From 2e6bd4a2750855eb3fda10853463a0066b3b278a Mon Sep 17 00:00:00 2001
From: Mattie Fu <mattiefu@google.com>
Date: Thu, 13 Aug 2026 20:02:31 +0000
Subject: [PATCH 1/5] deps: bump google-cloud-bigtable to 2.81.0

- Bump bigtable.version 2.77.0 -> 2.81.0 and emulator 0.214.0 -> 0.218.0
- Pin slf4j-api to 2.0.16 (veneer needs 2.0.x, hbase ships 1.7.x) so
  RequireUpperBoundDeps is satisfied; add slf4j-api to hbase-targeted
  verify-mirror-deps ignore lists
- Bump maven-shade-plugin to 3.6.0 (ASM 9 handles the Java 17 multi-release
  classes jackson-core 2.18.x now pulls in transitively)
- Exclude dead-weight jackson multi-release FastDoubleParser classes
  (META-INF/versions/*/com/fasterxml/**) from the 1.x/2.x shaded jars
- Bump conscrypt to 2.6.0 in the shaded modules to match the veneer deps-bom

Change-Id: I68c2a7fb2585babe601e0ad71bdb1eb8fb04a44d
---
 .../bigtable-hbase/pom.xml                    |  2 ++
 .../bigtable-hbase-1.x-hadoop/pom.xml         |  2 ++
 .../bigtable-hbase-1.x-mapreduce/pom.xml      |  2 ++
 .../bigtable-hbase-1.x-shaded/pom.xml         | 16 ++++++++++--
 .../bigtable-hbase-1.x/pom.xml                |  2 ++
 .../bigtable-hbase-2.x-hadoop/pom.xml         |  2 ++
 .../bigtable-hbase-2.x-mapreduce/pom.xml      |  2 ++
 .../bigtable-hbase-2.x-shaded/pom.xml         | 16 ++++++++++--
 .../bigtable-hbase-2.x/pom.xml                |  2 ++
 .../bigtable-hbase-1.x-replication/pom.xml    |  4 +++
 .../pom.xml                                   |  4 +++
 .../pom.xml                                   |  2 ++
 .../pom.xml                                   |  2 ++
 .../pom.xml                                   |  4 +++
 .../pom.xml                                   |  2 ++
 .../pom.xml                                   |  2 ++
 pom.xml                                       | 25 ++++++++++++++++---
 17 files changed, 83 insertions(+), 8 deletions(-)

diff --git a/bigtable-client-core-parent/bigtable-hbase/pom.xml b/bigtable-client-core-parent/bigtable-hbase/pom.xml
index dfcf82e15e..a8ddcface5 100644
--- a/bigtable-client-core-parent/bigtable-hbase/pom.xml
+++ b/bigtable-client-core-parent/bigtable-hbase/pom.xml
@@ -178,6 +178,8 @@ limitations under the License.
               </targetDependencies>
               <ignoredDependencies>
                 <!-- forcefully replaced with reload4j -->
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>log4j:log4j</dependency>
               </ignoredDependencies>
             </configuration>
diff --git a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-hadoop/pom.xml b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-hadoop/pom.xml
index a34ad43fcf..4d2b52e0f5 100644
--- a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-hadoop/pom.xml
+++ b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-hadoop/pom.xml
@@ -209,6 +209,8 @@ limitations under the License.
                 <targetDependency>org.apache.hbase:hbase-client</targetDependency>
               </targetDependencies>
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>log4j:log4j</dependency>
                 <!-- for some reason hbase-client exposes testing deps as a compile dep, just ignore them -->
                 <dependency>junit:junit</dependency>
diff --git a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-mapreduce/pom.xml b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-mapreduce/pom.xml
index 9bec7fe076..e62a98e9d9 100644
--- a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-mapreduce/pom.xml
+++ b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-mapreduce/pom.xml
@@ -201,6 +201,8 @@ limitations under the License.
               <ignoredDependencies>
 
                 <!-- hbase-common pulls in test deps via hbase-annotations, exclude them from mirror check -->
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>junit:junit</dependency>
                 <dependency>org.hamcrest:hamcrest-core</dependency>
               </ignoredDependencies>
diff --git a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml
index b9e97ac088..433095eef3 100644
--- a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml
+++ b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml
@@ -56,13 +56,13 @@ limitations under the License.
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk-uber</artifactId>
-        <version>2.5.2</version>
+        <version>2.6.0</version>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk</artifactId>
-        <version>2.5.2</version>
+        <version>2.6.0</version>
         <scope>provided</scope>
       </dependency>
 
@@ -244,6 +244,16 @@ limitations under the License.
                     <exclude>META-INF/DEPENDENCIES</exclude>
                     <exclude>META-INF/versions/9/module-info.class</exclude>
                     <exclude>META-INF/versions/11/module-info.class</exclude>
+                    <!-- google-cloud-bigtable 2.81.0 pulls in jackson-core 2.18.x (via the
+                         opentelemetry GCP resource detector), which ships multi-release
+                         FastDoubleParser SIMD optimizations under META-INF/versions/{11,17,21,22}.
+                         The com.fasterxml relocation below rewrites the base classes to
+                         com.google.bigtable.repackaged.com.faster.xml, but the multi-release
+                         copies keep their original com/fasterxml path, so Java's MR mechanism can
+                         never match them to the relocated base class - they are dead weight and
+                         also trip verify-shaded-jar-entries as un-relocated com.fasterxml classes.
+                         Drop them; the base classes provide identical functionality. -->
+                    <exclude>META-INF/versions/*/com/fasterxml/**</exclude>
                   </excludes>
                 </filter>
               </filters>
@@ -426,6 +436,8 @@ limitations under the License.
                 <targetDependency>org.apache.hbase:hbase-shaded-client</targetDependency>
               </targetDependencies>
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <ignoredDependency>org.slf4j:slf4j-api</ignoredDependency>
                 <ignoredDependency>log4j:log4j</ignoredDependency>
               </ignoredDependencies>
             </configuration>
diff --git a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x/pom.xml b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x/pom.xml
index 8153d9cf9c..ee8d71fc02 100644
--- a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x/pom.xml
+++ b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x/pom.xml
@@ -160,6 +160,8 @@ limitations under the License.
               </targetDependencies>
               <ignoredDependencies>
                 <!-- forcefully replaced with reload4j -->
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>log4j:log4j</dependency>
               </ignoredDependencies>
             </configuration>
diff --git a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-hadoop/pom.xml b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-hadoop/pom.xml
index aeaded71d6..1684f76c39 100644
--- a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-hadoop/pom.xml
+++ b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-hadoop/pom.xml
@@ -193,6 +193,8 @@ limitations under the License.
                 <targetDependency>org.apache.hbase:hbase-client</targetDependency>
               </targetDependencies>
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>log4j:log4j</dependency>
               </ignoredDependencies>
             </configuration>
diff --git a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-mapreduce/pom.xml b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-mapreduce/pom.xml
index 6e68e83f8f..f8ca938e8d 100644
--- a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-mapreduce/pom.xml
+++ b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-mapreduce/pom.xml
@@ -190,6 +190,8 @@ limitations under the License.
               </targetDependencies>
               <ignoredDependencies>
                 <!-- TODO: version mismatches after upgrading hbase client to 2.6.4 -->
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <ignoredDependency>org.slf4j:slf4j-api</ignoredDependency>
                 <ignoredDependency>javax.activation:activation</ignoredDependency>
                 <ignoredDependency>javax.xml.bind:jaxb-api</ignoredDependency>
                 <ignoredDependency>javax.xml.stream:stax-api</ignoredDependency>
diff --git a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml
index 7a3d590a93..dd306f0120 100644
--- a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml
+++ b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml
@@ -56,13 +56,13 @@ limitations under the License.
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk-uber</artifactId>
-        <version>2.5.2</version>
+        <version>2.6.0</version>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk</artifactId>
-        <version>2.5.2</version>
+        <version>2.6.0</version>
         <scope>provided</scope>
       </dependency>
 
@@ -236,6 +236,16 @@ limitations under the License.
                     <exclude>META-INF/DEPENDENCIES</exclude>
                     <exclude>META-INF/versions/9/module-info.class</exclude>
                     <exclude>META-INF/versions/11/module-info.class</exclude>
+                    <!-- google-cloud-bigtable 2.81.0 pulls in jackson-core 2.18.x (via the
+                         opentelemetry GCP resource detector), which ships multi-release
+                         FastDoubleParser SIMD optimizations under META-INF/versions/{11,17,21,22}.
+                         The com.fasterxml relocation below rewrites the base classes to
+                         com.google.bigtable.repackaged.com.faster.xml, but the multi-release
+                         copies keep their original com/fasterxml path, so Java's MR mechanism can
+                         never match them to the relocated base class - they are dead weight and
+                         also trip verify-shaded-jar-entries as un-relocated com.fasterxml classes.
+                         Drop them; the base classes provide identical functionality. -->
+                    <exclude>META-INF/versions/*/com/fasterxml/**</exclude>
                   </excludes>
                 </filter>
               </filters>
@@ -422,6 +432,8 @@ limitations under the License.
               <!-- opentelemetry dependency is added to veneer since 2.38.0. We shade veneer so ignoring
                    opentelemetry when comparing with hbase-shaded-client is fine-->
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>io.opentelemetry:opentelemetry-api</dependency>
                 <dependency>io.opentelemetry:opentelemetry-context</dependency>
                 <dependency>io.opentelemetry:opentelemetry-semconv</dependency>
diff --git a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x/pom.xml b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x/pom.xml
index 07529f1aca..c0f4867ab7 100644
--- a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x/pom.xml
+++ b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x/pom.xml
@@ -182,6 +182,8 @@ limitations under the License.
                 <targetDependency>org.apache.hbase:hbase-shaded-client</targetDependency>
               </targetDependencies>
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>io.opentelemetry:opentelemetry-api</dependency>
                 <dependency>io.opentelemetry:opentelemetry-context</dependency>
                 <dependency>io.opentelemetry:opentelemetry-semconv</dependency>
diff --git a/hbase-migration-tools/bigtable-hbase-replication/bigtable-hbase-1.x-replication/pom.xml b/hbase-migration-tools/bigtable-hbase-replication/bigtable-hbase-1.x-replication/pom.xml
index b7cb9d446b..0dabd4210f 100644
--- a/hbase-migration-tools/bigtable-hbase-replication/bigtable-hbase-1.x-replication/pom.xml
+++ b/hbase-migration-tools/bigtable-hbase-replication/bigtable-hbase-1.x-replication/pom.xml
@@ -49,6 +49,10 @@ limitations under the License.
               <targetDependencies>
                 <targetDependency>org.apache.hbase:hbase-server</targetDependency>
               </targetDependencies>
+              <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
+              </ignoredDependencies>
             </configuration>
           </execution>
         </executions>
diff --git a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x-shaded/pom.xml b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x-shaded/pom.xml
index d0604af769..5f1bdc10cc 100644
--- a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x-shaded/pom.xml
+++ b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x-shaded/pom.xml
@@ -187,6 +187,8 @@ limitations under the License.
                 <targetDependency>org.apache.hbase:hbase-shaded-client</targetDependency>
               </targetDependencies>
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <ignoredDependency>org.slf4j:slf4j-api</ignoredDependency>
                 <ignoredDependency>log4j:log4j</ignoredDependency>
               </ignoredDependencies>
             </configuration>
@@ -223,6 +225,8 @@ limitations under the License.
                 <targetDependency>org.apache.hbase:hbase-shaded-client</targetDependency>
               </targetDependencies>
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <ignoredDependency>org.slf4j:slf4j-api</ignoredDependency>
                 <ignoredDependency>log4j:log4j</ignoredDependency>
               </ignoredDependencies>
             </configuration>
diff --git a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x/pom.xml b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x/pom.xml
index 87dbf20b24..019ffa12a1 100644
--- a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x/pom.xml
+++ b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-1.x-parent/bigtable-hbase-mirroring-client-1.x/pom.xml
@@ -128,6 +128,8 @@ limitations under the License.
               </targetDependencies>
               <ignoredDependencies>
                 <!-- forcefully replaced with reload4j -->
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>log4j:log4j</dependency>
               </ignoredDependencies>
             </configuration>
diff --git a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-hadoop/pom.xml b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-hadoop/pom.xml
index 2c8973fe19..c082346e2c 100644
--- a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-hadoop/pom.xml
+++ b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-hadoop/pom.xml
@@ -201,6 +201,8 @@ limitations under the License.
                 we are using that version -->
                 <ignoredDependency>commons-logging:commons-logging</ignoredDependency>
 
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <ignoredDependency>org.slf4j:slf4j-api</ignoredDependency>
                 <ignoredDependency>log4j:log4j</ignoredDependency>
               </ignoredDependencies>
             </configuration>
diff --git a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-shaded/pom.xml b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-shaded/pom.xml
index 9ebe41cb78..8c0c81f30b 100644
--- a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-shaded/pom.xml
+++ b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x-shaded/pom.xml
@@ -198,6 +198,10 @@ limitations under the License.
               <targetDependencies>
                 <targetDependency>org.apache.hbase:hbase-shaded-client</targetDependency>
               </targetDependencies>
+              <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <ignoredDependency>org.slf4j:slf4j-api</ignoredDependency>
+              </ignoredDependencies>
             </configuration>
           </execution>
         </executions>
diff --git a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x/pom.xml b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x/pom.xml
index f49e6d61cd..b7cceea38a 100644
--- a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x/pom.xml
+++ b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-2.x-parent/bigtable-hbase-mirroring-client-2.x/pom.xml
@@ -122,6 +122,8 @@ limitations under the License.
                 <targetDependency>org.apache.hbase:hbase-shaded-client</targetDependency>
               </targetDependencies>
               <ignoredDependencies>
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
               </ignoredDependencies>
             </configuration>
           </execution>
diff --git a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-core-parent/bigtable-hbase-mirroring-client-core/pom.xml b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-core-parent/bigtable-hbase-mirroring-client-core/pom.xml
index 3a95302509..45e8bc7054 100644
--- a/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-core-parent/bigtable-hbase-mirroring-client-core/pom.xml
+++ b/hbase-migration-tools/mirroring-client/bigtable-hbase-mirroring-client-core-parent/bigtable-hbase-mirroring-client-core/pom.xml
@@ -146,6 +146,8 @@ limitations under the License.
               </targetDependencies>
               <ignoredDependencies>
                 <!-- forcefully replaced with reload4j -->
+                <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x -->
+                <dependency>org.slf4j:slf4j-api</dependency>
                 <dependency>log4j:log4j</dependency>
               </ignoredDependencies>
             </configuration>
diff --git a/pom.xml b/pom.xml
index e8a180da60..e4012bf6d4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,8 +55,8 @@ limitations under the License.
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
     <!-- core dependency versions -->
-    <bigtable.version>2.77.0</bigtable.version>
-    <google-cloud-bigtable-emulator.version>0.214.0</google-cloud-bigtable-emulator.version>
+    <bigtable.version>2.81.0</bigtable.version>
+    <google-cloud-bigtable-emulator.version>0.218.0</google-cloud-bigtable-emulator.version>
     <bigtable-metrics-api.version>1.29.2</bigtable-metrics-api.version>
     <!-- Optional dep for bigtable-metrics-api used for tests -->
     <dropwizard-metrics.version>4.2.22</dropwizard-metrics.version>
@@ -93,6 +93,19 @@ limitations under the License.
     <maven.compiler.target>1.8</maven.compiler.target>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <!-- google-cloud-bigtable 2.81.0 pulls in slf4j-api 2.0.x, while hbase brings the
+           older 1.7.x. Pin to the higher version so the inherited RequireUpperBoundDeps
+           enforcer (from google-cloud-shared-config) is satisfied. -->
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>slf4j-api</artifactId>
+        <version>2.0.16</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <scm>
     <connection>
       scm:git:git@github.com:googleapis/java-bigtable-hbase.git
@@ -173,8 +186,12 @@ limitations under the License.
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-shade-plugin</artifactId>
-          <!-- MSHADE-419: 3.3.0 Shade plugin causes pom to be created without compile dependencies -->
-          <version>3.2.4</version>
+          <!-- 3.6.0+ bundles ASM 9, which can process the Java 17 multi-release classes that
+               google-cloud-bigtable now pulls in transitively (jackson-core 2.18.x). 3.2.4's
+               older ASM fails on those with "Unsupported class file major version 61". The
+               MSHADE-419 regression (reduced pom dropping compile deps) seen in 3.3.0 no longer
+               applies; the generated dependency-reduced-pom is verified to keep compile deps. -->
+          <version>3.6.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>

From 802c9479d4eaaf624d8e9a7812fbd57a6636761d Mon Sep 17 00:00:00 2001
From: Mattie Fu <mattiefu@google.com>
Date: Thu, 13 Aug 2026 20:24:44 +0000
Subject: [PATCH 2/5] deps: centralize slf4j and conscrypt versions as root
 properties

Address review feedback: define slf4j.version and conscrypt.version in the
root pom properties and reference them from dependencyManagement and the
shaded module poms instead of hardcoding.

Change-Id: I3954193069ad1ae794f5ba65708f6a3dedffb276
---
 bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml | 4 ++--
 bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml | 4 ++--
 pom.xml                                                     | 6 +++++-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml
index 433095eef3..b030dbeee8 100644
--- a/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml
+++ b/bigtable-hbase-1.x-parent/bigtable-hbase-1.x-shaded/pom.xml
@@ -56,13 +56,13 @@ limitations under the License.
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk-uber</artifactId>
-        <version>2.6.0</version>
+        <version>${conscrypt.version}</version>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk</artifactId>
-        <version>2.6.0</version>
+        <version>${conscrypt.version}</version>
         <scope>provided</scope>
       </dependency>
 
diff --git a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml
index dd306f0120..0c2d00faf4 100644
--- a/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml
+++ b/bigtable-hbase-2.x-parent/bigtable-hbase-2.x-shaded/pom.xml
@@ -56,13 +56,13 @@ limitations under the License.
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk-uber</artifactId>
-        <version>2.6.0</version>
+        <version>${conscrypt.version}</version>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.conscrypt</groupId>
         <artifactId>conscrypt-openjdk</artifactId>
-        <version>2.6.0</version>
+        <version>${conscrypt.version}</version>
         <scope>provided</scope>
       </dependency>
 
diff --git a/pom.xml b/pom.xml
index e4012bf6d4..149e728987 100644
--- a/pom.xml
+++ b/pom.xml
@@ -58,6 +58,10 @@ limitations under the License.
     <bigtable.version>2.81.0</bigtable.version>
     <google-cloud-bigtable-emulator.version>0.218.0</google-cloud-bigtable-emulator.version>
     <bigtable-metrics-api.version>1.29.2</bigtable-metrics-api.version>
+    <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x; pinned centrally -->
+    <slf4j.version>2.0.16</slf4j.version>
+    <!-- conscrypt version must match the google-cloud-bigtable deps-bom -->
+    <conscrypt.version>2.6.0</conscrypt.version>
     <!-- Optional dep for bigtable-metrics-api used for tests -->
     <dropwizard-metrics.version>4.2.22</dropwizard-metrics.version>
 
@@ -101,7 +105,7 @@ limitations under the License.
       <dependency>
         <groupId>org.slf4j</groupId>
         <artifactId>slf4j-api</artifactId>
-        <version>2.0.16</version>
+        <version>${slf4j.version}</version>
       </dependency>
     </dependencies>
   </dependencyManagement>

From 3cdc66bb2e86579931f821faf1b09eca71272509 Mon Sep 17 00:00:00 2001
From: Mattie Fu <mattiefu@google.com>
Date: Thu, 13 Aug 2026 20:26:40 +0000
Subject: [PATCH 3/5] deps: group slf4j/conscrypt version properties with
 veneer shared libs

Change-Id: I6ce876f481d0e959eda3c0fa7cd032155f66b094
---
 pom.xml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 149e728987..9f55dd5dbb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -58,13 +58,14 @@ limitations under the License.
     <bigtable.version>2.81.0</bigtable.version>
     <google-cloud-bigtable-emulator.version>0.218.0</google-cloud-bigtable-emulator.version>
     <bigtable-metrics-api.version>1.29.2</bigtable-metrics-api.version>
-    <!-- veneer requires slf4j-api 2.x while hbase ships 1.7.x; pinned centrally -->
-    <slf4j.version>2.0.16</slf4j.version>
-    <!-- conscrypt version must match the google-cloud-bigtable deps-bom -->
-    <conscrypt.version>2.6.0</conscrypt.version>
     <!-- Optional dep for bigtable-metrics-api used for tests -->
     <dropwizard-metrics.version>4.2.22</dropwizard-metrics.version>
 
+    <!-- shared library versions pulled in by the bigtable veneer; pinned to satisfy
+         RequireUpperBoundDeps (slf4j) and to match the google-cloud-bigtable deps-bom (conscrypt) -->
+    <slf4j.version>2.0.16</slf4j.version>
+    <conscrypt.version>2.6.0</conscrypt.version>
+
     <!--  keeping at this version to align with hbase-->
     <reload4j.version>1.2.24</reload4j.version>
 

From f454640b3c9276686e089a46d626a1b1d6fc0985 Mon Sep 17 00:00:00 2001
From: Mattie Fu <mattiefu@google.com>
Date: Fri, 14 Aug 2026 15:19:46 +0000
Subject: [PATCH 4/5] fix: make veneer wrapper tests and TestMetrics pass after
 2.81.0 bump

- exclude jspecify from the bigtable-hbase test classpath: gax 2.83.0's
  @NullMarked (@Target ElementType.MODULE) breaks Mockito on Java 8; use
  withoutAnnotations() for the Credentials mocks (TYPE_USE @Nullable)
- record ReadRows first-response latency regardless of OperationType, which
  is now Unary for bounded single-row reads

Change-Id: Iac53d9d8aa9a5a0482f58604064f2de40ff6b94b
---
 .../bigtable-hbase/pom.xml                    | 47 +++++++++++++++++++
 .../metrics/MetricsApiTracerAdapter.java      |  6 ++-
 .../TestBigtableHBaseVeneerSettings.java      | 14 +++++-
 3 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/bigtable-client-core-parent/bigtable-hbase/pom.xml b/bigtable-client-core-parent/bigtable-hbase/pom.xml
index a8ddcface5..3c53879d8c 100644
--- a/bigtable-client-core-parent/bigtable-hbase/pom.xml
+++ b/bigtable-client-core-parent/bigtable-hbase/pom.xml
@@ -73,6 +73,24 @@ limitations under the License.
     <dependency>
       <groupId>com.google.cloud</groupId>
       <artifactId>google-cloud-bigtable</artifactId>
+      <exclusions>
+        <!-- jspecify is a compile-time-only nullness annotation library. Since
+             google-cloud-bigtable 2.81.0 (gax 2.83.0) the veneer API is annotated
+             with @org.jspecify.annotations.NullMarked, whose @Target references
+             ElementType.MODULE (Java 9+). When Mockito/byte-buddy mocks an
+             annotated veneer type on Java 8, the JDK parses that @Target, cannot
+             find the MODULE constant, and throws
+             ArrayStoreException: EnumConstantNotPresentExceptionProxy
+             ("Mockito cannot mock this class"). jspecify carries no runtime
+             behavior, so drop it from the classpath; with the annotation type
+             absent the JVM silently ignores @NullMarked. Excluded from every path
+             that pulls it (see the two test deps below) so it stays off the test
+             classpath. -->
+        <exclusion>
+          <groupId>org.jspecify</groupId>
+          <artifactId>jspecify</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <dependency>
@@ -87,16 +105,37 @@ limitations under the License.
       <artifactId>bigtable-internal-test-helper</artifactId>
       <version>2.19.1</version> <!-- {x-version-update:bigtable-client-parent:current} -->
       <scope>test</scope>
+      <exclusions>
+        <!-- keep jspecify off the (test) classpath - see google-cloud-bigtable above -->
+        <exclusion>
+          <groupId>org.jspecify</groupId>
+          <artifactId>jspecify</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>grpc-google-common-protos</artifactId>
       <scope>test</scope>
+      <exclusions>
+        <!-- keep jspecify off the (test) classpath - see google-cloud-bigtable above -->
+        <exclusion>
+          <groupId>org.jspecify</groupId>
+          <artifactId>jspecify</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>grpc-google-cloud-bigtable-admin-v2</artifactId>
       <scope>test</scope>
+      <exclusions>
+        <!-- keep jspecify off the (test) classpath - see google-cloud-bigtable above -->
+        <exclusion>
+          <groupId>org.jspecify</groupId>
+          <artifactId>jspecify</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>commons-lang</groupId>
@@ -163,6 +202,14 @@ limitations under the License.
                 <!-- make sure that we are a strict superset of veneer -->
                 <targetDependency>com.google.cloud:google-cloud-bigtable</targetDependency>
               </targetDependencies>
+              <ignoredDependencies>
+                <!-- jspecify is a compile-time-only nullness annotation library that
+                     is intentionally excluded from this module (see the exclusions on
+                     google-cloud-bigtable) because its @NullMarked annotation breaks
+                     Mockito on Java 8; it carries no runtime behavior, so it does not
+                     need to be mirrored from veneer. -->
+                <dependency>org.jspecify:jspecify</dependency>
+              </ignoredDependencies>
             </configuration>
           </execution>
           <execution>
diff --git a/bigtable-client-core-parent/bigtable-hbase/src/main/java/com/google/cloud/bigtable/hbase/wrappers/veneer/metrics/MetricsApiTracerAdapter.java b/bigtable-client-core-parent/bigtable-hbase/src/main/java/com/google/cloud/bigtable/hbase/wrappers/veneer/metrics/MetricsApiTracerAdapter.java
index 50ffb2794c..24832885cc 100644
--- a/bigtable-client-core-parent/bigtable-hbase/src/main/java/com/google/cloud/bigtable/hbase/wrappers/veneer/metrics/MetricsApiTracerAdapter.java
+++ b/bigtable-client-core-parent/bigtable-hbase/src/main/java/com/google/cloud/bigtable/hbase/wrappers/veneer/metrics/MetricsApiTracerAdapter.java
@@ -61,7 +61,11 @@ public MetricsApiTracerAdapter(
     this.rpcMetrics = rpcMetrics;
     operationTimer = rpcMetrics.timeOperation();
     lastRetryStatus = RetryStatus.PERMANENT_FAILURE;
-    if (methodName.equals("ReadRows") && operationType == OperationType.ServerStreaming) {
+    // Track first-response latency for ReadRows. Historically ReadRows was always a
+    // ServerStreaming operation, but since google-cloud-bigtable 2.81.0 bounded
+    // single-row reads (e.g. an HBase point-scan) are traced as OperationType.Unary,
+    // so key off the method name alone rather than the operation type.
+    if (methodName.equals("ReadRows")) {
       this.firstResponseTimer = firstResponseLatencyTimer.time();
     }
     firstResponseRecorded = new AtomicBoolean(false);
diff --git a/bigtable-client-core-parent/bigtable-hbase/src/test/java/com/google/cloud/bigtable/hbase/wrappers/veneer/TestBigtableHBaseVeneerSettings.java b/bigtable-client-core-parent/bigtable-hbase/src/test/java/com/google/cloud/bigtable/hbase/wrappers/veneer/TestBigtableHBaseVeneerSettings.java
index 53c37f0f4e..09b70070af 100644
--- a/bigtable-client-core-parent/bigtable-hbase/src/test/java/com/google/cloud/bigtable/hbase/wrappers/veneer/TestBigtableHBaseVeneerSettings.java
+++ b/bigtable-client-core-parent/bigtable-hbase/src/test/java/com/google/cloud/bigtable/hbase/wrappers/veneer/TestBigtableHBaseVeneerSettings.java
@@ -100,7 +100,12 @@ public void testDataSettingsBasicKeys() throws IOException {
     String appProfileId = "appProfileId";
     String userAgent = "test-user-agent";
     String fakeTracingCookie = "fake-tracing-cookie";
-    Credentials credentials = Mockito.mock(Credentials.class);
+    // withoutAnnotations(): com.google.auth.Credentials carries jspecify TYPE_USE
+    // nullness annotations. On Java 8, byte-buddy reading them while building the
+    // mock hits a JDK bug (NPE in sun.reflect.annotation.TypeAnnotationParser), so
+    // tell Mockito not to copy annotations onto the generated mock.
+    Credentials credentials =
+        Mockito.mock(Credentials.class, Mockito.withSettings().withoutAnnotations());
 
     configuration.set(BIGTABLE_PORT_KEY, String.valueOf(TEST_PORT));
     configuration.set(APP_PROFILE_ID_KEY, appProfileId);
@@ -161,7 +166,12 @@ public void testAdminSettingsBasicKeys() throws IOException {
     String adminHost = "testadmin.example.com";
     String userAgent = "test-user-agent";
     String fakeTracingCookie = "fake-tracing-cookie";
-    Credentials credentials = Mockito.mock(Credentials.class);
+    // withoutAnnotations(): com.google.auth.Credentials carries jspecify TYPE_USE
+    // nullness annotations. On Java 8, byte-buddy reading them while building the
+    // mock hits a JDK bug (NPE in sun.reflect.annotation.TypeAnnotationParser), so
+    // tell Mockito not to copy annotations onto the generated mock.
+    Credentials credentials =
+        Mockito.mock(Credentials.class, Mockito.withSettings().withoutAnnotations());
 
     configuration.set(BIGTABLE_ADMIN_HOST_KEY, adminHost);
     configuration.setInt(BIGTABLE_PORT_KEY, TEST_PORT);

From 974769360abb67dae771b8b5796ecd32bc2461c0 Mon Sep 17 00:00:00 2001
From: Mattie Fu <mattiefu@google.com>
Date: Fri, 14 Aug 2026 16:44:29 +0000
Subject: [PATCH 5/5] fix: scope jspecify test-classpath exclusion to surefire
 only

The Java 8 Mockito failure (ArrayStoreException from gax 2.83.0's
@NullMarked) was previously fixed by excluding org.jspecify:jspecify
from google-cloud-bigtable and the test deps. That stripped jspecify
from the compile classpath, which cascaded to downstream modules
(bigtable-hbase-1.x/2.x and the *-shaded modules lost it at compile
scope) and broke their verify-mirror-deps check against
google-cloud-bigtable (expected 1.0.0, got null).

Keep jspecify on the compile classpath and drop it only from the core
module's test runtime via maven-surefire-plugin classpathDependencyExcludes.
Same runtime effect for the mocks, zero blast radius on downstream
modules or shaded jars, no ignoredDependencies needed.

Change-Id: If613073c3dcbde530a6bd76405e0d35a16123acc
---
 .../bigtable-hbase/pom.xml                    | 61 +++++--------------
 1 file changed, 14 insertions(+), 47 deletions(-)

diff --git a/bigtable-client-core-parent/bigtable-hbase/pom.xml b/bigtable-client-core-parent/bigtable-hbase/pom.xml
index 3c53879d8c..7630e64a0b 100644
--- a/bigtable-client-core-parent/bigtable-hbase/pom.xml
+++ b/bigtable-client-core-parent/bigtable-hbase/pom.xml
@@ -73,24 +73,6 @@ limitations under the License.
     <dependency>
       <groupId>com.google.cloud</groupId>
       <artifactId>google-cloud-bigtable</artifactId>
-      <exclusions>
-        <!-- jspecify is a compile-time-only nullness annotation library. Since
-             google-cloud-bigtable 2.81.0 (gax 2.83.0) the veneer API is annotated
-             with @org.jspecify.annotations.NullMarked, whose @Target references
-             ElementType.MODULE (Java 9+). When Mockito/byte-buddy mocks an
-             annotated veneer type on Java 8, the JDK parses that @Target, cannot
-             find the MODULE constant, and throws
-             ArrayStoreException: EnumConstantNotPresentExceptionProxy
-             ("Mockito cannot mock this class"). jspecify carries no runtime
-             behavior, so drop it from the classpath; with the annotation type
-             absent the JVM silently ignores @NullMarked. Excluded from every path
-             that pulls it (see the two test deps below) so it stays off the test
-             classpath. -->
-        <exclusion>
-          <groupId>org.jspecify</groupId>
-          <artifactId>jspecify</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
 
     <dependency>
@@ -105,37 +87,16 @@ limitations under the License.
       <artifactId>bigtable-internal-test-helper</artifactId>
       <version>2.19.1</version> <!-- {x-version-update:bigtable-client-parent:current} -->
       <scope>test</scope>
-      <exclusions>
-        <!-- keep jspecify off the (test) classpath - see google-cloud-bigtable above -->
-        <exclusion>
-          <groupId>org.jspecify</groupId>
-          <artifactId>jspecify</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>grpc-google-common-protos</artifactId>
       <scope>test</scope>
-      <exclusions>
-        <!-- keep jspecify off the (test) classpath - see google-cloud-bigtable above -->
-        <exclusion>
-          <groupId>org.jspecify</groupId>
-          <artifactId>jspecify</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>grpc-google-cloud-bigtable-admin-v2</artifactId>
       <scope>test</scope>
-      <exclusions>
-        <!-- keep jspecify off the (test) classpath - see google-cloud-bigtable above -->
-        <exclusion>
-          <groupId>org.jspecify</groupId>
-          <artifactId>jspecify</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>commons-lang</groupId>
@@ -176,6 +137,20 @@ limitations under the License.
         <artifactId>maven-surefire-plugin</artifactId>
         <configuration>
           <trimStackTrace>false</trimStackTrace>
+          <!-- Drop jspecify from the TEST runtime classpath only (it stays on the
+               compile classpath, so downstream modules and shaded jars are
+               unaffected). Since google-cloud-bigtable 2.81.0 (gax 2.83.0) the
+               veneer API is annotated with @org.jspecify.annotations.NullMarked,
+               whose @Target references ElementType.MODULE (Java 9+). When
+               Mockito/byte-buddy mocks an annotated veneer type (e.g. Batcher) on
+               Java 8, the JDK parses that @Target, cannot find the MODULE constant,
+               and throws ArrayStoreException: EnumConstantNotPresentExceptionProxy
+               ("Mockito cannot mock this class"). jspecify carries no runtime
+               behavior, so removing it from the test classpath makes the JVM
+               silently ignore @NullMarked and the mocks succeed. -->
+          <classpathDependencyExcludes>
+            <classpathDependencyExclude>org.jspecify:jspecify</classpathDependencyExclude>
+          </classpathDependencyExcludes>
           <systemProperties>
             <property>
               <name>java.util.logging.config.file</name>
@@ -202,14 +177,6 @@ limitations under the License.
                 <!-- make sure that we are a strict superset of veneer -->
                 <targetDependency>com.google.cloud:google-cloud-bigtable</targetDependency>
               </targetDependencies>
-              <ignoredDependencies>
-                <!-- jspecify is a compile-time-only nullness annotation library that
-                     is intentionally excluded from this module (see the exclusions on
-                     google-cloud-bigtable) because its @NullMarked annotation breaks
-                     Mockito on Java 8; it carries no runtime behavior, so it does not
-                     need to be mirrored from veneer. -->
-                <dependency>org.jspecify:jspecify</dependency>
-              </ignoredDependencies>
             </configuration>
           </execution>
           <execution>