Honor Auth_Scope for OAuth M2M client credentials - #1707

## Description

Syncs `jdk-8` with `main` at `a64ae0e0` (**3.4.3**) and applies the JDK
8 changes from `.claude/commands/sync-jdk8-branch.md`. I followed the
updated version of that skill from `main` (#1298), which this merge also
brings into `jdk-8`. Replaces #1717.

- **Scope:** 173 commits from `main` since the last sync point,
`3ef86030` (#1270, synced via #1275). That covers releases 3.3.1, 3.3.2,
3.3.3, 3.4.2 and 3.4.3.
- **Merge base:** #1275 was squash-merged, so git's merge base for
`jdk-8`/`main` is still #1150 (`23a0bbdc`). A plain `git merge
origin/main` would re-conflict changes that were already synced. I
merged with `3ef86030` as the base (using a temporary graft), so only
changes since the last sync were merged. This is a real merge commit:
its parents are the `jdk-8` tip and the `main` tip.

### JDK 8 changes

**Root `pom.xml`**
- Source/target stay at `1.8`. The JDK 8 pins stay: Arrow `13.0.0`,
Mockito `4.11.0`, nimbus-jose-jwt `9.47`.
- Spotless stays removed entirely. Main's spotless plugin block was not
merged.
- OWASP `dependency-check-maven` is removed (plugin, `pluginManagement`
entry and version property). Version 12.x needs Java 11, so it breaks
`mvn install` on JDK 8. On `main`, OSV replaced OWASP as the security
gate (#1460).
- Kept from `main`: the dependency bumps, the CycloneDX aggregate-SBOM
plugin (works on JDK 8), and the `dependencyManagement` CVE overrides
for commons-lang3 and gson.

**`jdbc-core/pom.xml`**
- No WireMock dependency and no `--add-opens`.
- The `jdk17-NioNotOpen` and `jdk21-NioNotOpen` profiles, the
Arrow-patch JaCoCo exclusions, and the
`!Jvm17PlusAndArrowToNioReflectionDisabled` group filter are removed.
- Surefire excludes the fakeservice and e2e tests.

**Workflows**
- `coverageReport.yml`: JDK 8, 80% threshold, and `mvn -pl jdbc-core
clean test -Dspotless.skip=true jacoco:report`.
- All other workflows match `main`. That fixes a duplicated "Compile"
step the merge produced in `prCheckJDK8.yml`.

**Java 9+ APIs in code added on `main` since the last sync**
- `List.of`, `Set.of`, `Map.of` and `List.copyOf` became Guava
`ImmutableList`/`ImmutableSet`/`ImmutableMap` in main code, and
`Arrays.asList` or `Collections.empty*` in tests.
- `String.isBlank()`/`strip()` became `trim().isEmpty()`/`trim()`.
- `Objects.requireNonNullElse` became a null-check ternary.
- `Optional.isEmpty()` became `!isPresent()`.
- `Files.writeString` became `Files.write`.
- An anonymous-class diamond became an explicit type.
- JDBC 4.3: removed `supportsSharding()` again and dropped the
`beginRequest`/`endRequest` test asserts.
- Conflicts were resolved keeping the existing `jdk-8` rewrites and
applying main's logic changes on top.

**Removed**
- The fakeservice and e2e tests, plus `IntegrationTestUtil` and
`DatabricksDriverExamples` (which uses it).
- All WireMock resources. That includes `sqlexecapi`, `thriftserverapi`
and `cloudfetchapi`, plus leftover `sqlgatewayapi`,
`cloudfetchsqlgatewayapi`, `cloudfetchthriftserverapi`,
`jwttokenendpoint`, `__files` and the `*fakeservicetest.properties`
files. Only the removed fakeservice tests used them.
- The Arrow patch sources (#1243), their tests, and
`src/test/resources/arrow`.

### Cleanup beyond the skill

I removed 23 Java sources that exist only on `jdk-8`: they were never on
`main`, or were deleted from it long ago. They came back in the 2025-09
"post merge" commit `de3efe43`. Nothing references them:
- `api/IDatabricksConnectionContext` and `api/IDatabricksSession`, stale
duplicates of the `api.internal` interfaces
- `ChunkDownloadCallback`
- `VolumeOperationProcessorDirect`
- `OAuthEndpointResolver`
- `ErrorCodes`, `ErrorTypes`
- `DeviceInfoLogUtil`
- 15 old Thrift-generated classes (`TDBSql*`, `TExpressionInfo`,
`TSQLVariable`, etc.)

Non-code leftovers (`release-notes/v1.0.x`, `.vscode/settings.json`,
`runBenchmarks.yml`) are unchanged.

## Testing

All runs were local on OpenJDK 1.8.0:
- `mvn clean install -DskipTests -Dspotless.skip=true` (the
`prCheckJDK8` "Compile" step): BUILD SUCCESS for all 6 modules.
- `mvn -pl jdbc-core test -Dspotless.skip=true` (the `prCheckJDK8`
unit-test step): 3,569 tests, 0 failures, 0 errors, 0 skipped.
- The built core, thin and uber jars are all Java 8 bytecode (class-file
major version 52; `javap` on `com.databricks.client.jdbc.Driver` reports
52).
- Dependency audit: none of the 85 jars on jdbc-core's test classpath
contains classes newer than Java 8 (multi-release `META-INF/versions`
entries excluded).
- `TestThinPackaging`/`TestUberPackaging`: the offline packaging checks
pass. `executeLargeQuery` needs live workspace credentials, so it wasn't
run.

## Telemetry Errors
- [x] Not applicable — this PR does not add or change a
telemetry-visible error. It only syncs changes already reviewed on
`main`.
- [ ] Applicable — the error uses `DatabricksDriverErrorCode` where
appropriate, and any
      new code is uniquely numbered and tested.
- [ ] Applicable — its driver/server/user classification is linked, or
maintainer help is
      requested because the author cannot access the classification.

## Additional Notes to the Reviewer

- The reviewable part is the JDK 8 delta against `main` (`git diff
origin/main...` on this branch): the poms, `coverageReport.yml`, and the
Java 8 rewrites listed above. Everything else is `main`'s code as
already reviewed.
- Spotless doesn't run on `jdk-8`. I formatted the lines I touched with
google-java-format 1.18.1, the version `main` uses.

<details><summary>Synced commits (173)</summary>

- Honor Auth_Scope for OAuth M2M client credentials (#1707)
- chore(security): remediate OSV findings (#1716)
- Fix SEA UserAgentEntry attribution in Query History (#1709)
- Fix M2M private-key integration test session stub (#1703)
- Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4
(#1656)
- Run Jira automation on protected runner (#1696)
- Automate Jira tickets for new GitHub issues (#1694)
- chore(security): remediate OSV findings (#1690)
- Bump JDBC driver version to 3.4.3 (#1689)
- Add session version exchange to SQL Exec API client (#1678)
- Auto-recover Reyden Thrift rejection to SEA (KP001) (#1683)
- fix(metadata): order getTypeInfo rows by DATA_TYPE (#1680)
- Update Apache Thrift to 0.24.0 (#1682)
- Fix logging when an OFF connection initializes first (#1670)
- Enable native SEA metadata defaults behind server flag (#1672)
- Fix NPE on materialising nested arrays or arrays of maps with `NULL`
elements. (#1659)
- Add Thrift-native metadata support (#1641)
- Fix blocking security scan findings on main (#1663)
- Fix NPE for incomplete JDBC URLs (#1646)
- [2/7] Add native batching configuration and parameter model (#1621)
- Fix duplicate JDBC connection parameters (#1652)
- Add telemetry error classification guardrails (#1629)
- [1/7] Isolate legacy prepared statement batch execution (#1620)
- ci: wire merge_group triggers into required-check workflows (#1582)
- feat(learning): add daily engineer-bot retrospective flow + bump
engine to 654a31d0 (#1635)
- Add Thrift V10 batch parameter wire model (#1602)
- Update 3.4.1 metadata release notes (#1578)
- ci: warm test deps for Engineer Bot's offline agent + bump timeout
(#1588)
- Improve SEA connection-failure error messages (#1587)
- Fix invalid AuthMech crashing with Recursive update /
StackOverflowError (#1586)
- Throw SQLException for out-of-range column in Arrow getObject (#1557)
- Use SHOW COLUMNS IN ALL CATALOGS for getColumns with null catalog
(same-repo, integration-test verification) (#1580)
- Fix PreparedStatement.getMetaData() returning null for CTE (WITH ...)
queries [PECOBLR-3778] (#1581)
- feat(bots): onboard reviewer + engineer bots to databricks-bot-engine
(#1583)
- ci: dispatch coverage-fanout on merged source PRs (#1575)
- Fix NPE reading STRING COLLATE columns via Arrow (#1548)
- Throw SQLException for wrong complex-type getter calls (#1561)
- [test] Make nested timestamp assertions timezone-safe (#1565)
- [connection] Guarantee resource cleanup during close (#1564)
- Harden OSV security-scan gate (fail-closed) + drop SMTP email (#1563)
- Fix IdleConnectionEvictor thread leak when connection.close() fails
due to expired token (#1559)
- Bump to version 3.4.2 (#1551)
- Align Thrift statement-error vendor code with SEA
(EXECUTE_STATEMENT_FAILED) (#1549)
- Fix MAP with complex value type rendering as empty via Arrow (#1505)
(#1546)
- Stream CloudFetch chunk decompression to bound memory and prevent OOM
on large results (#1509)
- Add bounded SEA API support for CloudFetch (UseBoundedSeaApi) (#1468)
- Preserve TIMESTAMP_NTZ type name in ResultSetMetaData (#1495) (#1519)
- Bump anthropics/claude-code-action from 1.0.79 to 1.0.166 (#1538)
- Bump actions/setup-java from 4.8.0 to 5.4.0 (#1542)
- Bump peter-evans/create-pull-request from 7.0.11 to 8.1.1 (#1541)
- Bump actions/cache/save from 4.3.0 to 6.1.0 (#1540)
- Bump dawidd6/action-send-mail from 3.12.0 to 18 (#1539)
- Fix JulLogger CPU burn from unconditional stack-trace walk (#1511)
(#1515)
- Fix telemetry misattribution across connections on the same thread
(#1531)
- Accept OAuth M2M client id/secret via JDBC user/password (#1132)
(#1533)
- Bump actions/checkout from 4.3.1 to 7.0.0 (#1484)
- Bump dawidd6/action-send-mail from 3.11.0 to 3.12.0 (#1486)
- Bump actions/github-script from 7.0.1 to 9.0.0 (#1488)
- Bump softprops/action-gh-release from 1 to 3 (#1487)
- Bump actions/stale from 8.0.0 to 10.3.0 (#1479)
- Add release notes for v3.4.1 (#1522)
- Harden OAuth U2M token cache encryption and file permissions (#1520)
- Make Connection.setReadOnly a no-op instead of throwing (#1523)
- Bump shaded jackson 2.18.7 to 2.18.8 to fix CVE-2026-54512 and
CVE-2026-54513 in uber jar (#1507)
- Use offline cache for Security Scan on fork PRs (#1514)
- Fix Maven cache warmer to cache surefire-junit-platform provider
(#1513)
- Redact credentials in DatabaseMetaData.getURL() and parse errors
(#1502)
- Redact Azure and GCS presigned URL credentials in logs (#1501)
- Redact access token before logging in setClientInfoProperty (#1498)
- Bump Databricks SDK for Java from 0.106.0 to 0.118.0 (#1500)
- Fix getColumns() flooding DriverManager log writer with stack traces
(#1494)
- Fix timezone-shifted TIMESTAMP in nested complex types (ES-1978662)
(#1492)
- Fix closeOnCompletion() infinite recursion on ResultSet/Statement
close (ES-1978361) (#1493)
- Harden binary parameter interpolation against SQL injection (#1497)
- Fix supportsBatchUpdates() to honor EnableBatchedInserts (#1496)
- Surface truncated flag from SEA result manifest (#1503)
- Use async wait timeout for SEA when direct results disabled (fix
hybrid-path truncation) (#1476)
- Fix metadata identifiers containing backticks (#1474)
- Fix chunk download failures mis-bucketed as CONNECTION_ERROR in
telemetry (#1469)
- Fix double backtick wrapping in setCatalog and setSchema (#1454)
- v3.4.1 Bump (#1467)
- Bump databricks-sdk-java from 0.69.0 to 0.106.0 (#1465)
- Add debug logging for connector-service feature flags request and
response (#1462)
- [PECOBLR-2321] Result Set Heartbeat / Keep-Alive for Ongoing Query
Executions (#1415)
- Unify weekly + per-PR security scanning into a single workflow (#1460)
- Fix PreparedStatement.getMetaData() crash for SQL type aliases (#1289)
- Bump shaded bouncycastle and libthrift to clear remaining CVE findings
(#1461)
- Fix telemetry HTTP client socket leak preventing CRaC checkpoint
(#1333)
- Deprecate EnableArrow — Arrow always enabled except on AIX/IBM Power
(#1450)
- Fix DML misclassification for statements containing
UNION/INTERSECT/EXCEPT (#1420)
- Fix client-side maxRows enforcement in ResultSet.next() (#1448)
- Bump shaded jackson, httpcore5-h2, netty, commons-configuration2, lz4
to address CVEs (#1456)
- Proactive server-side statement close when results consumed (#1444)
- Update NEXT_CHANGELOG with detailed breaking changes for 3.4.1 (#1449)
- Fix getTables(types=[]) returning rows in Thrift mode (#1451)
- Close server-side operation on Statement re-execution (#1422)
- Fix SQLInterpolator treating ? in comments and literals as
placeholders + shorten next_changelog (#1424)
- Enable native geospatial type support by default (#1446)
- Add MetadataOperationTimeout support for SHOW commands metadata path
(#1417)
- [ES-1884446] Classify transient/mis-categorized server errors with
retryable SQL states (#1430)
- Distinguish Arrow schema parsing failures from generic ResultSet
errors (#1443)
- Add server-side SAFE flag for UseQueryForMetadata rollout on DBSQL
(#1437)
- Decouple geospatial support from complex datatype flag (#1438)
- Update release-notes.txt for 3.3.3 and mark 3.3.2 as DEPRECATED
(#1441)
- Cut new release 3.3.3 (#1434)
- Fix unresolvable 3.3.2 Maven Central POM for uber jar (#1432)
- Fix main CI: JFrog mirror bypass and Windows pwsh parse error (#1428)
- Cut new release 3.3.2 (#1419)
- Enable release freeze for 3.3.2 (#1427)
- Fix cancel error handling: vendor code, telemetry level, SEA async
path (#1425)
- Improve error messages for transient HTTP failures during Thrift
polling (#1426)
- Fix SEA result expiry error handling — preserve server error message
(#1302)
- Fix ambiguous errors when statements are cancelled or connection
closed (#1291)
- Fix race condition between chunk release and download error handling
(#1407)
- Revert UseQueryForMetadata default to 0, make SHOW commands opt-in
(#1421)
- Force Thrift mode when metadata params require native RPCs (#1416)
- [PECOBLR-2086] MST transaction tests — parameterized for SEA/Thrift
(#1366)
- Change UseQueryForMetadata default to 1 (SHOW commands) (#1413)
- Fix statement close behavior for direct results in SEA (#1400)
- Add SPOG support for ?o= routing in httpPath (#1316)
- Fix batched insert regex to support backtick-quoted identifiers with
special characters (#1403)
- Fix getCrossReference case-insensitive parent matching (#1411)
- [PECOBLR-2318] Unify EnableDirectResults and
EnableSQLExecDirectResults params (#1409)
- Fix IntervalConverter crash on CloudFetch interval columns (#1397)
- [PECOBLR-1928] Add AI coding agent detection to User-Agent header
(#1230)
- [PECOBLR-2409] Add CallableStatement support with IN parameters
(#1371)
- Add VARIANT type to ColumnInfoTypeName for correct SEA metadata
(#1388)
- Fix GEOMETRY/GEOGRAPHY DATA_TYPE mapping in Thrift getColumns()
(#1387)
- SEA metadata: throw for invalid null/empty params (Thrift parity)
(#1390)
- Add vulnerability scan gate to release workflows (#1396)
- Fix cache warmer: add Windows runner, timestamp-based cache keys
(#1395)
- Fix cache warmer: add clean to resolve maven-clean-plugin and
exec-maven-plugin (#1394)
- Fix: normalize _remote.repositories repo ID for offline mode (#1393)
- Fix: non-fork cache path must be restore-only (#1392)
- Remove _remote.repositories from cache + use offline mode for forked
PRs (#1391)
- Fix fork Maven config: set updatePolicy=never to prevent 401 on cached
artifacts (#1389)
- Fix cache warmer: run real test to resolve surefire provider (#1385)
- Revert Windows git install, restore original Enable long paths step
(#1383)
- Fix cache warmer: use install only, drop dependency:resolve (#1382)
- Fix cache warmer: use install for inter-module SNAPSHOT resolution
(#1381)
- Fix cache warmer: Linux-only, OS-agnostic cache key (#1380)
- Bump version to 3.3.2-SNAPSHOT (#1292)
- Bump netty.version from 4.2.6.Final to 4.2.12.Final (#1347)
- Use Databricks protected runner group for CI actions (#1369)
- Resolve null catalog/schema in SEA key-based metadata operations
(#1370)
- Fix getSchemas returning JDBC-escaped catalog name in SEA mode (#1365)
- Fix IllegalFormatConversionException in JulLogger error logging with
Throwable (#1372)
- Simplify SEA disposition: use connection parameters instead of
statement type (#1322)
- Fix CI failures: replace gh API calls blocked by IP allow list (#1363)
- Fix SEA metadata JDBC spec compliance: catalog handling, empty types,
non-existent objects (#1308)
- Fix SEA volume operations failing with Statement is closed (#1323)
- Address open supply chain security action items (#1359)
- Disable publishing workflows per third-party package freeze (#1354)
- Migrate all CI workflows from Databricks runners to GitHub-hosted
runners (#1350)
- Pin all GitHub Actions to commit SHAs (#1324)
- Harden CI/CD supply chain security across all workflows (#1328)
- Migrate dco-check and vulnerabilityCatcher to Databricks runners
(#1327)
- Prevent script injection in coverageReport workflow (#1295)
- Improve instructions for jdk8 branch update (#1298)
- Use version property for jts-core dependency (#1297)
- Add OWASP suppression for CVE-2026-25087 and re-enable dependency
check in release (#1296)
- Add Claude GitHub Actions workflows (#1288)
- Move dependencyManagement to parent pom to fix CVE-2025-48924 in uber
jar (#1294)
- Fix backtick quoting for column names in batched INSERT reconstruction
(#1285)
- Fix primitive type parsing in complex types for Arrow-serialized
formats (#1250)
- Skip OWASP dependency check in release build step (#1286)
- Cut new release 3.3.1 (#1281)
- [PECOBLR-1746] Implementing support for listing procedures (#1238)
- Fix IdleConnectionEvictor thread leak in long-running services (#1271)
- [ES-1717770] Fix TIMEDOUT_STATE not recognized as error on interactive
clusters (#1244)
- [ES-1765150] Coalesce concurrent expired-link refreshes into single
batch RPC (#1277)
- [ES-1774740] Fix Thrift polling infinite loop on invalid operation
handle (#1273)
- Add /sync-jdk8-branch slash command + update the jdk8 action workflow
(#1274)

</details>

NO_CHANGELOG=true

This pull request and its description were written by Isaac.


[PECOBLR-3778]:
https://databricks.atlassian.net/browse/PECOBLR-3778?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

---------

Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: samikshya-chand_data <samikshya.chand@databricks.com>
Signed-off-by: Sreekanth Vadigi <sreekanth.vadigi@databricks.com>
Signed-off-by: Nikhil Suri <nikhil.suri@databricks.com>
Signed-off-by: Gopal Lal <gopal.lal@databricks.com>
Signed-off-by: rileythomp <rileythompson99@gmail.com>
Signed-off-by: Samikshya Chand <samikshya.chand@databricks.com>
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>
Signed-off-by: Oleksandr Shevchenko <oleksandr.shevchenko@datarobot.com>
Signed-off-by: Shivam Raj <shivam.raj@databricks.com>
Signed-off-by: Madhavendra Rathore
Signed-off-by: Dan Homola <dan.homola@hotmail.cz>
Signed-off-by: Matthieu Sprunck <msprunck@cisco.com>
Signed-off-by: Matthieu Sprunck <matthieu@sprunck.com>
Signed-off-by: Eric Wang <e.wang@databricks.com>
Signed-off-by: eric-wang-1990 <e.wang@databricks.com>
Signed-off-by: Prathamesh Baviskar <prathamesh.baviskar@databricks.com>
Signed-off-by: Cathleen Yan <cathleen.yan@databricks.com>
Signed-off-by: Vu Anh Phung <vu.phung@databricks.com>
Signed-off-by: Michael Simons <michael@simons.ac>
Signed-off-by: Cathleen Yan <58714163+cathleeny@users.noreply.github.com>
Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com>
Signed-off-by: Aakash Saravanan <aakash.saravanan@databricks.com>
Signed-off-by: peco-engineer-bot[bot] <287056288+peco-engineer-bot[bot]@users.noreply.github.com>
Co-authored-by: Gopal Lal <135012033+gopalldb@users.noreply.github.com>
Co-authored-by: Samikshya Chand <148681192+samikshya-db@users.noreply.github.com>
Co-authored-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>
Co-authored-by: Vikrant Puppala <vikrant.puppala@databricks.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: tejassp-db <241722411+tejassp-db@users.noreply.github.com>
Co-authored-by: jayant <167047871+jayantsing-db@users.noreply.github.com>
Co-authored-by: Sreekanth <sreekanth.vadigi@databricks.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Jothi Prakash <jothi.prakash@databricks.com>
Co-authored-by: Shivam Raj <171748731+shivam2680@users.noreply.github.com>
Co-authored-by: nikhilsuri-db <nikhil.suri@databricks.com>
Co-authored-by: Riley Thompson <rileythompson99@gmail.com>
Co-authored-by: Oleksandr Shevchenko <shevchenko.olexandr96@gmail.com>
Co-authored-by: Oleksandr Shevchenko <oleksandr.shevchenko@datarobot.com>
Co-authored-by: Madhav Sainanee <madhav.sainanee@databricks.com>
Co-authored-by: Dan Homola <dan.homola@hotmail.cz>
Co-authored-by: Thomas Powell <tom-s-powell@users.noreply.github.com>
Co-authored-by: Matthieu Sprunck <matthieu@sprunck.com>
Co-authored-by: eric-wang-1990 <115501094+eric-wang-1990@users.noreply.github.com>
Co-authored-by: Prathamesh Baviskar <prathamesh.baviskar@databricks.com>
Co-authored-by: vuanhphung <vuanhphung1997@gmail.com>
Co-authored-by: Michael Simons <michael@simons.ac>
Co-authored-by: vuanhphung <vu.phung@databricks.com>
Co-authored-by: Rahul Singhal <126218237+rahuls-db@users.noreply.github.com>
Co-authored-by: Isaac <no-reply@databricks.com>
Co-authored-by: aakash-saravanan-db <aakash.saravanan@databricks.com>
Co-authored-by: peco-engineer-bot[bot] <287056288+peco-engineer-bot[bot]@users.noreply.github.com>