diff --git a/Changes.md b/Changes.md
index cf9be2e84374..9c090b281cef 100644
--- a/Changes.md
+++ b/Changes.md
@@ -2,6 +2,43 @@
 
 ## H2O
 
+### 3.42.0.1 - 6/21/2023
+
+Download at: <a href='http://h2o-release.s3.amazonaws.com/h2o/rel-3.42.0/1/index.html'>http://h2o-release.s3.amazonaws.com/h2o/rel-3.42.0/1/index.html</a>
+
+#### Bug
+- [[PUBDEV-9097]](https://h2oai.atlassian.net/browse/PUBDEV-9097) - Fixed Infogram cross-validation with weights.
+- [[PUBDEV-9096]](https://h2oai.atlassian.net/browse/PUBDEV-9096) - Updated R package maintainer.
+- [[PUBDEV-9087]](https://h2oai.atlassian.net/browse/PUBDEV-9087) - Fixed leaks in GLM’s Negative Binomial estimation.
+
+#### Improvement
+- [[PUBDEV-9085]](https://h2oai.atlassian.net/browse/PUBDEV-9085) - Changed `warning` tag to `info` tag when weights are not provided during validation/test dataset scoring when weights are present in training. 
+- [[PUBDEV-9081]](https://h2oai.atlassian.net/browse/PUBDEV-9081) - Removed support for Python 2.7 and 3.5.
+- [[PUBDEV-8985]](https://h2oai.atlassian.net/browse/PUBDEV-8985) - Upgraded the default parquet library to 1.12.3 for standalone jar.
+- [[PUBDEV-8018]](https://h2oai.atlassian.net/browse/PUBDEV-8018) - Upgraded XGBoost to version 1.6.1.
+
+#### New Feature
+- [[PUBDEV-8947]](https://h2oai.atlassian.net/browse/PUBDEV-8947) - Implemented AIC metric for all GLM model families.
+- [[PUBDEV-8899]](https://h2oai.atlassian.net/browse/PUBDEV-8899) - Implemented Tweedie variance power maximum likelihood estimation for GLM.
+- [[PUBDEV-8793]](https://h2oai.atlassian.net/browse/PUBDEV-8793) - Added ability to convert H2OAssembly to a MOJO2 artifact.
+- [[PUBDEV-8691]](https://h2oai.atlassian.net/browse/PUBDEV-8691) - Implemented new Decision Tree algorithm.
+
+#### Docs
+- [[issue-15474]](https://github.com/h2oai/h2o-3/issues/15474) - Added link to AutoML Wave app from AutoML user guide.
+- [[PUBDEV-9106]](https://h2oai.atlassian.net/browse/PUBDEV-9106) - Added documentation on H2OAssembly to MOJO 2 export functionality.
+- [[PUBDEV-9104]](https://h2oai.atlassian.net/browse/PUBDEV-9104) - Added algorithm page in user guide for new Decision Tree algorithm.
+- [[PUBDEV-9090]](https://h2oai.atlassian.net/browse/PUBDEV-9090) - Added AIC metric support for all GLM families to GLM user guide page and GLM booklet.
+- [[PUBDEV-9088]](https://h2oai.atlassian.net/browse/PUBDEV-9088) - Updated authors and editors for GLM booklet.
+- [[PUBDEV-8894]](https://h2oai.atlassian.net/browse/PUBDEV-8894) - Added documentation on Tweedie variance power maximum likelihood estimation to GLM booklet and user guide.
+- [[PUBDEV-8461]](https://h2oai.atlassian.net/browse/PUBDEV-8461) - Improved user guide documentation for Generalized Additive Models algorithm.
+
+#### Security
+- [[PUBDEV-9112]](https://h2oai.atlassian.net/browse/PUBDEV-9112) - Addressed CVE-2023-2976 in h2o-steam.jar.
+- [[PUBDEV-9105]](https://h2oai.atlassian.net/browse/PUBDEV-9105) - Addressed CVE-2020-29582 in h2o-steam.jar.
+- [[PUBDEV-9103]](https://h2oai.atlassian.net/browse/PUBDEV-9103) - Addressed CVE-2023-26048 and CVE-2023-26049 by upgrading Jetty for minimal and steam jar.
+- [[PUBDEV-9100]](https://h2oai.atlassian.net/browse/PUBDEV-9100) - Addressed PRISMA-2023-0067 in h2o-steam.jar.
+- [[PUBDEV-9080]](https://h2oai.atlassian.net/browse/PUBDEV-9080) - Addressed CVE-2023-1436, CVE-2022-45693, CVE-2022-45685, and CVE-2022-40150 by upgrading org.codehaus.jettison:jettison in h2o-steam.jar.
+
 ### Kurka (3.40.0.4) - 4/28/2023
 
 Download at: <a href='http://h2o-release.s3.amazonaws.com/h2o/rel-zz_kurka/4/index.html'>http://h2o-release.s3.amazonaws.com/h2o/rel-zz_kurka/4/index.html</a>
diff --git a/h2o-assemblies/main/build.gradle b/h2o-assemblies/main/build.gradle
index 8a4bae76c045..611f10dedd30 100644
--- a/h2o-assemblies/main/build.gradle
+++ b/h2o-assemblies/main/build.gradle
@@ -27,7 +27,8 @@ dependencies {
         api('com.fasterxml.jackson.core:jackson-databind:2.13.4.2') {
             because 'Fixes CVE-2022-42003'
         }
-        api('com.google.guava:guava:31.1-jre') {
+        api('com.google.guava:guava:32.0.1-jre') {
+            because 'Fixes CVE-2023-2976'
             because 'Fixes CVE-2020-8908'
             because 'Fixes CVE-2018-10237'
         }
diff --git a/h2o-assemblies/minimal/build.gradle b/h2o-assemblies/minimal/build.gradle
index 10bb6567cdcf..2a0fe0b54359 100644
--- a/h2o-assemblies/minimal/build.gradle
+++ b/h2o-assemblies/minimal/build.gradle
@@ -23,7 +23,8 @@ dependencies {
     api project(":h2o-persist-http")
 
     constraints {
-        api('com.google.guava:guava:31.1-jre') {
+        api('com.google.guava:guava:32.0.1-jre') {
+            because 'Fixes CVE-2023-2976'
             because 'Fixes CVE-2020-8908'
             because 'Fixes CVE-2018-10237'
         }
diff --git a/h2o-assemblies/steam/build.gradle b/h2o-assemblies/steam/build.gradle
index ff659360b260..7de32060f6f4 100644
--- a/h2o-assemblies/steam/build.gradle
+++ b/h2o-assemblies/steam/build.gradle
@@ -76,7 +76,8 @@ dependencies {
         api('org.jetbrains.kotlin:kotlin-stdlib:1.4.32') {
             because 'Fixes CVE-2020-29582'
         }
-        api('com.google.guava:guava:31.1-jre') {
+        api('com.google.guava:guava:32.0.1-jre') {
+            because 'Fixes CVE-2023-2976'
             because 'Fixes CVE-2020-8908'
             because 'Fixes CVE-2018-10237'
         }
diff --git a/h2o-core/src/main/java/water/parser/ARFFParser.java b/h2o-core/src/main/java/water/parser/ARFFParser.java
index a21b3a8609dc..680b4db3d991 100644
--- a/h2o-core/src/main/java/water/parser/ARFFParser.java
+++ b/h2o-core/src/main/java/water/parser/ARFFParser.java
@@ -108,7 +108,7 @@ static ParseSetup guessSetup(ByteVec bv, byte[] bits, byte sep, boolean singleQu
         }
         data[0] = determineTokens(datalines[0], sep, singleQuotes, escapechar);
         ncols = (ncols > 0) ? ncols : data[0].length;
-        labels = null;
+        labels = labels[0] == null ? null : labels;
       } else {                    // 2 or more lines
         if (sep == GUESS_SEP) {   // first guess the separator
           //FIXME if last line is incomplete, this logic fails
diff --git a/h2o-py/tests/testdir_parser/pyunit_parse_single_entry_arff.py b/h2o-py/tests/testdir_parser/pyunit_parse_single_entry_arff.py
new file mode 100644
index 000000000000..125c6c104a14
--- /dev/null
+++ b/h2o-py/tests/testdir_parser/pyunit_parse_single_entry_arff.py
@@ -0,0 +1,33 @@
+import os
+import sys
+import tempfile
+
+sys.path.insert(1, "../../")
+import h2o
+from tests import pyunit_utils
+
+
+def test_single_entry_arff_file():
+    with open(pyunit_utils.locate("smalldata/junit/arff/iris.arff"), "r") as input_:
+        arff = input_.readlines()
+    data_start = arff.index("@DATA\n")
+    subsample = arff[:data_start + 2]
+    print(subsample[-3:])
+    _fd, tmp = tempfile.mkstemp(".arff")
+    try:
+        with open(tmp, "w") as output:
+            output.write(''.join(subsample))
+
+        train = h2o.import_file(pyunit_utils.locate("smalldata/junit/arff/iris.arff"))
+        test = h2o.import_file(tmp)
+
+        print(f"{train.columns} == {test.columns}: {train.columns == test.columns}")
+        assert train.columns == test.columns
+    finally:
+        os.unlink(tmp)
+
+
+if __name__ == "__main__":
+    pyunit_utils.standalone_test(test_single_entry_arff_file)
+else:
+    test_single_entry_arff_file()