[dependabot]

Bumps the production-minor-patch group with 4 updates: com.github.ben-manes.caffeine:jcache, com.github.ben-manes.caffeine:caffeine, com.auth0:java-jwt and io.grpc:grpc-bom.

Updates com.github.ben-manes.caffeine:jcache from 3.3.0 to 3.3.1

Release notes

Sourced from com.github.ben-manes.caffeine:jcache's releases.

3.3.1

• Added a workaround for ForkJoinPool queue corruption caused by resubmitting a reusable ForkJoinTask (#2021)
• Improved JCache read performance when using access expiration
• Fixed various minor issues found using AI audits

Commits

• aabb242 record the prefix-cache and warm-up findings
• 0117302 stop JCache access expiry from writing every hit
• 27fc6b8 skip rewriting an unchanged deadline on a read
• 7f87a7e restore coverage lost to recent fixes
• 75e2dc0 minor polish
• 5155a5a use nullRef() for null futures rejected by NullAway's generic inference (#2023)
• 998978c Avoid reusing a ForkJoinTask for maintenance (fixes #2021)
• 6999bfd add the Qwen Bailian prefix-cache traces
• 76dcbb5 fix canary test races and misc cleanups
• 7f46a43 pad the eviction sizes off the hit path's lines
• Additional commits viewable in compare view

Updates com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1

Release notes

Sourced from com.github.ben-manes.caffeine:caffeine's releases.

3.3.1

• Added a workaround for ForkJoinPool queue corruption caused by resubmitting a reusable ForkJoinTask (#2021)
• Improved JCache read performance when using access expiration
• Fixed various minor issues found using AI audits

Commits

• aabb242 record the prefix-cache and warm-up findings
• 0117302 stop JCache access expiry from writing every hit
• 27fc6b8 skip rewriting an unchanged deadline on a read
• 7f87a7e restore coverage lost to recent fixes
• 75e2dc0 minor polish
• 5155a5a use nullRef() for null futures rejected by NullAway's generic inference (#2023)
• 998978c Avoid reusing a ForkJoinTask for maintenance (fixes #2021)
• 6999bfd add the Qwen Bailian prefix-cache traces
• 76dcbb5 fix canary test races and misc cleanups
• 7f46a43 pad the eviction sizes off the hit path's lines
• Additional commits viewable in compare view

Updates com.auth0:java-jwt from 4.6.1 to 4.6.2

Release notes

Sourced from com.auth0:java-jwt's releases.

4.6.2

Added

• Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /lib #811 (dependabot[bot]

Fixed

• Security Fix: Uncaught DateTimeException in java-jwt PayloadDeserializer.getInstantFromSeconds() commit (tanya732)

Changelog

Sourced from com.auth0:java-jwt's changelog.

4.6.2 (2026-10-13)

Full Changelog

Added

• Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /lib #811 (dependabot[bot]) Fixed
• Security Fix: Uncaught DateTimeException in java-jwt PayloadDeserializer.getInstantFromSeconds() commit (tanya732)

Commits

• 1d589a4 Release 4.6.2 (#816)
• fb8229c Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /li...
• 33a2110 Merge commit from fork
• a35a650 Merge branch 'master' into fix/advisory-GHSA-cg7w-5cc2-f2xm
• 65c16bc force clear github orchestration cache
• 051174d refactor: extract epochSecond local in getInstantFromSeconds for clarity
• 16c2ebf fix: catch DateTimeException from Instant.ofEpochSecond in timestamp claim pa...
• See full diff in compare view

Updates io.grpc:grpc-bom from 1.84.2 to 1.85.0

Release notes

Sourced from io.grpc:grpc-bom's releases.

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

• netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
• binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

• xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
   

Bug Fixes

•  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
• core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
• core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

• netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
• bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

• api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

• Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
• netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

• stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

v1.84.3

Bug Fixes

• xDS: fix DistributorWatcher thread safety in CertificateProvider- #13087

Commits

• 73a9039 Bump version to 1.85.0
• 44ef493 Update README etc to reference 1.85.0
• 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
• 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
• c9ee3f8 bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994)
• fc56206 xds: fix ext_authz unit test issues creating import issues (#13061)
• 4865560 binder: deliver, even in the case where a prefix-only txn arrives last
• 126f42e binder: Add true unit tests for io.grpc.binder.internal.Inbound
• 4c8d26d binder: Fix OneWayBinderProxy to be a complete abstraction, removing getDeleg...
• 872b8c8 binder: Add Context-based hasPermissions to SecurityPolicies and deprecate th...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions