test"
-val junitVintage = "org.junit.vintage" % "junit-vintage-engine" % "5.11.4" % "test"
+val junitVintage = "org.junit.vintage" % "junit-vintage-engine" % "5.14.1" % "test"
 
 // Project settings
 lazy val root = Project(id = "msgpack-java", base = file("."))

From befe3b943fbdc59070acfea8feb317044096bc85 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 2 Jan 2026 09:30:03 -0800
Subject: [PATCH 19/23] Bump actions/checkout from 5 to 6 (#935)

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/CI.yml       | 6 +++---
 .github/workflows/release.yml  | 2 +-
 .github/workflows/snapshot.yml | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 86936f65..a427ec6f 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -15,7 +15,7 @@ jobs:
       docs: ${{ steps.changes.outputs.docs }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - uses: dorny/paths-filter@v3
         id: changes
         with:
@@ -39,7 +39,7 @@ jobs:
     needs: changes
     if: ${{ needs.changes.outputs.code == 'true' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: jcheckstyle
         run: ./sbt jcheckStyle
       - name: scalafmtCheckAll
@@ -54,7 +54,7 @@ jobs:
       matrix:
         java: ['8', '11', '17', '21', '24']
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 16adf80f..0cec5029 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 10000
       # Fetch all tags so that sbt-dynver can find the previous release version
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 749e6175..dc0fac1d 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -16,7 +16,7 @@ jobs:
     name: Publish snapshots
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 10000
       # Fetch all tags so that sbt-dynver can find the previous release version

From daa2ea6b2f11f500e22c70a22f689f7a9debdeae Mon Sep 17 00:00:00 2001
From: "Taro L. Saito" <leo@xerial.org>
Date: Fri, 2 Jan 2026 10:26:44 -0800
Subject: [PATCH 20/23] Merge commit from fork
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Improve readPayload(int) to use gradual memory allocation for large
payloads (>64MB). This validates that sufficient data is available
before completing allocation, improving robustness when handling
untrusted input.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../org/msgpack/core/MessageUnpacker.java     |  85 ++++++++++++-
 .../msgpack/core/PayloadSizeLimitTest.scala   | 116 ++++++++++++++++++
 2 files changed, 197 insertions(+), 4 deletions(-)
 create mode 100644 msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala

diff --git a/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java b/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
index 5a9a1a63..5819f6c2 100644
--- a/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
+++ b/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java
@@ -26,6 +26,8 @@
 import java.io.Closeable;
 import java.io.IOException;
 import java.math.BigInteger;
+import java.util.ArrayList;
+import java.util.List;
 import java.nio.ByteBuffer;
 import java.nio.CharBuffer;
 import java.nio.charset.CharacterCodingException;
@@ -150,6 +152,14 @@ public class MessageUnpacker
 {
     private static final MessageBuffer EMPTY_BUFFER = MessageBuffer.wrap(new byte[0]);
 
+    /**
+     * Threshold for switching from upfront allocation to gradual allocation.
+     * Payloads up to this size use efficient upfront allocation.
+     * Payloads exceeding this size use gradual allocation to detect malicious files
+     * that declare large payload sizes but contain little actual data.
+     */
+    private static final int GRADUAL_ALLOCATION_THRESHOLD = 64 * 1024 * 1024;  // 64 MB
+
     private final boolean allowReadingStringAsBinary;
     private final boolean allowReadingBinaryAsString;
     private final CodingErrorAction actionOnMalformedString;
@@ -1637,18 +1647,85 @@ public void readPayload(byte[] dst)
      * This method allocates a new byte array and consumes specified amount of bytes into the byte array.
      *
      * <p>
-     * This method is equivalent to <code>readPayload(new byte[length])</code>.
+     * For sizes up to {@link #GRADUAL_ALLOCATION_THRESHOLD}, this method uses efficient upfront allocation.
+     * For larger sizes, it uses gradual allocation to protect against malicious files that declare
+     * large payload sizes but contain little actual data.
      *
      * @param length number of bytes to be read
      * @return the new byte array
      * @throws IOException when underlying input throws IOException
+     * @throws MessageSizeException when the input ends before the declared size is reached (for large payloads)
      */
     public byte[] readPayload(int length)
             throws IOException
     {
-        byte[] newArray = new byte[length];
-        readPayload(newArray);
-        return newArray;
+        if (length <= GRADUAL_ALLOCATION_THRESHOLD) {
+            // Small/moderate size: use efficient upfront allocation
+            byte[] newArray = new byte[length];
+            readPayload(newArray);
+            return newArray;
+        }
+
+        // Large declared size: use gradual allocation to protect against malicious files
+        return readPayloadGradually(length);
+    }
+
+    /**
+     * Read payload gradually, allocating memory only as data becomes available.
+     * This method protects against malicious files that declare large payload sizes
+     * but contain little actual data.
+     *
+     * @param declaredLength the declared payload length
+     * @return the payload bytes
+     * @throws IOException when underlying input throws IOException
+     * @throws MessageSizeException when the input ends before the declared size is reached
+     */
+    private byte[] readPayloadGradually(int declaredLength)
+            throws IOException
+    {
+        List<byte[]> chunks = new ArrayList<>();
+        int totalRead = 0;
+        int remaining = declaredLength;
+
+        while (remaining > 0) {
+            int bufferRemaining = buffer.size() - position;
+            if (bufferRemaining == 0) {
+                // Need more data from input
+                MessageBuffer next = in.next();
+                if (next == null) {
+                    // Input ended before we read the declared size
+                    throw new MessageSizeException(
+                            String.format("Payload declared %,d bytes but input ended after %,d bytes",
+                                    declaredLength, totalRead),
+                            declaredLength);
+                }
+                totalReadBytes += buffer.size();
+                buffer = next;
+                position = 0;
+                bufferRemaining = buffer.size();
+            }
+
+            int toRead = Math.min(remaining, bufferRemaining);
+            byte[] chunk = new byte[toRead];
+            buffer.getBytes(position, chunk, 0, toRead);
+            chunks.add(chunk);
+            totalRead += toRead;
+            position += toRead;
+            remaining -= toRead;
+        }
+
+        // All data verified to exist - combine chunks into result
+        if (chunks.size() == 1) {
+            return chunks.get(0);  // Common case: single chunk, no copy needed
+        }
+
+        byte[] result = new byte[declaredLength];
+        int offset = 0;
+        for (byte[] chunk : chunks) {
+            System.arraycopy(chunk, 0, result, offset, chunk.length);
+            offset += chunk.length;
+        }
+        return result;
     }
 
     /**
diff --git a/msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala b/msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala
new file mode 100644
index 00000000..e42c38a5
--- /dev/null
+++ b/msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala
@@ -0,0 +1,116 @@
+package org.msgpack.core
+
+import wvlet.airspec.AirSpec
+
+import java.nio.ByteBuffer
+
+class PayloadSizeLimitTest extends AirSpec:
+
+  test("detects malicious EXT32 file with huge declared size but tiny actual data") {
+    // Craft a malicious EXT32 header:
+    // 0xC9 = EXT32 format
+    // 4 bytes = declared length (100MB, which exceeds 64MB threshold)
+    // 1 byte = extension type
+    // followed by only 1 byte of actual data (not 100MB)
+    val declaredLength = 100 * 1024 * 1024  // 100 MB
+    val buffer = ByteBuffer.allocate(7)  // header(1) + length(4) + type(1) + data(1)
+    buffer.put(0xC9.toByte)  // EXT32 format code
+    buffer.putInt(declaredLength)  // declared length (big-endian)
+    buffer.put(0x01.toByte)  // extension type
+    buffer.put(0x41.toByte)  // only 1 byte of actual data
+    val maliciousData = buffer.array()
+
+    val unpacker = MessagePack.newDefaultUnpacker(maliciousData)
+
+    // Should throw MessageSizeException because the declared size exceeds actual data
+    intercept[MessageSizeException] {
+      unpacker.unpackValue()
+    }
+  }
+
+  test("detects malicious BIN32 file with huge declared size but tiny actual data") {
+    // Craft a malicious BIN32 header:
+    // 0xC6 = BIN32 format
+    // 4 bytes = declared length (100MB, which exceeds 64MB threshold)
+    // followed by only 1 byte of actual data (not 100MB)
+    val declaredLength = 100 * 1024 * 1024  // 100 MB
+    val buffer = ByteBuffer.allocate(6)  // header(1) + length(4) + data(1)
+    buffer.put(0xC6.toByte)  // BIN32 format code
+    buffer.putInt(declaredLength)  // declared length (big-endian)
+    buffer.put(0x41.toByte)  // only 1 byte of actual data
+    val maliciousData = buffer.array()
+
+    val unpacker = MessagePack.newDefaultUnpacker(maliciousData)
+
+    // Should throw MessageSizeException because the declared size exceeds actual data
+    intercept[MessageSizeException] {
+      unpacker.unpackValue()
+    }
+  }
+
+  test("legitimate extension data works correctly") {
+    val packer = MessagePack.newDefaultBufferPacker()
+    val testData = Array.fill[Byte](1000)(0x42)
+    packer.packExtensionTypeHeader(0x01.toByte, testData.length)
+    packer.writePayload(testData)
+    val msgpack = packer.toByteArray
+
+    val unpacker = MessagePack.newDefaultUnpacker(msgpack)
+    val value = unpacker.unpackValue()
+
+    assert(value.isExtensionValue)
+    assert(value.asExtensionValue().getData.length == 1000)
+  }
+
+  test("legitimate binary data works correctly") {
+    val packer = MessagePack.newDefaultBufferPacker()
+    val testData = Array.fill[Byte](1000)(0x42)
+    packer.packBinaryHeader(testData.length)
+    packer.writePayload(testData)
+    val msgpack = packer.toByteArray
+
+    val unpacker = MessagePack.newDefaultUnpacker(msgpack)
+    val value = unpacker.unpackValue()
+
+    assert(value.isBinaryValue)
+    assert(value.asBinaryValue().asByteArray().length == 1000)
+  }
+
+  test("readPayload directly with malicious size throws exception") {
+    // Test readPayload(int) directly with a malicious input
+    val declaredLength = 100 * 1024 * 1024  // 100 MB
+    val buffer = ByteBuffer.allocate(6)  // header(1) + length(4) + data(1)
+    buffer.put(0xC6.toByte)  // BIN32 format code
+    buffer.putInt(declaredLength)  // declared length (big-endian)
+    buffer.put(0x41.toByte)  // only 1 byte of actual data
+    val maliciousData = buffer.array()
+
+    val unpacker = MessagePack.newDefaultUnpacker(maliciousData)
+
+    // First, unpack the binary header to get the declared length
+    val len = unpacker.unpackBinaryHeader()
+    assert(len == declaredLength)
+
+    // Then try to read the payload - should throw exception
+    intercept[MessageSizeException] {
+      unpacker.readPayload(len)
+    }
+  }
+
+  test("small payloads under threshold work with upfront allocation") {
+    // Payloads under 64MB should use the efficient upfront allocation path
+    val packer = MessagePack.newDefaultBufferPacker()
+    val testData = Array.fill[Byte](10000)(0x42)  // 10KB, well under threshold
+    packer.packBinaryHeader(testData.length)
+    packer.writePayload(testData)
+    val msgpack = packer.toByteArray
+
+    val unpacker = MessagePack.newDefaultUnpacker(msgpack)
+    val len = unpacker.unpackBinaryHeader()
+    val payload = unpacker.readPayload(len)
+
+    assert(payload.length == 10000)
+    assert(payload.forall(_ == 0x42.toByte))
+  }
+
+end PayloadSizeLimitTest

From 884e9c1baec57c211253cd92fd8f81c4c899f943 Mon Sep 17 00:00:00 2001
From: "Taro L. Saito" <leo@xerial.org>
Date: Fri, 2 Jan 2026 10:32:18 -0800
Subject: [PATCH 21/23] Fix Scala code formatting (#939)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix Scala code formatting in PayloadSizeLimitTest

Apply scalafmt to align variable declarations and comments
according to project style guidelines.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../msgpack/core/PayloadSizeLimitTest.scala   | 54 +++++++++----------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala b/msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala
index e42c38a5..7f454c85 100644
--- a/msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/core/PayloadSizeLimitTest.scala
@@ -12,13 +12,13 @@ class PayloadSizeLimitTest extends AirSpec:
     // 4 bytes = declared length (100MB, which exceeds 64MB threshold)
     // 1 byte = extension type
     // followed by only 1 byte of actual data (not 100MB)
-    val declaredLength = 100 * 1024 * 1024  // 100 MB
-    val buffer = ByteBuffer.allocate(7)  // header(1) + length(4) + type(1) + data(1)
-    buffer.put(0xC9.toByte)  // EXT32 format code
-    buffer.putInt(declaredLength)  // declared length (big-endian)
-    buffer.put(0x01.toByte)  // extension type
-    buffer.put(0x41.toByte)  // only 1 byte of actual data
-    val maliciousData = buffer.array()
+    val declaredLength = 100 * 1024 * 1024      // 100 MB
+    val buffer         = ByteBuffer.allocate(7) // header(1) + length(4) + type(1) + data(1)
+    buffer.put(0xc9.toByte) // EXT32 format code
+    buffer.putInt(declaredLength) // declared length (big-endian)
+    buffer.put(0x01.toByte) // extension type
+    buffer.put(0x41.toByte) // only 1 byte of actual data
+    val maliciousData  = buffer.array()
 
     val unpacker = MessagePack.newDefaultUnpacker(maliciousData)
 
@@ -33,12 +33,12 @@ class PayloadSizeLimitTest extends AirSpec:
     // 0xC6 = BIN32 format
     // 4 bytes = declared length (100MB, which exceeds 64MB threshold)
     // followed by only 1 byte of actual data (not 100MB)
-    val declaredLength = 100 * 1024 * 1024  // 100 MB
-    val buffer = ByteBuffer.allocate(6)  // header(1) + length(4) + data(1)
-    buffer.put(0xC6.toByte)  // BIN32 format code
-    buffer.putInt(declaredLength)  // declared length (big-endian)
-    buffer.put(0x41.toByte)  // only 1 byte of actual data
-    val maliciousData = buffer.array()
+    val declaredLength = 100 * 1024 * 1024      // 100 MB
+    val buffer         = ByteBuffer.allocate(6) // header(1) + length(4) + data(1)
+    buffer.put(0xc6.toByte) // BIN32 format code
+    buffer.putInt(declaredLength) // declared length (big-endian)
+    buffer.put(0x41.toByte) // only 1 byte of actual data
+    val maliciousData  = buffer.array()
 
     val unpacker = MessagePack.newDefaultUnpacker(maliciousData)
 
@@ -49,28 +49,28 @@ class PayloadSizeLimitTest extends AirSpec:
   }
 
   test("legitimate extension data works correctly") {
-    val packer = MessagePack.newDefaultBufferPacker()
+    val packer   = MessagePack.newDefaultBufferPacker()
     val testData = Array.fill[Byte](1000)(0x42)
     packer.packExtensionTypeHeader(0x01.toByte, testData.length)
     packer.writePayload(testData)
     val msgpack = packer.toByteArray
 
     val unpacker = MessagePack.newDefaultUnpacker(msgpack)
-    val value = unpacker.unpackValue()
+    val value    = unpacker.unpackValue()
 
     assert(value.isExtensionValue)
     assert(value.asExtensionValue().getData.length == 1000)
   }
 
   test("legitimate binary data works correctly") {
-    val packer = MessagePack.newDefaultBufferPacker()
+    val packer   = MessagePack.newDefaultBufferPacker()
     val testData = Array.fill[Byte](1000)(0x42)
     packer.packBinaryHeader(testData.length)
     packer.writePayload(testData)
     val msgpack = packer.toByteArray
 
     val unpacker = MessagePack.newDefaultUnpacker(msgpack)
-    val value = unpacker.unpackValue()
+    val value    = unpacker.unpackValue()
 
     assert(value.isBinaryValue)
     assert(value.asBinaryValue().asByteArray().length == 1000)
@@ -78,12 +78,12 @@ class PayloadSizeLimitTest extends AirSpec:
 
   test("readPayload directly with malicious size throws exception") {
     // Test readPayload(int) directly with a malicious input
-    val declaredLength = 100 * 1024 * 1024  // 100 MB
-    val buffer = ByteBuffer.allocate(6)  // header(1) + length(4) + data(1)
-    buffer.put(0xC6.toByte)  // BIN32 format code
-    buffer.putInt(declaredLength)  // declared length (big-endian)
-    buffer.put(0x41.toByte)  // only 1 byte of actual data
-    val maliciousData = buffer.array()
+    val declaredLength = 100 * 1024 * 1024      // 100 MB
+    val buffer         = ByteBuffer.allocate(6) // header(1) + length(4) + data(1)
+    buffer.put(0xc6.toByte) // BIN32 format code
+    buffer.putInt(declaredLength) // declared length (big-endian)
+    buffer.put(0x41.toByte) // only 1 byte of actual data
+    val maliciousData  = buffer.array()
 
     val unpacker = MessagePack.newDefaultUnpacker(maliciousData)
 
@@ -99,15 +99,15 @@ class PayloadSizeLimitTest extends AirSpec:
 
   test("small payloads under threshold work with upfront allocation") {
     // Payloads under 64MB should use the efficient upfront allocation path
-    val packer = MessagePack.newDefaultBufferPacker()
-    val testData = Array.fill[Byte](10000)(0x42)  // 10KB, well under threshold
+    val packer   = MessagePack.newDefaultBufferPacker()
+    val testData = Array.fill[Byte](10000)(0x42) // 10KB, well under threshold
     packer.packBinaryHeader(testData.length)
     packer.writePayload(testData)
     val msgpack = packer.toByteArray
 
     val unpacker = MessagePack.newDefaultUnpacker(msgpack)
-    val len = unpacker.unpackBinaryHeader()
-    val payload = unpacker.readPayload(len)
+    val len      = unpacker.unpackBinaryHeader()
+    val payload  = unpacker.readPayload(len)
 
     assert(payload.length == 10000)
     assert(payload.forall(_ == 0x42.toByte))

From ab5dc83f7039a3fe009d84d39e8b5f83addb5a45 Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Fri, 2 Jan 2026 20:44:35 +0100
Subject: [PATCH 22/23] Update scalafmt-core to 3.9.10 (#921)

---
 .scalafmt.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.scalafmt.conf b/.scalafmt.conf
index a4b995aa..8ef32eb0 100644
--- a/.scalafmt.conf
+++ b/.scalafmt.conf
@@ -1,4 +1,4 @@
-version = 3.9.9
+version = 3.9.10
 project.layout = StandardConvention
 runner.dialect = scala3
 maxColumn = 100

From 580fde4766e6e6a6931cabf6062a6661377185da Mon Sep 17 00:00:00 2001
From: Scala Steward <43047562+scala-steward@users.noreply.github.com>
Date: Mon, 5 Jan 2026 18:36:02 +0100
Subject: [PATCH 23/23] Update scalafmt-core to 3.10.3 (#941)

* Update scalafmt-core to 3.10.3

* Reformat with scalafmt 3.10.3

Executed command: scalafmt --non-interactive

* Add 'Reformat with scalafmt 3.10.3' to .git-blame-ignore-revs
---
 .git-blame-ignore-revs                              |  3 +++
 .scalafmt.conf                                      |  2 +-
 .../scala/org/msgpack/core/MessagePackSpec.scala    |  3 ++-
 .../scala/org/msgpack/core/MessagePackTest.scala    | 13 +++++++++----
 .../scala/org/msgpack/core/MessagePackerTest.scala  |  8 ++++++--
 .../org/msgpack/core/MessageUnpackerTest.scala      |  7 ++++---
 .../core/buffer/MessageBufferInputTest.scala        | 10 +++++++---
 .../scala/org/msgpack/value/ValueTypeTest.scala     |  3 ++-
 .../test/scala/org/msgpack/value/VariableTest.scala |  4 +++-
 9 files changed, 37 insertions(+), 16 deletions(-)

diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 285ed6f4..aead1172 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -1,2 +1,5 @@
 # Scala Steward: Reformat with scalafmt 3.9.9
 424ec59eb4865feb383ca53b4278dfb8b9b6c36c
+
+# Scala Steward: Reformat with scalafmt 3.10.3
+d8af028d2cd271ab7f3adec9842f07cce86a2ac3
diff --git a/.scalafmt.conf b/.scalafmt.conf
index 8ef32eb0..d30b0537 100644
--- a/.scalafmt.conf
+++ b/.scalafmt.conf
@@ -1,4 +1,4 @@
-version = 3.9.10
+version = 3.10.3
 project.layout = StandardConvention
 runner.dialect = scala3
 maxColumn = 100
diff --git a/msgpack-core/src/test/scala/org/msgpack/core/MessagePackSpec.scala b/msgpack-core/src/test/scala/org/msgpack/core/MessagePackSpec.scala
index 135c4921..21080f65 100644
--- a/msgpack-core/src/test/scala/org/msgpack/core/MessagePackSpec.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/core/MessagePackSpec.scala
@@ -16,7 +16,8 @@
 package org.msgpack.core
 
 import wvlet.log.LogLevel
-import wvlet.log.io.{TimeReport, Timer}
+import wvlet.log.io.TimeReport
+import wvlet.log.io.Timer
 
 import java.io.ByteArrayOutputStream
 
diff --git a/msgpack-core/src/test/scala/org/msgpack/core/MessagePackTest.scala b/msgpack-core/src/test/scala/org/msgpack/core/MessagePackTest.scala
index b5541393..16236c65 100644
--- a/msgpack-core/src/test/scala/org/msgpack/core/MessagePackTest.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/core/MessagePackTest.scala
@@ -15,18 +15,23 @@
 //
 package org.msgpack.core
 
-import org.msgpack.core.MessagePack.{Code, PackerConfig, UnpackerConfig}
+import org.msgpack.core.MessagePack.Code
+import org.msgpack.core.MessagePack.PackerConfig
+import org.msgpack.core.MessagePack.UnpackerConfig
 import org.msgpack.core.MessagePackSpec.toHex
-import org.msgpack.value.{Value, Variable}
+import org.msgpack.value.Value
+import org.msgpack.value.Variable
 import org.scalacheck.Prop.propBoolean
-import org.scalacheck.{Arbitrary, Gen}
+import org.scalacheck.Arbitrary
+import org.scalacheck.Gen
 import wvlet.airspec.AirSpec
 import wvlet.airspec.spi.PropertyCheck
 
 import java.io.ByteArrayOutputStream
 import java.math.BigInteger
 import java.nio.CharBuffer
-import java.nio.charset.{CodingErrorAction, UnmappableCharacterException}
+import java.nio.charset.CodingErrorAction
+import java.nio.charset.UnmappableCharacterException
 import java.time.Instant
 import scala.util.Random
 
diff --git a/msgpack-core/src/test/scala/org/msgpack/core/MessagePackerTest.scala b/msgpack-core/src/test/scala/org/msgpack/core/MessagePackerTest.scala
index 7ff5d82e..e31853ab 100644
--- a/msgpack-core/src/test/scala/org/msgpack/core/MessagePackerTest.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/core/MessagePackerTest.scala
@@ -16,12 +16,16 @@
 package org.msgpack.core
 
 import org.msgpack.core.MessagePack.PackerConfig
-import org.msgpack.core.buffer.{ChannelBufferOutput, OutputStreamBufferOutput}
+import org.msgpack.core.buffer.ChannelBufferOutput
+import org.msgpack.core.buffer.OutputStreamBufferOutput
 import org.msgpack.value.ValueFactory
 import wvlet.airspec.AirSpec
 import wvlet.log.io.IOUtil.withResource
 
-import java.io.{ByteArrayOutputStream, File, FileInputStream, FileOutputStream}
+import java.io.ByteArrayOutputStream
+import java.io.File
+import java.io.FileInputStream
+import java.io.FileOutputStream
 import scala.util.Random
 
 /**
diff --git a/msgpack-core/src/test/scala/org/msgpack/core/MessageUnpackerTest.scala b/msgpack-core/src/test/scala/org/msgpack/core/MessageUnpackerTest.scala
index adab4708..bf43591a 100644
--- a/msgpack-core/src/test/scala/org/msgpack/core/MessageUnpackerTest.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/core/MessageUnpackerTest.scala
@@ -15,7 +15,8 @@
 //
 package org.msgpack.core
 
-import org.msgpack.core.MessagePackSpec.{createMessagePackData, toHex}
+import org.msgpack.core.MessagePackSpec.createMessagePackData
+import org.msgpack.core.MessagePackSpec.toHex
 import org.msgpack.core.buffer.*
 import org.msgpack.value.ValueType
 import wvlet.airspec.AirSpec
@@ -67,8 +68,8 @@ class MessageUnpackerTest extends AirSpec with Benchmark:
 
   private val intSeq =
     (
-      for (i <- 0 until 100)
-        yield Random.nextInt()
+      for i <- 0 until 100
+      yield Random.nextInt()
     ).toArray[Int]
 
   private def testData2: Array[Byte] =
diff --git a/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala b/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala
index 5e6c1f96..0465aa69 100644
--- a/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala
@@ -22,9 +22,13 @@ import wvlet.log.io.IOUtil.withResource
 import java.io.*
 import java.net.InetSocketAddress
 import java.nio.ByteBuffer
-import java.nio.channels.{ServerSocketChannel, SocketChannel}
-import java.util.concurrent.{Callable, Executors, TimeUnit}
-import java.util.zip.{GZIPInputStream, GZIPOutputStream}
+import java.nio.channels.ServerSocketChannel
+import java.nio.channels.SocketChannel
+import java.util.concurrent.Callable
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+import java.util.zip.GZIPInputStream
+import java.util.zip.GZIPOutputStream
 import scala.util.Random
 
 class MessageBufferInputTest extends AirSpec:
diff --git a/msgpack-core/src/test/scala/org/msgpack/value/ValueTypeTest.scala b/msgpack-core/src/test/scala/org/msgpack/value/ValueTypeTest.scala
index 7b992f28..53707c99 100644
--- a/msgpack-core/src/test/scala/org/msgpack/value/ValueTypeTest.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/value/ValueTypeTest.scala
@@ -16,7 +16,8 @@
 package org.msgpack.value
 
 import org.msgpack.core.MessagePack.Code.*
-import org.msgpack.core.{MessageFormat, MessageFormatException}
+import org.msgpack.core.MessageFormat
+import org.msgpack.core.MessageFormatException
 import wvlet.airspec.AirSpec
 
 /**
diff --git a/msgpack-core/src/test/scala/org/msgpack/value/VariableTest.scala b/msgpack-core/src/test/scala/org/msgpack/value/VariableTest.scala
index 2f3cbf9c..d4754e83 100644
--- a/msgpack-core/src/test/scala/org/msgpack/value/VariableTest.scala
+++ b/msgpack-core/src/test/scala/org/msgpack/value/VariableTest.scala
@@ -15,7 +15,9 @@
 //
 package org.msgpack.value
 
-import org.msgpack.core.{MessagePack, MessagePacker, MessageTypeCastException}
+import org.msgpack.core.MessagePack
+import org.msgpack.core.MessagePacker
+import org.msgpack.core.MessageTypeCastException
 import wvlet.airspec.AirSpec
 import wvlet.airspec.spi.PropertyCheck