Bump the gradle-all group across 9 directories with 11 updates

[dependabot]

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/async-http-api directory:

Package	From	To
org.springframework.boot:spring-boot-dependencies	4.0.6	4.1.0
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle-all group with 6 updates in the /samples/durable-task-sdks/java/entities directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle-all group with 6 updates in the /samples/durable-task-sdks/java/eternal-orchestrations directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle-all group with 6 updates in the /samples/durable-task-sdks/java/fan-out-fan-in directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle-all group with 6 updates in the /samples/durable-task-sdks/java/function-chaining directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle-all group with 6 updates in the /samples/durable-task-sdks/java/human-interaction directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle-all group with 6 updates in the /samples/durable-task-sdks/java/monitoring directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle-all group with 9 updates in the /samples/durable-task-sdks/java/opentelemetry-tracing directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1
io.opentelemetry:opentelemetry-api	1.62.0	1.63.0
io.opentelemetry:opentelemetry-sdk	1.62.0	1.63.0
io.opentelemetry:opentelemetry-exporter-otlp	1.62.0	1.63.0

Bumps the gradle-all group with 6 updates in the /samples/durable-task-sdks/java/sub-orchestrations directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.34	1.5.37
io.grpc:grpc-protobuf	1.81.0	1.82.1
io.grpc:grpc-stub	1.81.0	1.82.1
io.grpc:grpc-netty-shaded	1.81.0	1.82.1
com.azure:azure-identity	1.18.3	1.18.4
gradle-wrapper	9.5.1	9.6.1

Updates org.springframework.boot:spring-boot-dependencies from 4.0.6 to 4.1.0

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.1.0

Full release notes for Spring Boot 4.1 are available on the wiki.

⭐ New Features

• Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause #50211
• Reduce memory consumption when repeatedly calling WritableJson.toByteArray #49428

🐞 Bug Fixes

• MailSender auto-configuration does not enable hostname verification #50747
• Artemis auto-configuration uses a predictable default location for the embedded broker's data #50745
• Embedded LDAP SSL should not be enabled when its bundle is empty #50700
• InetAddressFilter.externalAddresses does not exclude special purpose addresses from RFC 6890 #50668
• NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket #50645
• SSL should not be enabled when a SSL bundle is overridden to an empty string #50635
• Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver #50633
• Configuration property metadata includes incorrect class references #50632
• Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50618
• RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50612
• NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50610
• SpringJtaPlatform should have been deprecated since 4.1.0-M3 #50592
• Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50510
• ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50417
• Created StackTracePrinter instances have no access to the Environment #50414
• MappingsEndpoint reports the context's own ID as parentId when a parent exists #50412
• Buildpack module does not validate long-to-int casts #50410
• Gradle gRPC support fails if protobuf-java dependency is used instead of protobuf-java-util #50405
• GraphQL WebSocket support does not configure allowed origins #50394
• Spring Boot Loader Does Not Support RSA and EC Signed Jars #50298
• Meter registries are not removed from the global registry when the context is closed #50287
• DataSourceBuilder cannot derive a DataSource from a lazy connection proxy #50271
• Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation #50266
• Bean definitions can be added with an initializer before setAllowBeanDefinitionOverriding is called #50264
• EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50261
• Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50258
• ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50234
• NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50228
• Missing dependency management for spring-boot-web-server-test #50224
• Spring Batch support for MongoDB modules are not included in dependency management #50223
• Apply HTML escaping to timestamp attribute in Whitelabel error page #50216
• GrpcServerHealthScheduler is not started in servlet environments #50209
• Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat #50204

📔 Documentation

• Fix reference to Gradle documentation for module replacement #50647
• Document SSL reloading with Let's Encrypt #50630
• Remove the use of Optional from Data Neo4j repository examples #50622
• Fix typos in documentation #50620

... (truncated)

Commits

• ac2cfe0 Release v4.1.0
• 1a5815c Upgrade to Spring Batch 6.0.4
• a8364ff Merge branch '4.0.x'
• 9755ff2 Upgrade to Spring Batch 6.0.4
• 6a6dedc Upgrade to Spring Integration 7.1.0
• db7b2b9 Merge branch '4.0.x'
• d549d07 Upgrade to Spring Integration 7.0.5
• 4d9e463 Merge branch '3.5.x' into 4.0.x
• b068647 Upgrade to Spring Integration 6.5.9
• 198af99 Merge branch '4.0.x'
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.34 to 1.5.37

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.37

2026-06-26 Release of logback version 1.5.37

1. • Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the <condition> element introduced in version 1.5.20. See the relevant documentation for more details.

• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.36

2026-06-25 Release of logback version 1.5.36

• The 'condition' attribute in <if> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.35

026-06-23 Release of logback version 1.5.35

• The 'condition' attribute in <if> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.

• Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. ContextInitializer now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.

• ConsoleCharsetPropertyDefiner is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner will need an alternative approach for console charset detection.

• The logback-examples module is now included in artifacts published to Maven Central.

• JoranConfigurator.makeAnotherInstance() and DefaultJoranConfigurator.performMultiStepConfigurationFileSearch() are now protected, allowing derived configurators to override these methods.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• c1df7f5 prepare release 1.5.37
• a189967 remove conditional based on janino
• aaa9052 start work on 1.5.37-SNAPSHOT
• 9b94c37 prepare release 1.5.36
• e6a8280 prevent attacks using disallowed references
• 24c4b63 start work on 1.5.36-SNAPSHOT
• 08bd159 preapre release 1.5.35
• 37d256b indentation changes only
• d3d7307 minor comment
• fa0411a radomize file location
• Additional commits viewable in compare view

Updates io.grpc:grpc-protobuf from 1.81.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

v1.82.1

• protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0

v1.82.0

This release drops support for Bazel 7. It may still run, but we are no longer testing it. We are testing Bazel 8 and 9.

We are anticipating requiring Netty 4.2 in the next release. Please file an issue if you still need Netty 4.1 support.

Behavior Changes

• xds: Disable Priority LB child policy retention cache (#12806). Previously, when a priority became inactive, its associated child load balancer was kept in a deactivated state for potential reuse. Now, inactive child balancers are immediately torn down and removed.
• xds: skip DiscoveryRequest for unsubscribed types on stream ready (#12782). When the bootstrap declares more than one xDS server (e.g. a default server for LDS/CDS plus an authority-specific EDS-only server), grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server too. That server replies UNIMPLEMENTED, which tears down the stream and EDS data never arrives. This fix makes it skip DiscoveryRequests for resource types we don't actually subscribe to on a given server.

Improvements

• Remove JSR-305 @ThreadSafe annotation and replace with JavaDoc (#12762). Removes JSR-305 annotations but instead of replacing it with ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is done only in public non-final classes and interfaces. This allows Java applications that have moved away from javax to compile and avoids a bug in Immutables and Lombok (and possibly other annotation processors) from failing when JSR-305 is not present.
• core: Reduce per-stream idle memory on the server by 0.5 KB (b38df6c94). The main improvement here is not retaining the request Metadata for the life of the RPC. That means RPCs with larger request Metadata would see a larger benefit.
• core: Clarify missing content-type on HTTP error responses (#12720). Adjusts the diagnostic for the missing rather than invalid content-type, in the Status description.
• core: throw IOException when ProxySelector returns null or empty list (#12793). ProxySelector.select(URI) is required to return a non-null, non-empty list. Some implementations violate this, which previously caused an opaque crash in ProxyDetectorImpl. Now it detects this case explicitly and fails gracefully, naming the offending ProxySelector class to help with debugging.
• okhttp: enable TLS 1.3 by default for Android clients, retain TLS 1.2-only for desktop JVM (f43013161)
• xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is most noticeable when there are many endpoints returned by EDS, but the LB policy only uses a few of them, like pick_first.
• xds: pre-parse custom metric names in WRR load balancer (#12773) (324fce715). This reduces the per-RPC overhead of the gRFC A114 support added in v1.81.0
• xds: Propagate status cause through XdsDepManager (13b4b9727). This preserves more information for failures communicating with the control plane.
• binder: Give clear error when message is larger than parcel (d92ca44a1)

Bug Fixes

• xds: Trust Manager fix for certain scenarios where SAN validation shouldn't use the SNI sent (#12775) (bb153a83f).
• core: Cancel DelayedClientCall when application listener throws (#12761). Align DelayedClientCall.DelayedListener with ClientCallImpl's existing behavior for listener exceptions. When the application listener throws from onHeaders/onMessage/onReady, catch the Throwable, cancel the call with CANCELLED (cause = the throwable), and swallow subsequent callbacks. Previously, a throw from the application listener escaped to the callExecutor's uncaught-exception handler. The real call was not cancelled and the transport kept delivering callbacks to an already broken listener
• core,opentelemetry: Fix server metric labels on early close (#12774). Addresses the server-side OpenTelemetry metric labeling bug where a generated method can be recorded as grpc.method="other" if streamClosed() happens before serverCallStarted().
• core: Fix pick_first NPE with GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true when accepting resolved addresses and in CONNECTING state (#12814). It makes sure that whenever PickFirstLeafLoadBalancer transitions into CONNECTING the current address in the addressIndex has a corresponding subchannel. This prevents an NPE in acceptResolvedAddresses in some situations.
• okhttp: HPACK should fail on varint overflow (ec1099254). This should have no visible impact in normal use. It mostly just makes it easier to debug broken implementations
• xds: When using the file watcher certificate provider, reload cert/key even if only one of them changes (f4125c591)
• compiler: Avoid compile error on weird proto file names (f021befcd)

New Features

• googleapis: support ?force-xds query parameter in the google-c2p resolver (#12760) (86fa86063). This disables environment checks and uses xDS unconditionally. Please note that this feature has not yet seen comprehensive testing.

Dependencies

• Upgrade Netty to 4.1.133 (ada087b9d)
• bazel: Upgrade googleapis proto repo to commit 1dbb1a14 (ec0a9c976). This fixed a rules_go incompatibility issue with Bazel 9.1. But it also greatly reduced the overall transitive dependencies, as the C++ grpc repo is no longer a dependency
• bazel: Upgrade workflows to Bazel 8 (039ad7779) add Bazel 9.1.0 to our CI matrix (17be0d3d1)
• protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04 instead of 18.04 (8802dc35b5, da98b04b09)

Thanks to

@​becomeStar
@​bengtsson1-flir

... (truncated)

Commits

• 7b5e9ff Bump version to 1.82.1
• 20768f1 Update README etc to reference 1.82.1
• 5ab5eba kokoro: Remove extra / in architecture replacement
• 6726caf buildscripts: add regional td config for psm-interop (v1.82.x backport) (#12864)
• 022256f Bump version to 1.82.1-SNAPSHOT
• 78fb519 Bump version to 1.82.0
• b62b0fc Update README etc to reference 1.82.0
• 8802dc3 build: downgrade multiarch to Ubuntu 20.04 and consolidate images (#12830)
• be300bd kokoro: Avoid brew on Mac OS
• 4111f6f core: throw IOException when ProxySelector returns null or empty list (#12793)
• Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.81.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-stub's releases.

v1.82.1

• protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0

v1.82.0

This release drops support for Bazel 7. It may still run, but we are no longer testing it. We are testing Bazel 8 and 9.

We are anticipating requiring Netty 4.2 in the next release. Please file an issue if you still need Netty 4.1 support.

Behavior Changes

• xds: Disable Priority LB child policy retention cache (#12806). Previously, when a priority became inactive, its associated child load balancer was kept in a deactivated state for potential reuse. Now, inactive child balancers are immediately torn down and removed.
• xds: skip DiscoveryRequest for unsubscribed types on stream ready (#12782). When the bootstrap declares more than one xDS server (e.g. a default server for LDS/CDS plus an authority-specific EDS-only server), grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server too. That server replies UNIMPLEMENTED, which tears down the stream and EDS data never arrives. This fix makes it skip DiscoveryRequests for resource types we don't actually subscribe to on a given server.

Improvements

• Remove JSR-305 @ThreadSafe annotation and replace with JavaDoc (#12762). Removes JSR-305 annotations but instead of replacing it with ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is done only in public non-final classes and interfaces. This allows Java applications that have moved away from javax to compile and avoids a bug in Immutables and Lombok (and possibly other annotation processors) from failing when JSR-305 is not present.
• core: Reduce per-stream idle memory on the server by 0.5 KB (b38df6c94). The main improvement here is not retaining the request Metadata for the life of the RPC. That means RPCs with larger request Metadata would see a larger benefit.
• core: Clarify missing content-type on HTTP error responses (#12720). Adjusts the diagnostic for the missing rather than invalid content-type, in the Status description.
• core: throw IOException when ProxySelector returns null or empty list (#12793). ProxySelector.select(URI) is required to return a non-null, non-empty list. Some implementations violate this, which previously caused an opaque crash in ProxyDetectorImpl. Now it detects this case explicitly and fails gracefully, naming the offending ProxySelector class to help with debugging.
• okhttp: enable TLS 1.3 by default for Android clients, retain TLS 1.2-only for desktop JVM (f43013161)
• xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is most noticeable when there are many endpoints returned by EDS, but the LB policy only uses a few of them, like pick_first.
• xds: pre-parse custom metric names in WRR load balancer (#12773) (324fce715). This reduces the per-RPC overhead of the gRFC A114 support added in v1.81.0
• xds: Propagate status cause through XdsDepManager (13b4b9727). This preserves more information for failures communicating with the control plane.
• binder: Give clear error when message is larger than parcel (d92ca44a1)

Bug Fixes

• xds: Trust Manager fix for certain scenarios where SAN validation shouldn't use the SNI sent (#12775) (bb153a83f).
• core: Cancel DelayedClientCall when application listener throws (#12761). Align DelayedClientCall.DelayedListener with ClientCallImpl's existing behavior for listener exceptions. When the application listener throws from onHeaders/onMessage/onReady, catch the Throwable, cancel the call with CANCELLED (cause = the throwable), and swallow subsequent callbacks. Previously, a throw from the application listener escaped to the callExecutor's uncaught-exception handler. The real call was not cancelled and the transport kept delivering callbacks to an already broken listener
• core,opentelemetry: Fix server metric labels on early close (#12774). Addresses the server-side OpenTelemetry metric labeling bug where a generated method can be recorded as grpc.method="other" if streamClosed() happens before serverCallStarted().
• core: Fix pick_first NPE with GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true when accepting resolved addresses and in CONNECTING state (#12814). It makes sure that whenever PickFirstLeafLoadBalancer transitions into CONNECTING the current address in the addressIndex has a corresponding subchannel. This prevents an NPE in acceptResolvedAddresses in some situations.
• okhttp: HPACK should fail on varint overflow (ec1099254). This should have no visible impact in normal use. It mostly just makes it easier to debug broken implementations
• xds: When using the file watcher certificate provider, reload cert/key even if only one of them changes (f4125c591)
• compiler: Avoid compile error on weird proto file names (f021befcd)

New Features

• googleapis: support ?force-xds query parameter in the google-c2p resolver (#12760) (86fa86063). This disables environment checks and uses xDS unconditionally. Please note that this feature has not yet seen comprehensive testing.

Dependencies

• Upgrade Netty to 4.1.133 (ada087b9d)
• bazel: Upgrade googleapis proto repo to commit 1dbb1a14 (ec0a9c976). This fixed a rules_go incompatibility issue with Bazel 9.1. But it also greatly reduced the overall transitive dependencies, as the C++ grpc repo is no longer a dependency
• bazel: Upgrade workflows to Bazel 8 (039ad7779) add Bazel 9.1.0 to our CI matrix (17be0d3d1)
• protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04 instead of 18.04 (8802dc35b5, da98b04b09)

Thanks to

@​becomeStar
@​bengtsson1-flir

... (truncated)

Commits

• 7b5e9ff Bump version to 1.82.1
• 20768f1 Update README etc to reference 1.82.1
• 5ab5eba kokoro: Remove extra / in architecture replacement
• 6726caf buildscripts: add regional td config for psm-interop (v1.82.x backport) (#12864)
• 022256f Bump version to 1.82.1-SNAPSHOT
• 78fb519 Bump version to 1.82.0
• b62b0fc Update README etc to reference 1.82.0
• 8802dc3 build: downgrade multiarch to Ubuntu 20.04 and consolidate images (#12830)
• be300bd kokoro: Avoid brew on Mac OS
• 4111f6f core: throw IOException when ProxySelector returns null or empty list (#12793)
• Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.81.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.82.1

• protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0

v1.82.0

This release drops support for Bazel 7. It may still run, but we are no longer testing it. We are testing Bazel 8 and 9.

We are anticipating requiring Netty 4.2 in the next release. Please file an issue if you still need Netty 4.1 support.

Behavior Changes

• xds: Disable Priority LB child policy retention cache (#12806). Previously, when a priority became inactive, its associated child load balancer was kept in a deactivated state for potential reuse. Now, inactive child balancers are immediately torn down and removed.
• xds: skip DiscoveryRequest for unsubscribed types on stream ready (#12782). When the bootstrap declares more than one xDS server (e.g. a default server for LDS/CDS plus an authority-specific EDS-only server), grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server too. That server replies UNIMPLEMENTED, which tears down the stream and EDS data never arrives. This fix makes it skip DiscoveryRequests for resource types we don't actually subscribe to on a given server.

Improvements

• Remove JSR-305 @ThreadSafe annotation and replace with JavaDoc (#12762). Removes JSR-305 annotations but instead of replacing it with ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is done only in public non-final classes and interfaces. This allows Java applications that have moved away from javax to compile and avoids a bug in Immutables and Lombok (and possibly other annotation processors) from failing when JSR-305 is not present.
• core: Reduce per-stream idle memory on the server by 0.5 KB (b38df6c94). The main improvement here is not retaining the request Metadata for the life of the RPC. That means RPCs with larger request Metadata would see a larger benefit.
• core: Clarify missing content-type on HTTP error responses (#12720). Adjusts the diagnostic for the missing rather than invalid content-type, in the Status description.
• core: throw IOException when ProxySelector returns null or empty list (#12793). ProxySelector.select(URI) is required to return a non-null, non-empty list. Some implementations violate this, which previously caused an opaque crash in ProxyDetectorImpl. Now it detects this case explicitly and fails gracefully, naming the offending ProxySelector class to help with debugging.
• okhttp: enable TLS 1.3 by default for Android clients, retain TLS 1.2-only for desktop JVM (f43013161)
• xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is most noticeable when there are many endpoints returned by EDS, but the LB policy only uses a few of them, like pick_first.
• xds: pre-parse custom metric names in WRR load balancer (#12773) (324fce715). This reduces the per-RPC overhead of the gRFC A114 support added in v1.81.0
• xds: Propagate status cause through XdsDepManager (13b4b9727). This preserves more information for failures communicating with the control plane.
• binder: Give clear error when message is larger than parcel (d92ca44a1)

Bug Fixes

• xds: Trust Manager fix for certain scenarios where SAN validation shouldn't use the SNI sent (#12775) (bb153a83f).
• core: Cancel DelayedClientCall when application listener throws (#12761). Align DelayedClientCall.DelayedListener with ClientCallImpl's existing behavior for listener exceptions. When the application listener throws from onHeaders/onMessage/onReady, catch the Throwable, cancel the call with CANCELLED (cause = the throwable), and swallow subsequent callbacks. Previously, a throw from the application listener escaped to the callExecutor's uncaught-exception handler. The real call was not cancelled and the transport kept delivering callbacks to an already broken listener
• core,opentelemetry: Fix server metric labels on early close (#12774). Addresses the server-side OpenTelemetry metric labeling bug where a generated method can be recorded as grpc.method="other" if streamClosed() happens before serverCallStarted().
• core: Fix pick_first NPE with GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true when accepting resolved addresses and in CONNECTING state (#12814). It makes sure that whenever PickFirstLeafLoadBalancer transitions into CONNECTING the current address in the addressIndex has a corresponding subchannel. This prevents an NPE in acceptResolvedAddresses in some situations.
• okhttp: HPACK should fail on varint overflow (ec1099254). This should have no visible impact in normal use. It mostly just makes it easier to debug broken implementations
• xds: When using the file watcher certificate provider, reload cert/key even if only one of them changes (f4125c591)
• compiler: Avoid compile error on weird proto file names (f021befcd)

New Features

• googleapis: support ?force-xds query parameter in the google-c2p resolver (#12760) (86fa86063). This disables environment checks and uses xDS unconditionally. Please note that this feature has not yet seen comprehensive testing.

Dependencies

• Upgrade Netty to 4.1.133 (ada087b9d)
• bazel: Upgrade googleapis proto repo to commit 1dbb1a14 (ec0a9c976). This fixed a rules_go incompatibility issue with Bazel 9.1. But it also greatly reduced the overall transitive dependencies, as the C++ grpc repo is no longer a dependency
• bazel: Upgrade workflows to Bazel 8 (039ad7779) add Bazel 9.1.0 to our CI matrix (17be0d3d1)
• protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04 instead of 18.04 (8802dc35b5, da98b04b09)

Thanks to

@​becomeStar
@​bengtsson1-flir

... (truncated)

Commits

• 7b5e9ff Bump version to 1.82.1
• 20768f1 Update README etc to reference 1.82.1
• 5ab5eba kokoro: Remove extra / in architecture replacement
• 6726caf buildscripts: add regional td config for psm-interop (v1.82.x backport) (#12864)
• 022256f Bump version to 1.82.1-SNAPSHOT
• 78fb519 Bump version to 1.82.0
• b62b0fc Update README etc to reference 1.82.0
• 8802dc3 build: downgrade multiarch to Ubuntu 20.04 and consolidate images (#12830)
• be300bd kokoro: Avoid brew on Mac OS
• 4111f6f core: throw IOException when ProxySelector returns null or empty list (#12793)
• Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.81.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-stub's releases.

v1.82.1

• protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0

v1.82.0

This release drops support for Bazel 7. It may still run, but we are no longer testing it. We are testing Bazel 8 and 9.

We are anticipating requiring Netty 4.2 in the next release. Please file an issue if you still need Netty 4.1 support.

Behavior Changes

• xds: Disable Priority LB child policy retention cache (#12806). Previously, when a priority became inactive, its associated child load balancer was kept in a deactivated state for potential reuse. Now, inactive child balancers are immediately torn down and removed.
• xds: skip DiscoveryRequest for unsubscribed types on stream ready (#12782). When the bootstrap declares more than one xDS server (e.g. a default server for LDS/CDS plus an authority-specific EDS-only server), grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server too. That server replies UNIMPLEMENTED, which tears down the stream and EDS data never arrives. This fix makes it skip DiscoveryRequests for resource types we don't actually subscribe to on a given server.

Improvements

• Remove JSR-305 @ThreadSafe annotation and replace with JavaDoc (#12762). Removes JSR-305 annotations but instead of replacing it with ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is done only in public non-final classes and interfaces. This allows Java applications that have moved away from javax to compile and avoids a bug in Immutables and Lombok (and possibly other annotation processors) from failing when JSR-305 is not present.
• core: Reduce per-stream idle memory on the server by 0.5 KB (b38df6c94). The main improvement here is not retaining the request Metadata for the life of the RPC. That means RPCs with larger request Metadata would see a larger benefit.
• core: Clarify missing content-type on HTTP error responses (#12720). Adjusts the diagnostic for the missing rather than invalid content-type, in the Status description.
• core: throw IOException when ProxySelector returns null or empty list (#12793). ProxySelector.select(URI) is required to return a non-null, non-empty list. Some implementations violate this, which previously caused an opaque crash in ProxyDetectorImpl. Now it detects this case explicitly and fails gracefully, naming the offending ProxySelector class to help with debugging.
• okhttp: enable TLS 1.3 by default for Android clients, retain TLS 1.2-only for desktop JVM (f43013161)
• xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is most noticeable when there are many endpoints returned by EDS, but the LB policy only uses a few of them, like pick_first.
• xds: pre-parse custom metric names in WRR load balancer (#12773) (324fce715). This reduces the per-RPC overhead of the gRFC A114 support added in v1.81.0
• xds: Propagate status cause through XdsDepManager (13b4b9727). This preserves more information for failures communicating with the control plane.
• binder: Give clear error when message is larger than parcel (d92ca44a1)

Bug Fixes

• xds: Trust Manager fix for certain scenarios where SAN validation shouldn't use the SNI sent (#12775) (bb153a83f).
• core: Cancel DelayedClientCall when application listener throws (#12761). Align DelayedClientCall.DelayedListener with ClientCallImpl's existing behavior for listener exceptions. When the application listener throws from onHeaders/onMessage/onReady, catch the Throwable, cancel the call with CANCELLED (cause = the throwable), and swallow subsequent callbacks. Previously, a throw from the application listener escaped to the callExecutor's uncaught-exception handler. The real call was not cancelled and the transport kept delivering callbacks to an already broken listener
• core,opentelemetry: Fix server metric labels on early close (#12774). Addresses the server-side OpenTelemetry metric labeling bug where a generated method can be recorded as grpc.method="other" if streamClosed() happens before serverCallStarted().
• core: Fix pick_first NPE with GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true when accepting resolved addresses and in CONNECTING state (#12814). It makes sure that whenever PickFirstLeafLoadBalancer transitions into CONNECTING the current address in the addressIndex has a corresponding subchannel. This prevents an NPE in acceptResolvedAddresses in some situations.
• okhttp: HPACK should fail on varint overflow (ec1099254). This should have no visible impact in normal use. It mostly just makes it easier to debug broken implementations
• xds: When using the file watcher certificate provider, reload cert/key even if only one of them changes (f4125c591)
• compiler: Avoid compile error on weird proto file names (f021befcd)

New Features

• googleapis: support ?force-xds query parameter in the google-c2p resolver (#12760) (86fa86063). This disables environment checks and uses xDS unconditionally. Please note that this feature has not yet seen comprehensive testing.

Dependencies

• Upgrade Netty to 4.1.133 (ada087b9d)
• bazel: Upgrade googleapis proto repo to commit 1dbb1a14 (ec0a9c976). This fixed a rules_go incompatibility issue with Bazel 9.1. But it also greatly reduced the overall transitive dependencies, as the C++ grpc repo is no longer a dependency
• bazel: Upgrade workflows to Bazel 8 (039ad7779) add Bazel 9.1.0 to our CI matrix (17be0d3d1)
• protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04 instead of 18.04 (8802dc35b5, da98b04b09)

Thanks to

@​becomeStar
@​bengtsson1-flir

... (truncated)

Commits

• 7b5e9ff Bump version to 1.82.1
• 20768f1 Update README etc to reference 1.82.1
• 5ab5eba kokoro: Remove extra / in architecture replacement
• 6726caf buildscripts: add regional td config for psm-interop (v1.82.x backport) (#12864)
• 022256f Bump version to 1.82.1-SNAPSHOT
• 78fb519 Bump version to 1.82.0
• b62b0fc Update README etc to reference 1.82.0
• 8802dc3 build: downgrade multiarch to Ubuntu 20.04 and consolidate images (#12830)
• be300bd kokoro: Avoid brew on Mac OS
• 4111f6f core: throw IOException when ProxySelector returns null or empty list (#12793)
• Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.81.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.82.1

• protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0

v1.82.0

This release drops support for Bazel 7. It may still run, but we are no longer testing it. We are testing Bazel 8 and 9.

We are anticipating requiring Netty 4.2 in the next release. Please file an issue if you still need Netty 4.1 support.

Behavior Changes

• xds: Disable Priority LB child policy retention cache (#12806). Previously, when a priority became inactive, its associated child load balancer was kept in a deactivated state for potential reuse. Now, inactive child balancers are immediately torn down and removed.
• xds: skip DiscoveryRequest for unsubscribed types on stream ready (#12782). When the bootstrap declares more than one xDS server (e.g. a default server for LDS/CDS plus an authority-specific EDS-only server), grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server too. That server replies UNIMPLEMENTED, which tears down the stream and EDS data never arrives. This fix makes it skip DiscoveryRequests for resource types we don't actually subscribe to on a given server.

Improvements

• Remove JSR-305 @ThreadSafe annotation and replace with JavaDoc (#12762). Removes JSR-305 annotations but instead of replacing it with ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is done only in public non-final classes and interfaces. This allows Java applications that have moved away from javax to compile and avoids a bug in Immutables and Lombok (and possibly other annotation processors) from failing when JSR-305 is not present.
• core: Reduce per-stream idle memory on the server by 0.5 KB (b38df6c94). The main improvement here is not retaining the request Metadata for the life of the RPC. That means RPCs with larger request Metadata would see a larger benefit.
• core: Clarify missing content-type on HTTP error responses (#12720). Adjusts the diagnostic for the missing rather than invalid content-type, in the Status description.
• core: throw IOException when ProxySelector returns null or empty list (#12793). ProxySelector.select(URI) is required to return a non-null, non-empty list. Some implementations violate this, which previously caused an opaque crash in ProxyDetectorImpl. Now it detects this case explicitly and fails gracefully, naming the offending ProxySelector class to help with debugging.
• okhttp: enable TLS 1.3 by default for Android clients, retain TLS 1.2-only for desktop JVM (f43013161)
• xds: Reduce per-endpoint memory from CDS LB (cc0d1a810). This is most noticeable when there are many endpoints returned by EDS, but the LB policy only uses a few of them, like pick_first.
• xds: pre-parse custom metric names in WRR load balancer (#12773) (324fce715). This reduces the per-RPC overhead of the gRFC A114 support added in v1.81.0
• xds: Propagate status cause through XdsDepManager (13b4b9727). This preserves more information for failures communicating with the control plane.
• binder: Give clear error when message is larger than parcel (d92ca44a1)

Bug Fixes

• xds: Trust Manager fix for certain scenarios where SAN validation shouldn't use the SNI sent (#12775) (bb153a83f).
• core: Cancel DelayedClientCall when application listener throws (#12761). Align DelayedClientCall.DelayedListener with ClientCallImpl's existing behavior for listener exceptions. When the application listener throws from onHeaders/onMessage/onReady, catch the Throwable, cancel the call with CANCELLED (cause = the throwable), and swallow subsequent callbacks. Previously, a throw from the application listener escaped to the callExecutor's uncaught-exception handler. The real call was not cancelled and the transport kept delivering callbacks to an already broken listener
• core,opentelemetry: Fix server metric labels on early close (#12774). Addresses the server-side OpenTelemetry metric labeling bug where a generated method can be recorded as grpc.method="other" if streamClosed() happens before serverCallStarted().
• core: Fix pick_first NPE with GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true when accepting resolved addresses and in CONNECTING state (#12814). It makes sure that whenever PickFirstLeafLoadBalancer transitions into CONNECTING the current address in the addressIndex has a corresponding subchannel. This prevents an NPE in acceptResolvedAddresses in some situations.
• okhttp: HPACK should fail on varint overflow (ec1099254). This should have no visible impact in normal use. It mostly just makes it easier to debug broken implementations
• xds: When using the file watcher certificate provider, reload cert/key even if only one of them changes (f4125c591)
• compiler: Avoid compile error on weird proto file names (f021befcd)

New Features

• googleapis: support ?force-xds query parameter in the goog...

  Description has been truncated