Fix/flaky integration tests

.github/scripts/update_sdk_version.sh

@@ -12,6 +12,11 @@ mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -DprocessDependencies=true
 mvn versions:set-property -Dproperty=dapr.sdk.alpha.version -DnewVersion=$DAPR_JAVA_SDK_ALPHA_VERSION
 mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION
 mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-tests/pom.xml
+# BOMs are standalone (no parent), so versions:set skips them — update explicitly.
+mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-bom/pom.xml
+mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-bom/pom.xml
+mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -f dapr-spring/dapr-spring-bom/pom.xml
+mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f dapr-spring/dapr-spring-bom/pom.xml
 mvn versions:set-property -Dproperty=dapr.sdk.alpha.version -DnewVersion=$DAPR_JAVA_SDK_ALPHA_VERSION -f sdk-tests/pom.xml
 
 

.github/workflows/build.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Run tests
         run: ./mvnw clean install -B -q -DskipITs=true
       - name: Codecov
-        uses: codecov/codecov-action@v5.5.2
+        uses: codecov/codecov-action@v6.0.0
         with:
           token: ${{  secrets.CODECOV_TOKEN  }}
       - name: Upload test report for sdk

.github/workflows/create-release.yml

@@ -53,4 +53,18 @@ jobs:
           git remote set-url origin https://x-access-token:${{ secrets.DAPR_BOT_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git
           # Copy first to allow automation to use the latest version and not the release branch's version.
           cp -R ./.github/scripts ${RUNNER_TEMP}/
-          ${RUNNER_TEMP}/scripts/create-release.sh ${{ inputs.rel_version }}
+          ${RUNNER_TEMP}/scripts/create-release.sh ${{ inputs.rel_version }}
+      - name: Create GitHub Release with auto-generated notes
+        if: ${{ !endsWith(inputs.rel_version, '-SNAPSHOT') && !contains(inputs.rel_version, '-rc-') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.DAPR_BOT_TOKEN }}
+          REL_VERSION: ${{ inputs.rel_version }}
+        run: |
+          # Normalize release version by stripping an optional leading 'v'
+          REL_VERSION="${REL_VERSION#v}"
+          TAG="v${REL_VERSION}"
+          if gh release view "${TAG}" >/dev/null 2>&1; then
+            echo "Release ${TAG} already exists, skipping creation."
+          else
+            gh release create "${TAG}" --generate-notes
+          fi

.github/workflows/dapr_bot.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Comment analyzer
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           github-token: ${{secrets.DAPR_BOT_TOKEN}}
           script: |

.github/workflows/fossa.yml

@@ -35,12 +35,12 @@ jobs:
         uses: actions/checkout@v5
 
       - name: "Run FOSSA Scan"
-        uses: fossas/fossa-action@v1.8.0 # Use a specific version if locking is preferred
+        uses: fossas/fossa-action@v1.9.0 # Use a specific version if locking is preferred
         with:
           api-key: ${{ env.FOSSA_API_KEY }}
 
       - name: "Run FOSSA Test"
-        uses: fossas/fossa-action@v1.8.0 # Use a specific version if locking is preferred
+        uses: fossas/fossa-action@v1.9.0 # Use a specific version if locking is preferred
         with:
           api-key: ${{ env.FOSSA_API_KEY }}
           run-tests: true

.github/workflows/validate-docs.yml

@@ -17,8 +17,8 @@ on:
 jobs:
   build:
     name: "Validate Javadocs generation"
-    runs-on: linux-arm64-latest-4-cores
-    timeout-minutes: 30
+    runs-on: oracle-vm-4cpu-16gb-arm64
+    timeout-minutes: 60
     env:
       JDK_VER: 17
     steps:

.gitignore

@@ -51,3 +51,7 @@ hs_err_pid*
 
 # macOS
 .DS_Store
+
+# Claude Code / OMC
+.omc/
+.omx/

README.md

@@ -59,47 +59,143 @@ For the full list of available APIs, see the [Dapr API reference](https://docs.d
 If using [SDKMAN!](https://sdkman.io), execute `sdk env install` to install the required JDK.
 
 ### Importing Dapr's Java SDK
-For a Maven project, add the following to your `pom.xml` file:
+
+#### Using a BOM (recommended)
+
+Two BOMs are published:
+
+- **`io.dapr:dapr-sdk-bom`** — core SDK modules (`dapr-sdk`, `dapr-sdk-actors`, `dapr-sdk-workflows`, `dapr-sdk-autogen`, `durabletask-client`, `testcontainers-dapr`) plus security-patched transitive dependencies (Netty, Jackson, commons-compress, commons-codec).
+- **`io.dapr.spring:dapr-spring-bom`** — Spring-specific modules (`dapr-sdk-springboot`, `dapr-spring-*`). Imports `dapr-sdk-bom` transitively, so Spring users only need this single BOM.
+
+Pick the one that matches your project. Importing a BOM ensures you inherit security fixes for transitive dependencies like the Netty CVEs.
+
+##### Core (non-Spring) projects
+
+For Maven:
 ```xml
 <project>
   ...
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>io.dapr</groupId>
+        <artifactId>dapr-sdk-bom</artifactId>
+        <version>1.18.0</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
-    ...
-     <!-- Dapr's core SDK with all features, except Actors. -->
+    <!-- Dapr's core SDK with all features, except Actors. -->
     <dependency>
       <groupId>io.dapr</groupId>
       <artifactId>dapr-sdk</artifactId>
-      <version>1.17.0</version>
     </dependency>
     <!-- Dapr's SDK for Actors (optional). -->
     <dependency>
       <groupId>io.dapr</groupId>
       <artifactId>dapr-sdk-actors</artifactId>
-      <version>1.17.0</version>
     </dependency>
-    <!-- Dapr's SDK integration with SpringBoot (optional). -->
+  </dependencies>
+  ...
+</project>
+```
+
+For Gradle:
+```groovy
+dependencies {
+    implementation platform('io.dapr:dapr-sdk-bom:1.18.0')
+
+    // Dapr's core SDK with all features, except Actors.
+    implementation 'io.dapr:dapr-sdk'
+    // Dapr's SDK for Actors (optional).
+    implementation 'io.dapr:dapr-sdk-actors'
+}
+```
+
+##### Spring Boot projects
+
+For Maven:
+```xml
+<project>
+  ...
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>io.dapr.spring</groupId>
+        <artifactId>dapr-spring-bom</artifactId>
+        <version>1.18.0</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
+  <dependencies>
+    <!-- Dapr's SDK integration with Spring Boot. -->
     <dependency>
       <groupId>io.dapr</groupId>
       <artifactId>dapr-sdk-springboot</artifactId>
-      <version>1.17.0</version>
     </dependency>
-    ...
+    <!-- Optional Spring Boot starter. -->
+    <dependency>
+      <groupId>io.dapr.spring</groupId>
+      <artifactId>dapr-spring-boot-starter</artifactId>
+    </dependency>
   </dependencies>
   ...
 </project>
 ```
 
-For a Gradle project, add the following to your `build.gradle` file:
+For Gradle:
+```groovy
+dependencies {
+    implementation platform('io.dapr.spring:dapr-spring-bom:1.18.0')
+
+    // Dapr's SDK integration with Spring Boot.
+    implementation 'io.dapr:dapr-sdk-springboot'
+    // Optional Spring Boot starter.
+    implementation 'io.dapr.spring:dapr-spring-boot-starter'
+}
+```
 
+#### Without the BOM
+
+If you prefer to manage versions manually, specify the version on each dependency:
+
+For Maven:
+```xml
+<project>
+  ...
+  <dependencies>
+    <dependency>
+      <groupId>io.dapr</groupId>
+      <artifactId>dapr-sdk</artifactId>
+      <version>1.17.2</version>
+    </dependency>
+    <dependency>
+      <groupId>io.dapr</groupId>
+      <artifactId>dapr-sdk-actors</artifactId>
+      <version>1.17.2</version>
+    </dependency>
+    <dependency>
+      <groupId>io.dapr</groupId>
+      <artifactId>dapr-sdk-springboot</artifactId>
+      <version>1.17.2</version>
+    </dependency>
+  </dependencies>
+  ...
+</project>
 ```
+
+For Gradle:
+```groovy
 dependencies {
-...
-    // Dapr's core SDK with all features, except Actors.
-    compile('io.dapr:dapr-sdk:1.17.0')
-    // Dapr's SDK for Actors (optional).
-    compile('io.dapr:dapr-sdk-actors:1.17.0')
-    // Dapr's SDK integration with SpringBoot (optional).
-    compile('io.dapr:dapr-sdk-springboot:1.17.0')
+    implementation 'io.dapr:dapr-sdk:1.17.2'
+    implementation 'io.dapr:dapr-sdk-actors:1.17.2'
+    implementation 'io.dapr:dapr-sdk-springboot:1.17.2'
 }
 ```
 

dapr-spring/dapr-spring-6-data/pom.xml

@@ -17,8 +17,8 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.2</springboot4.version>
-    <!-- Override JUnit version to align with Spring Boot 4.0.2 -->
+    <springboot4.version>4.0.5</springboot4.version>
+    <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>