From 0609d3d90f7f68214e35fffa99c192b8f93d017f Mon Sep 17 00:00:00 2001
From: Jiadong Bai <43344272+bobbai00@users.noreply.github.com>
Date: Fri, 8 May 2026 14:47:38 -0700
Subject: [PATCH 1/5] chore(deps): refresh LICENSE-binary for transitive
 version drift (#4983)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

### What changes were proposed in this PR?

Refresh the per-module `LICENSE-binary` files so they match the bundled
versions reported by the nightly drift check on `b9bbf0d`. Every entry
stays in the license section it was already in, so the change is a pure
version-string substitution; reviewers should still confirm each
upstream's license at the new version is unchanged.

Drift covered:

- `frontend/LICENSE-binary` — `lodash` 4.17.23 → 4.18.1
- `amber/LICENSE-binary-java` and the 5 platform services
(`access-control-service`, `config-service`, `file-service`,
`workflow-compiling-service`, `computing-unit-managing-service`) —
`org.checkerframework.checker-qual` 3.42.0 → 3.52.0
- `amber/LICENSE-binary-python` —
  - `hf-xet` 1.4.3 → 1.5.0
  - `markdown-it-py` 4.0.0 → 4.1.0
  - `pydantic` 2.13.3 → 2.13.4
  - `pydantic-core` 2.46.3 → 2.46.4

All bumps are transitive, which is why PR-mode runs
(`check_binary_deps.py --ignore-transitive-version`) accepted them; only
the nightly strict run flagged the drift.

### Any related issues, documentation, discussions?

Resolves #4974.

### How was this PR tested?

- `python3 bin/licensing/test_check_binary_deps.py` — 27 tests pass.
- The check that originally flagged the drift (the nightly `License
Binary Checker` workflow, which calls `build.yml` with `mode: nightly`
and runs `check_binary_deps.py` without `--ignore-transitive-version`)
is exercised by the build matrix on this PR; the previously-failing
license steps for frontend, amber, the five platform services, and
python are expected to turn green.

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.7, 1M context)

Co-authored-by: Bot Bai <bobbairobot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 access-control-service/LICENSE-binary          | 2 +-
 amber/LICENSE-binary-java                      | 2 +-
 amber/LICENSE-binary-python                    | 8 ++++----
 computing-unit-managing-service/LICENSE-binary | 2 +-
 config-service/LICENSE-binary                  | 2 +-
 file-service/LICENSE-binary                    | 2 +-
 frontend/LICENSE-binary                        | 2 +-
 workflow-compiling-service/LICENSE-binary      | 2 +-
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/access-control-service/LICENSE-binary b/access-control-service/LICENSE-binary
index 6bb66df548d..9af04d35f5f 100644
--- a/access-control-service/LICENSE-binary
+++ b/access-control-service/LICENSE-binary
@@ -324,7 +324,7 @@ Source files derived from third-party MIT-licensed projects:
 
 Scala/Java jars:
   - net.sourceforge.argparse4j.argparse4j-0.9.0.jar
-  - org.checkerframework.checker-qual-3.42.0.jar
+  - org.checkerframework.checker-qual-3.52.0.jar
   - org.slf4j.jul-to-slf4j-2.0.12.jar
   - org.slf4j.slf4j-api-2.0.12.jar
 
diff --git a/amber/LICENSE-binary-java b/amber/LICENSE-binary-java
index 04c9732d3ac..8fbd626ca44 100644
--- a/amber/LICENSE-binary-java
+++ b/amber/LICENSE-binary-java
@@ -572,7 +572,7 @@ Scala/Java jars:
   - com.liveperson.dropwizard-websockets-1.3.14.jar
   - io.github.classgraph.classgraph-4.8.157.jar
   - net.sourceforge.argparse4j.argparse4j-0.8.1.jar
-  - org.checkerframework.checker-qual-3.42.0.jar
+  - org.checkerframework.checker-qual-3.52.0.jar
   - org.codehaus.mojo.animal-sniffer-annotations-1.23.jar
   - org.projectlombok.lombok-1.18.24.jar
   - org.reactivestreams.reactive-streams-1.0.4.jar
diff --git a/amber/LICENSE-binary-python b/amber/LICENSE-binary-python
index 5dfd64b6be7..91b8a3dd190 100644
--- a/amber/LICENSE-binary-python
+++ b/amber/LICENSE-binary-python
@@ -217,7 +217,7 @@ Python packages:
   - boto3==1.40.53
   - botocore==1.40.53
   - frozenlist==1.8.0
-  - hf-xet==1.4.3
+  - hf-xet==1.5.0
   - huggingface-hub==0.36.2
   - multidict==6.7.1
   - overrides==7.4.0
@@ -262,14 +262,14 @@ Python packages:
   - iniconfig==1.1.1
   - jmespath==1.1.0
   - loguru==0.7.0
-  - markdown-it-py==4.0.0
+  - markdown-it-py==4.1.0
   - mdurl==0.1.2
   - mmh3==5.2.1
   - pampy==0.3.0
   - plotly==5.24.1
   - pluggy==1.6.0
-  - pydantic==2.13.3
-  - pydantic-core==2.46.3
+  - pydantic==2.13.4
+  - pydantic-core==2.46.4
   - pyparsing==3.3.2
   - pyroaring==1.1.0
   - pytest==7.4.0
diff --git a/computing-unit-managing-service/LICENSE-binary b/computing-unit-managing-service/LICENSE-binary
index efcee44a84b..229fee7fdef 100644
--- a/computing-unit-managing-service/LICENSE-binary
+++ b/computing-unit-managing-service/LICENSE-binary
@@ -540,7 +540,7 @@ Scala/Java jars:
   - org.bouncycastle.bcpkix-jdk18on-1.78.1.jar
   - org.bouncycastle.bcprov-jdk18on-1.78.1.jar
   - org.bouncycastle.bcutil-jdk18on-1.78.1.jar
-  - org.checkerframework.checker-qual-3.42.0.jar
+  - org.checkerframework.checker-qual-3.52.0.jar
   - org.codehaus.mojo.animal-sniffer-annotations-1.23.jar
   - org.projectlombok.lombok-1.18.24.jar
   - org.reactivestreams.reactive-streams-1.0.4.jar
diff --git a/config-service/LICENSE-binary b/config-service/LICENSE-binary
index 99bb33f98d4..73bff916d93 100644
--- a/config-service/LICENSE-binary
+++ b/config-service/LICENSE-binary
@@ -326,7 +326,7 @@ Source files derived from third-party MIT-licensed projects:
 
 Scala/Java jars:
   - net.sourceforge.argparse4j.argparse4j-0.9.0.jar
-  - org.checkerframework.checker-qual-3.42.0.jar
+  - org.checkerframework.checker-qual-3.52.0.jar
   - org.slf4j.jul-to-slf4j-2.0.12.jar
   - org.slf4j.slf4j-api-2.0.12.jar
 
diff --git a/file-service/LICENSE-binary b/file-service/LICENSE-binary
index a242d5d4b4f..01172fafb86 100644
--- a/file-service/LICENSE-binary
+++ b/file-service/LICENSE-binary
@@ -501,7 +501,7 @@ Source files derived from third-party MIT-licensed projects:
 
 Scala/Java jars:
   - net.sourceforge.argparse4j.argparse4j-0.9.0.jar
-  - org.checkerframework.checker-qual-3.42.0.jar
+  - org.checkerframework.checker-qual-3.52.0.jar
   - org.codehaus.mojo.animal-sniffer-annotations-1.23.jar
   - org.projectlombok.lombok-1.18.24.jar
   - org.reactivestreams.reactive-streams-1.0.4.jar
diff --git a/frontend/LICENSE-binary b/frontend/LICENSE-binary
index 3cfe8bab21f..8e3904cadb7 100644
--- a/frontend/LICENSE-binary
+++ b/frontend/LICENSE-binary
@@ -288,7 +288,7 @@ Angular / npm packages:
   - json-schema-traverse@1.0.0
   - jszip@3.10.1
   - lib0@0.2.117
-  - lodash@4.17.23
+  - lodash@4.18.1
   - lodash-es@4.18.1
   - marked@17.0.1
   - mobx@4.14.1
diff --git a/workflow-compiling-service/LICENSE-binary b/workflow-compiling-service/LICENSE-binary
index 67fa5e9180f..76209778531 100644
--- a/workflow-compiling-service/LICENSE-binary
+++ b/workflow-compiling-service/LICENSE-binary
@@ -509,7 +509,7 @@ Scala/Java jars:
   - com.konghq.unirest-java-3.14.2.jar
   - io.github.classgraph.classgraph-4.8.157.jar
   - net.sourceforge.argparse4j.argparse4j-0.9.0.jar
-  - org.checkerframework.checker-qual-3.42.0.jar
+  - org.checkerframework.checker-qual-3.52.0.jar
   - org.codehaus.mojo.animal-sniffer-annotations-1.23.jar
   - org.projectlombok.lombok-1.18.24.jar
   - org.reactivestreams.reactive-streams-1.0.4.jar

From deb0e2cfc979767e07248a75261da5ec98e3ae3e Mon Sep 17 00:00:00 2001
From: Meng Wang <mengw15@uci.edu>
Date: Fri, 8 May 2026 15:01:05 -0700
Subject: [PATCH 2/5] refactor(config): drop unused rest-uri key from
 storage.conf (#4990)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

### What changes were proposed in this PR?

Delete the two `rest-uri` lines from
`common/config/src/main/resources/storage.conf`:

```
rest-uri = ""
rest-uri = ${?STORAGE_ICEBERG_CATALOG_REST_URI}
```

This hyphenated flat key (`storage.iceberg.catalog.rest-uri`) is not
read
by any Scala code. The active key is the nested
`storage.iceberg.catalog.rest.uri` (a few lines below in the `rest { …
}`
block), which already consumes the same
`STORAGE_ICEBERG_CATALOG_REST_URI`
env var.

| Key | Read by Scala? |
| --- | --- |
| `storage.iceberg.catalog.rest-uri` (deleted) | No |
| `storage.iceberg.catalog.rest.uri` (kept) |
`StorageConfig.icebergRESTCatalogUri` |

### Any related issues, documentation, discussions?

Closes #4989

### How was this PR tested?

```
sbt "Config/compile"
[success] Total time: 3 s
```

Pure config-cleanup; no Scala / Python / shell consumer of the deleted
key. The `STORAGE_ICEBERG_CATALOG_REST_URI` env var continues to flow
into
amber/CU through the nested `rest.uri` key.

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.7)

Co-authored-by: Jiadong Bai <43344272+bobbai00@users.noreply.github.com>
---
 common/config/src/main/resources/storage.conf | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/common/config/src/main/resources/storage.conf b/common/config/src/main/resources/storage.conf
index 1f39359155c..29d5f7be512 100644
--- a/common/config/src/main/resources/storage.conf
+++ b/common/config/src/main/resources/storage.conf
@@ -24,9 +24,6 @@ storage {
             type = postgres # either hadoop, rest, or postgres
             type = ${?STORAGE_ICEBERG_CATALOG_TYPE}
 
-            rest-uri = ""
-            rest-uri = ${?STORAGE_ICEBERG_CATALOG_REST_URI} # the uri of the rest catalog, not needed unless using REST catalog
-
             rest {
                 uri = "http://localhost:8181/catalog"
                 uri = ${?STORAGE_ICEBERG_CATALOG_REST_URI}

From 2652315f6c8d51688ca26dafaa760f811cff01a2 Mon Sep 17 00:00:00 2001
From: "Matthew B." <mgball@uci.edu>
Date: Fri, 8 May 2026 17:39:36 -0700
Subject: [PATCH 3/5] ci: add /request-review and /unrequest-review comment
 commands (#4986)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

### What changes were proposed in this PR?
- Renamed .github/workflows/take-commands.yml →
.github/workflows/comment-commands.yml, since the workflow now handles
more than just /take and /untake.
- Added a new request-review job that handles two new slash commands on
PRs:
- /request-review @alice @bob requests reviews from the listed
users/teams.
- /unrequest-review @alice cancels a pending review request.
- Authorization: PR author (fast path) or any committer with
write/maintain/admin permission. Anyone else is rejected and logged.
- Supports both individual users (@alice) and teams (@org/team-name);
routes them to the correct API bucket.
- Strips self-mentions before calling the API so the atomic call doesn't
fail over a single bad name.
- Workflow renamed Issue take commands → Comment commands and granted
pull-requests: write.
- Avoids the /review namespace so it stays free for future use (e.g.,
self-review).

### Any related issues, documentation, or discussions?
Closes: #4975

### How was this PR tested?
Tested on my local fork.


### Was this PR authored or co-authored using generative AI tooling?
Co-Authored with Claude Opus 4.7 in Compliance with ASF
---
 .github/workflows/comment-commands.yml | 167 +++++++++++++++++++++++++
 .github/workflows/take-commands.yml    |  85 -------------
 2 files changed, 167 insertions(+), 85 deletions(-)
 create mode 100644 .github/workflows/comment-commands.yml
 delete mode 100644 .github/workflows/take-commands.yml

diff --git a/.github/workflows/comment-commands.yml b/.github/workflows/comment-commands.yml
new file mode 100644
index 00000000000..3300db1353d
--- /dev/null
+++ b/.github/workflows/comment-commands.yml
@@ -0,0 +1,167 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# /take, /untake, /request-review, and /unrequest-review comment commands.
+#
+# Triage state is no longer materialized as a label — it is the search
+# filter `is:issue is:open no:assignee`. Anyone can self-claim an issue
+# by commenting `/take` (and self-release with `/untake`); PR-driven
+# assignee sync is handled by `pr-assignment.yml`.
+#
+# On pull requests, the author can request or cancel reviewer requests
+# via `/request-review @user [@user ...]` and `/unrequest-review @user
+# [@user ...]`. We avoid the `/review` namespace so it stays free for
+# future use (e.g. self-review).
+name: Comment commands
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  take:
+    # The startsWith filter at the job level keeps unrelated comments
+    # from allocating a runner; the regex inside the script enforces an
+    # exact `/take` or `/untake` so suffixes like `/take this` do not
+    # silently match.
+    if: >-
+      github.event_name == 'issue_comment'
+      && github.event.action == 'created'
+      && github.event.issue.pull_request == null
+      && github.event.comment.user.type != 'Bot'
+      && (startsWith(github.event.comment.body, '/take')
+          || startsWith(github.event.comment.body, '/untake'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const body = (context.payload.comment.body || '').trim();
+            const issue_number = context.payload.issue.number;
+            const login = context.payload.comment.user.login;
+            const { owner, repo } = context.repo;
+            core.info(
+              `take/untake candidate: ${login} on issue #${issue_number}; ` +
+                `body=${JSON.stringify(body)}`,
+            );
+
+            if (/^\/take\s*$/.test(body)) {
+              try {
+                await github.rest.issues.addAssignees({
+                  owner, repo, issue_number, assignees: [login],
+                });
+                core.info(`Assigned ${login} to issue #${issue_number}`);
+              } catch (e) {
+                core.warning(
+                  `addAssignees on #${issue_number} failed: ${e.message}`,
+                );
+              }
+            } else if (/^\/untake\s*$/.test(body)) {
+              try {
+                await github.rest.issues.removeAssignees({
+                  owner, repo, issue_number, assignees: [login],
+                });
+                core.info(`Unassigned ${login} from issue #${issue_number}`);
+              } catch (e) {
+                core.warning(
+                  `removeAssignees on #${issue_number} failed: ${e.message}`,
+                );
+              }
+            } else {
+              core.info(
+                `Comment does not match exact '/take' or '/untake'; skipping.`,
+              );
+            }
+
+  request-review:
+    # Job-level startsWith gate avoids spinning up a runner for every
+    # PR comment; the regex inside the script enforces the exact shape.
+    if: >-
+      github.event_name == 'issue_comment'
+      && github.event.action == 'created'
+      && github.event.issue.pull_request != null
+      && github.event.comment.user.type != 'Bot'
+      && (startsWith(github.event.comment.body, '/request-review')
+          || startsWith(github.event.comment.body, '/unrequest-review'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const body = (context.payload.comment.body || '').trim();
+            const pull_number = context.payload.issue.number;
+            const commenter = context.payload.comment.user.login;
+            const author = context.payload.issue.user.login;
+            const { owner, repo } = context.repo;
+
+            const match = body.match(
+              /^\/(request-review|unrequest-review)\b(.*)$/s,
+            );
+            if (!match) {
+              core.info(`Comment does not match exact command; skipping.`);
+              return;
+            }
+            const action = match[1];
+
+            if (commenter !== author) {
+              core.info(
+                `${commenter} is not the author of #${pull_number}; skipping.`,
+              );
+              return;
+            }
+
+            // Parse @user and @org/team mentions; route teams to the
+            // team_reviewers bucket. Strip self so the API doesn't
+            // reject the whole atomic call over one bad name. Copilot
+            // is a bot reviewer that the REST API expects as the exact
+            // slug "Copilot", so normalize any casing of @copilot.
+            const reviewers = [];
+            const team_reviewers = [];
+            for (const [, h] of match[2].matchAll(
+              /@([\w-]+(?:\/[\w.-]+)?)/g,
+            )) {
+              if (h.includes('/')) team_reviewers.push(h.split('/')[1]);
+              else if (h.toLowerCase() === 'copilot') reviewers.push('Copilot');
+              else if (h.toLowerCase() !== author.toLowerCase())
+                reviewers.push(h);
+            }
+            if (!reviewers.length && !team_reviewers.length) {
+              core.warning(`No valid @mentions in '${action}'; skipping.`);
+              return;
+            }
+
+            const params = { owner, repo, pull_number, reviewers, team_reviewers };
+            try {
+              if (action === 'request-review') {
+                await github.rest.pulls.requestReviewers(params);
+              } else {
+                await github.rest.pulls.removeRequestedReviewers(params);
+              }
+              core.info(
+                `${action} on #${pull_number} by ${commenter}: ` +
+                  `users=[${reviewers.join(', ')}] ` +
+                  `teams=[${team_reviewers.join(', ')}]`,
+              );
+            } catch (e) {
+              core.warning(
+                `${action} on #${pull_number} failed: ${e.message}`,
+              );
+            }
diff --git a/.github/workflows/take-commands.yml b/.github/workflows/take-commands.yml
deleted file mode 100644
index bf567f62408..00000000000
--- a/.github/workflows/take-commands.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# /take and /untake comment commands.
-#
-# Triage state is no longer materialized as a label — it is the search
-# filter `is:issue is:open no:assignee`. Anyone can self-claim an issue
-# by commenting `/take` (and self-release with `/untake`); PR-driven
-# assignee sync is handled by `pr-assignment.yml`.
-name: Issue take commands
-on:
-  issue_comment:
-    types: [created]
-
-permissions:
-  issues: write
-
-jobs:
-  take:
-    # The startsWith filter at the job level keeps unrelated comments
-    # from allocating a runner; the regex inside the script enforces an
-    # exact `/take` or `/untake` so suffixes like `/take this` do not
-    # silently match.
-    if: >-
-      github.event_name == 'issue_comment'
-      && github.event.action == 'created'
-      && github.event.issue.pull_request == null
-      && github.event.comment.user.type != 'Bot'
-      && (startsWith(github.event.comment.body, '/take')
-          || startsWith(github.event.comment.body, '/untake'))
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const body = (context.payload.comment.body || '').trim();
-            const issue_number = context.payload.issue.number;
-            const login = context.payload.comment.user.login;
-            const { owner, repo } = context.repo;
-            core.info(
-              `take/untake candidate: ${login} on issue #${issue_number}; ` +
-                `body=${JSON.stringify(body)}`,
-            );
-
-            if (/^\/take\s*$/.test(body)) {
-              try {
-                await github.rest.issues.addAssignees({
-                  owner, repo, issue_number, assignees: [login],
-                });
-                core.info(`Assigned ${login} to issue #${issue_number}`);
-              } catch (e) {
-                core.warning(
-                  `addAssignees on #${issue_number} failed: ${e.message}`,
-                );
-              }
-            } else if (/^\/untake\s*$/.test(body)) {
-              try {
-                await github.rest.issues.removeAssignees({
-                  owner, repo, issue_number, assignees: [login],
-                });
-                core.info(`Unassigned ${login} from issue #${issue_number}`);
-              } catch (e) {
-                core.warning(
-                  `removeAssignees on #${issue_number} failed: ${e.message}`,
-                );
-              }
-            } else {
-              core.info(
-                `Comment does not match exact '/take' or '/untake'; skipping.`,
-              );
-            }

From 75ff07e36adcc626a91a41f96b78893e2d5e63c3 Mon Sep 17 00:00:00 2001
From: Jiadong Bai <43344272+bobbai00@users.noreply.github.com>
Date: Fri, 8 May 2026 21:51:40 -0700
Subject: [PATCH 4/5] feat(build): bump Scala/Java services to Java 17 LTS
 (#4938)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

### What changes were proposed in this PR?

Bump all Scala/Java microservices from Java 11 to Java 17 LTS, and
centralize the JDK 17 `--add-opens` flags through `.jvmopts` as a
single source of truth.

**Toolchain bumps**

- 8 Dockerfiles under `bin/`: build base
  `sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11`
  → `...-17.0.5_8_1.9.3_2.13.11` (same sbt 1.9.3 + Scala 2.13.11);
  runtime `eclipse-temurin:11-{jdk,jre}-jammy` → `17-{jdk,jre}-jammy`.
- `.github/workflows/build.yml` and `build-and-push-images.yml`:
  `java-version: 11` → `17` (matrix entries + 5 `setup-java` steps).
- `AGENTS.md`: toolchain table.

**`.jvmopts` as single source of truth**

`.jvmopts` lists the seven `--add-opens` flags JDK 17 needs for the
runtime (Pekko, Apache Arrow, Ehcache `SizeOf`, Pekko Kryo
serialization). The same file reaches every JVM the build launches:

- sbt's own JVM: sbt's launcher reads `.jvmopts` directly.
- forked test JVMs (sbt-jacoco): `ThisBuild / Test / javaOptions ++=
  JdkOptions.jvmFlags(...)` in `build.sbt`.
- sbt-native-packager `bin/<svc>` launchers in production dists:
  `Universal / javaOptions ++= JdkOptions.jvmFlags(...).map("-J" + _)`,
  bundled per-project via `asfLicensingSettings` (Universal does not
  cascade from ThisBuild).
- IntelliJ run configs `.run/ComputingUnit{Master,Worker}.run.xml`:
  `VM_PARAMETERS=@$PROJECT_DIR$/.jvmopts` (JDK 9+ argfile expansion).

`project/JdkOptions.scala` (modeled on Pekko's) reads the file once
and exposes a `Seq[String]` for the build to wire up.

### Any related issues, documentation, discussions?

Closes #4937. Refs discussion #4001.

### How was this PR tested?

CI's amber job now finishes in
single-digit minutes, with all 5 `jacoco` tasks passing. Local
verification: `sbt show ThisBuild / Test / javaOptions` and
`sbt show <project> / Universal / javaOptions` confirm flag
propagation across all subprojects; `java @.jvmopts -version`
confirms the JDK accepts the argfile cleanly; running amber
`jacoco` locally hits zero `InaccessibleObjectException`.

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Opus 4.7)

---------

Co-authored-by: Xinyuan Lin <xinyual3@uci.edu>
Co-authored-by: Bot Bai <bobbairobot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build-and-push-images.yml   |  6 +-
 .github/workflows/build.yml                   | 10 ++--
 .jvmopts                                      | 28 +++++++++
 .run/ComputingUnitMaster.run.xml              |  1 +
 .run/ComputingUnitWorker.run.xml              |  1 +
 AGENTS.md                                     | 12 +++-
 bin/access-control-service.dockerfile         |  5 +-
 bin/computing-unit-master.dockerfile          |  5 +-
 bin/computing-unit-worker.dockerfile          |  5 +-
 bin/config-service.dockerfile                 |  5 +-
 bin/file-service.dockerfile                   |  5 +-
 bin/texera-web-application.dockerfile         |  5 +-
 bin/workflow-compiling-service.dockerfile     |  5 +-
 ...computing-unit-managing-service.dockerfile |  5 +-
 build.sbt                                     | 14 ++++-
 project/JdkOptions.scala                      | 57 +++++++++++++++++++
 16 files changed, 142 insertions(+), 27 deletions(-)
 create mode 100644 .jvmopts
 create mode 100644 project/JdkOptions.scala

diff --git a/.github/workflows/build-and-push-images.yml b/.github/workflows/build-and-push-images.yml
index 19534787f8b..ae998c9a9ef 100644
--- a/.github/workflows/build-and-push-images.yml
+++ b/.github/workflows/build-and-push-images.yml
@@ -123,7 +123,7 @@ jobs:
         uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: 11
+          java-version: 17
 
       - name: Setup sbt launcher
         uses: sbt/setup-sbt@508b753e53cb6095967669e0911487d2b9bc9f41 # v1.1.22
@@ -325,7 +325,7 @@ jobs:
         uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: 11
+          java-version: 17
 
       - name: Setup sbt launcher
         uses: sbt/setup-sbt@508b753e53cb6095967669e0911487d2b9bc9f41 # v1.1.22
@@ -405,7 +405,7 @@ jobs:
         uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: 11
+          java-version: 17
 
       - name: Setup sbt launcher
         uses: sbt/setup-sbt@508b753e53cb6095967669e0911487d2b9bc9f41 # v1.1.22
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 988c3831397..0a1ffbef18a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -144,7 +144,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-22.04]
-        java-version: [11]
+        java-version: [17]
     runs-on: ${{ matrix.os }}
     env:
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
@@ -175,7 +175,7 @@ jobs:
         uses: actions/setup-java@v5
         with:
           distribution: "temurin"
-          java-version: 11
+          java-version: 17
       - name: Create Databases
         # Must run before any sbt compile step: the build's JOOQ source
         # generators connect to texera_db while compiling.
@@ -262,7 +262,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-22.04]
-        java-version: [11]
+        java-version: [17]
     runs-on: ${{ matrix.os }}
     env:
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
@@ -293,7 +293,7 @@ jobs:
         uses: actions/setup-java@v5
         with:
           distribution: "temurin"
-          java-version: 11
+          java-version: 17
       - name: Setup Python for Scala-Python integration tests
         uses: actions/setup-python@v6
         with:
@@ -405,7 +405,7 @@ jobs:
         uses: actions/setup-java@v5
         with:
           distribution: "temurin"
-          java-version: 11
+          java-version: 17
       - name: Setup sbt launcher
         uses: sbt/setup-sbt@508b753e53cb6095967669e0911487d2b9bc9f41 # v1.1.22
       - uses: coursier/cache-action@90c37294538be80a558fd665531fcdc2b467b475 # v8.1.0
diff --git a/.jvmopts b/.jvmopts
new file mode 100644
index 00000000000..3f4c694a764
--- /dev/null
+++ b/.jvmopts
@@ -0,0 +1,28 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Required by Kryo: https://github.com/altoo-ag/pekko-kryo-serialization#using-kryo-on-jdk-17
+--add-opens=java.base/java.lang=ALL-UNNAMED
+--add-opens=java.base/java.lang.invoke=ALL-UNNAMED
+--add-opens=java.base/java.util=ALL-UNNAMED
+--add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED
+--add-opens=java.base/sun.nio.ch=ALL-UNNAMED
+
+# Required by Apache Arrow: https://arrow.apache.org/java/main/install.html
+--add-opens=java.base/java.nio=ALL-UNNAMED
+
+# Required by Apache Pekko: https://pekko.apache.org/docs/pekko/snapshot/release-notes/releases-2.0.html
+--add-opens=java.base/jdk.internal.misc=ALL-UNNAMED
diff --git a/.run/ComputingUnitMaster.run.xml b/.run/ComputingUnitMaster.run.xml
index 5ffffb79e88..7d3a3aaf989 100644
--- a/.run/ComputingUnitMaster.run.xml
+++ b/.run/ComputingUnitMaster.run.xml
@@ -19,6 +19,7 @@ under the License.
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="ComputingUnitMaster" type="Application" factoryName="Application">
     <option name="MAIN_CLASS_NAME" value="org.apache.texera.web.ComputingUnitMaster" />
+    <option name="VM_PARAMETERS" value="@$PROJECT_DIR$/.jvmopts" />
     <module name="texera.amber" />
     <shortenClasspath name="ARGS_FILE" />
     <extension name="coverage">
diff --git a/.run/ComputingUnitWorker.run.xml b/.run/ComputingUnitWorker.run.xml
index 854da672287..025e3cfd1b7 100644
--- a/.run/ComputingUnitWorker.run.xml
+++ b/.run/ComputingUnitWorker.run.xml
@@ -19,6 +19,7 @@ under the License.
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="ComputingUnitWorker" type="Application" factoryName="Application">
     <option name="MAIN_CLASS_NAME" value="org.apache.texera.web.ComputingUnitWorker" />
+    <option name="VM_PARAMETERS" value="@$PROJECT_DIR$/.jvmopts" />
     <module name="texera.amber" />
     <shortenClasspath name="ARGS_FILE" />
     <extension name="coverage">
diff --git a/AGENTS.md b/AGENTS.md
index cb1cd0fdb3a..ba40082d595 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -66,7 +66,7 @@ merge.
 
 | Component | Version |
 | --- | --- |
-| Java | JDK 11 |
+| Java | JDK 17 |
 | Scala | 2.13 |
 | Python | 3.12 |
 | Node | 24 |
@@ -90,6 +90,16 @@ in [`udf.conf`](common/config/src/main/resources/udf.conf) or
 `export UDF_PYTHON_PATH="$(pwd)/../venv312/bin/python"` (env var overrides).
 Without it, `sbt` Python-integration tests fail to launch a worker.
 
+[`.jvmopts`](.jvmopts) holds every `--add-opens` flag Texera needs for
+JDK 17+, with each group annotated by its upstream source (Kryo,
+Apache Arrow, Apache Pekko). sbt's launcher and the [`.run/`](.run)
+configs read it automatically; for raw `java` launches, pass it as an
+argfile: `java @.jvmopts -jar …`. If a future library version or a new
+code path triggers an `InaccessibleObjectException`, add the open to
+`.jvmopts`. [`project/JdkOptions.scala`](project/JdkOptions.scala)
+will propagates the changed options to forked test JVMs, sbt-native-packager dist launchers,
+and IntelliJ.
+
 ### Branch and commit naming
 
 Short, **Conventional Commits**, same shape for branch and commit subject.
diff --git a/bin/access-control-service.dockerfile b/bin/access-control-service.dockerfile
index 1429171a5a5..43d4c4e5a47 100644
--- a/bin/access-control-service.dockerfile
+++ b/bin/access-control-service.dockerfile
@@ -24,7 +24,7 @@
 # completeness or stability of the code, it does indicate that the project
 # has yet to be fully endorsed by the ASF.
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -34,6 +34,7 @@ COPY common/ common/
 COPY access-control-service/ access-control-service/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies
 RUN apt-get update && apt-get install -y \
@@ -52,7 +53,7 @@ RUN sbt clean AccessControlService/dist
 # Unzip the texera binary
 RUN unzip access-control-service/target/universal/access-control-service-*.zip -d target/
 
-FROM eclipse-temurin:11-jre-jammy AS runtime
+FROM eclipse-temurin:17-jre-jammy AS runtime
 
 WORKDIR /texera
 
diff --git a/bin/computing-unit-master.dockerfile b/bin/computing-unit-master.dockerfile
index 5fcb54968dc..191d23f2ddf 100644
--- a/bin/computing-unit-master.dockerfile
+++ b/bin/computing-unit-master.dockerfile
@@ -24,7 +24,7 @@
 # completeness or stability of the code, it does indicate that the project
 # has yet to be fully endorsed by the ASF.
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -34,6 +34,7 @@ COPY common/ common/
 COPY amber/ amber/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies. python3-minimal is needed by
 # bin/licensing/concat_license_binary.py below.
@@ -64,7 +65,7 @@ RUN python3 bin/licensing/concat_license_binary.py amber/LICENSE-binary-combined
         amber/LICENSE-binary-java \
         amber/LICENSE-binary-python
 
-FROM eclipse-temurin:11-jdk-jammy AS runtime
+FROM eclipse-temurin:17-jdk-jammy AS runtime
 
 WORKDIR /texera/amber
 
diff --git a/bin/computing-unit-worker.dockerfile b/bin/computing-unit-worker.dockerfile
index f600a9c05fb..28d3b4cf0c2 100644
--- a/bin/computing-unit-worker.dockerfile
+++ b/bin/computing-unit-worker.dockerfile
@@ -24,7 +24,7 @@
 # completeness or stability of the code, it does indicate that the project
 # has yet to be fully endorsed by the ASF.
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -34,6 +34,7 @@ COPY common/ common/
 COPY amber/ amber/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies. python3-minimal is needed by
 # bin/licensing/concat_license_binary.py below.
@@ -64,7 +65,7 @@ RUN python3 bin/licensing/concat_license_binary.py amber/LICENSE-binary-combined
         amber/LICENSE-binary-java \
         amber/LICENSE-binary-python
 
-FROM eclipse-temurin:11-jre-jammy AS runtime
+FROM eclipse-temurin:17-jre-jammy AS runtime
 
 WORKDIR /texera/amber
 
diff --git a/bin/config-service.dockerfile b/bin/config-service.dockerfile
index 17c3d57de1f..df986ee2ff6 100644
--- a/bin/config-service.dockerfile
+++ b/bin/config-service.dockerfile
@@ -24,7 +24,7 @@
 # completeness or stability of the code, it does indicate that the project
 # has yet to be fully endorsed by the ASF.
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -34,6 +34,7 @@ COPY common/ common/
 COPY config-service/ config-service/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies
 RUN apt-get update && apt-get install -y \
@@ -52,7 +53,7 @@ RUN sbt clean ConfigService/dist
 # Unzip the texera binary
 RUN unzip config-service/target/universal/config-service-*.zip -d target/
 
-FROM eclipse-temurin:11-jre-jammy AS runtime
+FROM eclipse-temurin:17-jre-jammy AS runtime
 
 WORKDIR /texera
 
diff --git a/bin/file-service.dockerfile b/bin/file-service.dockerfile
index 3966b5122b8..1bf7032a747 100644
--- a/bin/file-service.dockerfile
+++ b/bin/file-service.dockerfile
@@ -24,7 +24,7 @@
 # completeness or stability of the code, it does indicate that the project
 # has yet to be fully endorsed by the ASF.
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -34,6 +34,7 @@ COPY common/ common/
 COPY file-service/ file-service/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies
 RUN apt-get update && apt-get install -y \
@@ -52,7 +53,7 @@ RUN sbt clean FileService/dist
 # Unzip the texera binary
 RUN unzip file-service/target/universal/file-service-*.zip -d target/
 
-FROM eclipse-temurin:11-jre-jammy AS runtime
+FROM eclipse-temurin:17-jre-jammy AS runtime
 
 WORKDIR /texera
 
diff --git a/bin/texera-web-application.dockerfile b/bin/texera-web-application.dockerfile
index 706b0fdcfb5..a829fb16aa1 100644
--- a/bin/texera-web-application.dockerfile
+++ b/bin/texera-web-application.dockerfile
@@ -38,7 +38,7 @@ RUN echo "nodeLinker: node-modules" >> /frontend/.yarnrc.yml
 WORKDIR /frontend
 RUN yarn install && yarn run build
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -48,6 +48,7 @@ COPY common/ common/
 COPY amber/ amber/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies. python3-minimal is needed by
 # bin/licensing/concat_license_binary.py below.
@@ -82,7 +83,7 @@ RUN python3 bin/licensing/concat_license_binary.py amber/LICENSE-binary-combined
         amber/LICENSE-binary-java \
         amber/LICENSE-binary-frontend
 
-FROM eclipse-temurin:11-jre-jammy AS runtime
+FROM eclipse-temurin:17-jre-jammy AS runtime
 
 WORKDIR /texera/amber
 # Copy built frontend files from the build-frontend stage to match FileAssetsBundle path (../../frontend/dist from /texera/amber)
diff --git a/bin/workflow-compiling-service.dockerfile b/bin/workflow-compiling-service.dockerfile
index b8f7f6c3923..a94940ed0d7 100644
--- a/bin/workflow-compiling-service.dockerfile
+++ b/bin/workflow-compiling-service.dockerfile
@@ -24,7 +24,7 @@
 # completeness or stability of the code, it does indicate that the project
 # has yet to be fully endorsed by the ASF.
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -34,6 +34,7 @@ COPY common/ common/
 COPY workflow-compiling-service/ workflow-compiling-service/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies
 RUN apt-get update && apt-get install -y \
@@ -52,7 +53,7 @@ RUN sbt clean WorkflowCompilingService/dist
 # Unzip the texera binary
 RUN unzip workflow-compiling-service/target/universal/workflow-compiling-service-*.zip -d target/
 
-FROM eclipse-temurin:11-jre-jammy AS runtime
+FROM eclipse-temurin:17-jre-jammy AS runtime
 
 WORKDIR /texera
 
diff --git a/bin/workflow-computing-unit-managing-service.dockerfile b/bin/workflow-computing-unit-managing-service.dockerfile
index 78d0ba89db4..a47e6ce06e5 100644
--- a/bin/workflow-computing-unit-managing-service.dockerfile
+++ b/bin/workflow-computing-unit-managing-service.dockerfile
@@ -24,7 +24,7 @@
 # completeness or stability of the code, it does indicate that the project
 # has yet to be fully endorsed by the ASF.
 
-FROM sbtscala/scala-sbt:eclipse-temurin-jammy-11.0.17_8_1.9.3_2.13.11 AS build
+FROM sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.5_8_1.9.3_2.13.11 AS build
 
 # Set working directory
 WORKDIR /texera
@@ -34,6 +34,7 @@ COPY common/ common/
 COPY computing-unit-managing-service/ computing-unit-managing-service/
 COPY project/ project/
 COPY build.sbt build.sbt
+COPY .jvmopts .jvmopts
 
 # Update system and install dependencies
 RUN apt-get update && apt-get install -y \
@@ -52,7 +53,7 @@ RUN sbt clean ComputingUnitManagingService/dist
 # Unzip the texera binary
 RUN unzip computing-unit-managing-service/target/universal/computing-unit-managing-service-*.zip -d target/
 
-FROM eclipse-temurin:11-jre-jammy AS runtime
+FROM eclipse-temurin:17-jre-jammy AS runtime
 
 WORKDIR /texera
 
diff --git a/build.sbt b/build.sbt
index e36722313e3..d80a858c93b 100644
--- a/build.sbt
+++ b/build.sbt
@@ -19,6 +19,11 @@ ThisBuild / organization := "org.apache.texera"
 ThisBuild / version      := "1.1.0-incubating"
 ThisBuild / scalaVersion := "2.13.18"
 
+// Pull JDK 17+ JVM flags from .jvmopts so every JVM the build launches sees the same list.
+import com.typesafe.sbt.packager.universal.UniversalPlugin.autoImport.Universal
+ThisBuild / Test / javaOptions ++=
+  JdkOptions.jvmFlags((ThisBuild / baseDirectory).value)
+
 // sbt-jacoco emits only HTML by default; add XML so Codecov can consume
 // per-module jacoco.xml at target/scala-2.13/jacoco/report/jacoco.xml.
 // JacocoPlugin defines a project-scoped default that overrides ThisBuild,
@@ -30,13 +35,18 @@ lazy val coverageReportSettings = Seq(
     .withFormats(JacocoReportFormats.ScalaHTML, JacocoReportFormats.XML)
 )
 
+lazy val universalJvmFlagsSettings = Seq(
+  Universal / javaOptions ++=
+    JdkOptions.jvmFlags((ThisBuild / baseDirectory).value).map("-J" + _)
+)
+
 // Per-module ASF licensing: each jar's META-INF/LICENSE describes only what is in that jar.
 // Modules without vendored code get Apache 2.0 only; workflow-operator includes mbknor attribution.
 // See project/AddMetaInfLicenseFiles.scala.
 // Dist-producing modules additionally override Universal / mappings in their own
 // build.sbt (not here) — see AddMetaInfLicenseFiles.distMappings.
-lazy val asfLicensingSettings = AddMetaInfLicenseFiles.defaultSettings ++ coverageReportSettings
-lazy val asfLicensingSettingsWithVendored = AddMetaInfLicenseFiles.workflowOperatorSettings ++ coverageReportSettings
+lazy val asfLicensingSettings = AddMetaInfLicenseFiles.defaultSettings ++ coverageReportSettings ++ universalJvmFlagsSettings
+lazy val asfLicensingSettingsWithVendored = AddMetaInfLicenseFiles.workflowOperatorSettings ++ coverageReportSettings ++ universalJvmFlagsSettings
 
 val jacksonVersion = "2.18.6"
 
diff --git a/project/JdkOptions.scala b/project/JdkOptions.scala
new file mode 100644
index 00000000000..7275e6d350f
--- /dev/null
+++ b/project/JdkOptions.scala
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import sbt._
+
+import scala.io.Source
+
+/**
+ * This file reads JDK 17+ JVM flags from .jvmopts so every JVM the build
+ * launches shares one flag list.
+ *
+ * Modeled on Pekko's project/JdkOptions.scala. The JDK 8 gate is
+ * defensive: --add-opens does not exist before JDK 9, so jvmFlags
+ * stays empty there even though Texera ships JDK 17 only.
+ */
+object JdkOptions {
+
+  /** JVM flags from .jvmopts at the build root, or empty on JDK <9. */
+  def jvmFlags(baseDir: File): Seq[String] =
+    if (jdkSpecVersion < 9) Seq.empty
+    else readJvmopts(baseDir / ".jvmopts")
+
+  private def jdkSpecVersion: Int = {
+    val raw = sys.props.getOrElse("java.specification.version", "0")
+    val s = if (raw.startsWith("1.")) raw.drop(2) else raw
+    s.takeWhile(_.isDigit) match {
+      case ""    => 0
+      case digit => digit.toInt
+    }
+  }
+
+  private def readJvmopts(f: File): Seq[String] =
+    if (!f.exists()) Seq.empty
+    else {
+      val src = Source.fromFile(f)
+      try src.getLines()
+        .map(_.trim)
+        .filter(l => l.nonEmpty && !l.startsWith("#"))
+        .toList
+      finally src.close()
+    }
+}

From 37742cdd2283c0341f82d588b20bf0bc505a0f16 Mon Sep 17 00:00:00 2001
From: Matthew Ball <mgball@uci.edu>
Date: Sat, 9 May 2026 01:08:51 -0700
Subject: [PATCH 5/5] stop re-throwing in jsdom-svg-polyfill uncaughtException
 handler so vitest workers survive Zone-leaked errors

---
 frontend/src/jsdom-svg-polyfill.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/frontend/src/jsdom-svg-polyfill.ts b/frontend/src/jsdom-svg-polyfill.ts
index 4d296fac544..34bccf59ce2 100644
--- a/frontend/src/jsdom-svg-polyfill.ts
+++ b/frontend/src/jsdom-svg-polyfill.ts
@@ -191,8 +191,12 @@ function isBenignIconError(err: unknown): boolean {
   );
 }
 process.on("uncaughtException", err => {
-  if (!isBenignIconError(err)) throw err;
+  if (isBenignIconError(err)) return;
+  // Re-throwing inside `uncaughtException` aborts the Node process, which
+  // crashes the Vitest worker mid-run and leaves the runner hanging.
+  console.error(err);
 });
 process.on("unhandledRejection", reason => {
-  if (!isBenignIconError(reason)) throw reason;
+  if (isBenignIconError(reason)) return;
+  console.error(reason);
 });