Skip to content

chore(deps): Bump grpc-version from 1.83.1 to 1.84.0 - #26234

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/grpc-version-1.84.0
Open

chore(deps): Bump grpc-version from 1.83.1 to 1.84.0#26234
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/grpc-version-1.84.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps grpc-version from 1.83.1 to 1.84.0.
Updates io.grpc:grpc-all from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-all's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

  • xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
  • xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
  • api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

  • core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
    Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
    Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

  • core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
    Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
  • xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
  • xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
  • core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
  • rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
  • servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
  • okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
  • s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
  • binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
  • binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

  • compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
  • api: Bump Context to JDK 8 (5d0a012fa)
  • netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

  • api: Better explain the executors and how to configure them (ee08f5337)

New Features

  • core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits
  • b3838c0 Bump version to 1.84.0
  • eb21854 Update README etc to reference 1.84.0
  • 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
  • e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
  • cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
  • 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
  • 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
  • 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
  • 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
  • ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-alts from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-alts's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

  • xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
  • xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
  • api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

  • core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
    Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
    Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

  • core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
    Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
  • xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
  • xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
  • core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
  • rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
  • servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
  • okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
  • s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
  • binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
  • binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

  • compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
  • api: Bump Context to JDK 8 (5d0a012fa)
  • netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

  • api: Better explain the executors and how to configure them (ee08f5337)

New Features

  • core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits
  • b3838c0 Bump version to 1.84.0
  • eb21854 Update README etc to reference 1.84.0
  • 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
  • e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
  • cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
  • 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
  • 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
  • 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
  • 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
  • ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-api from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-api's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

  • xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
  • xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
  • api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

  • core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
    Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
    Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

  • core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
    Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
  • xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
  • xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
  • core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
  • rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
  • servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
  • okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
  • s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
  • binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
  • binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

  • compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
  • api: Bump Context to JDK 8 (5d0a012fa)
  • netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

  • api: Better explain the executors and how to configure them (ee08f5337)

New Features

  • core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits
  • b3838c0 Bump version to 1.84.0
  • eb21854 Update README etc to reference 1.84.0
  • 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
  • e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
  • cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
  • 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
  • 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
  • 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
  • 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
  • ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-auth from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-auth's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

  • xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
  • xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
  • api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

  • core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
    Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
    Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

  • core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
    Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
  • xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
  • xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
  • core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
  • rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
  • servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
  • okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
  • s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
  • binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
  • binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

  • compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
  • api: Bump Context to JDK 8 (5d0a012fa)
  • netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

  • api: Better explain the executors and how to configure them (ee08f5337)

New Features

  • core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits
  • b3838c0 Bump version to 1.84.0
  • eb21854 Update README etc to reference 1.84.0
  • 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
  • e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
  • cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
  • 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
  • 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
  • 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
  • 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
  • ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-benchmarks from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-benchmarks's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

  • xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
  • xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
  • api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

  • core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
    Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
    Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

  • core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
    Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
  • xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
  • xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
  • core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
  • rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
  • servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
  • okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
  • s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
  • binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
  • binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

  • compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
  • api: Bump Context to JDK 8 (5d0a012fa)
  • netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

  • api: Better explain the executors and how to configure them (ee08f5337)

New Features

  • core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits
  • b3838c0 Bump version to 1.84.0
  • eb21854 Update README etc to reference 1.84.0
  • 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
  • e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
  • cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
  • 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
  • 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
  • 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
  • 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
  • ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-census from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-census's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

  • xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
  • xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
  • api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

  • core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
    Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
    Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

  • core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
    Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
  • xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
  • xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
  • core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
  • rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
  • servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
  • okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
  • s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
  • binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
  • binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

  • compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
  • api: Bump Context to JDK 8 (5d0a012fa)
  • netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

  • api: Better explain the executors and how to configure them (ee08f5337)

New Features

  • core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits
  • b3838c0 Bump version to 1.84.0
  • eb21854 Update README etc to reference 1.84.0
  • 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
  • e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
  • cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
  • 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
  • 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
  • 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
  • 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
  • ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-context from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-context's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

  • xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
  • xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
  • api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

  • core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
    Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
    Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

  • core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
    Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
  • xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
  • xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
  • core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
  • rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
  • servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
  • okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
  • s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
  • binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
  • binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

  • compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
  • api: Bump Context to JDK 8 (5d0a012fa)
  • netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

  • api: Better explain the executors and how to configure them (ee08f5337)

New Features

  • core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits
  • b3838c0 Bump version to 1.84.0
  • eb21854 Update README etc to reference 1.84.0
  • 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
  • e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
  • cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
  • 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
  • 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
  • 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
  • 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
  • ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
  • Additional commits viewable i...

    Description has been truncated

Bumps `grpc-version` from 1.83.1 to 1.84.0.

Updates `io.grpc:grpc-all` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-alts` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-api` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-auth` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-benchmarks` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-census` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-context` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-core` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-gcp-csm-observability` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-gcp-observability` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-googleapis` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-grpclb` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-inprocess` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-interop-testing` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-netty` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-netty-shaded` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-okhttp` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-opentelemetry` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-protobuf` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-protobuf-lite` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-rls` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-services` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-servlet` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-servlet-jakarta` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-stub` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-testing` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-testing-proto` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-util` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:grpc-xds` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

Updates `io.grpc:protoc-gen-grpc-java` from 1.83.1 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.84.0)

---
updated-dependencies:
- dependency-name: io.grpc:grpc-all
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-alts
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-api
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-auth
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-benchmarks
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-census
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-context
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-core
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-gcp-csm-observability
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-gcp-observability
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-googleapis
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-grpclb
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-inprocess
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-interop-testing
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-netty
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-okhttp
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-opentelemetry
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-protobuf
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-protobuf-lite
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-rls
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-services
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-servlet
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-servlet-jakarta
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-stub
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-testing
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-testing-proto
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-util
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:grpc-xds
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.grpc:protoc-gen-grpc-java
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 9, 2026
@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

  • First-time contributors require MANUAL approval for the GitHub Actions to run
  • You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
  • You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
  • Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

🧪 CI tested the following changed modules:

  • parent

POM dependency changes: targeted tests included

Changed properties: grpc-version

Modules affected by dependency changes (5)
  • :camel-salesforce
  • :camel-tensorflow-serving
  • :camel-kserve
  • :camel-grpc
  • :camel-protobuf

🔬 Scalpel shadow comparison — Scalpel: 45 tested, 27 compile-only — current: 0 all tested

Maveniverse Scalpel detected 72 affected modules (current approach: 0).

⚠️ Modules only in Scalpel (72)
  • apache-camel
  • camel-allcomponents
  • camel-camunda
  • camel-catalog
  • camel-catalog-console
  • camel-catalog-maven
  • camel-catalog-suggest
  • camel-componentdsl
  • camel-dapr
  • camel-endpointdsl
  • camel-endpointdsl-support
  • camel-geocoder
  • camel-google-bigquery
  • camel-google-calendar
  • camel-google-common
  • camel-google-drive
  • camel-google-firestore
  • camel-google-functions
  • camel-google-mail
  • camel-google-pubsub
  • camel-google-secret-manager
  • camel-google-sheets
  • camel-google-speech-to-text
  • camel-google-storage
  • camel-google-text-to-speech
  • camel-google-vertexai
  • camel-google-vision
  • camel-grpc
  • camel-itest
  • camel-jbang-core
  • camel-jbang-it
  • camel-jbang-main
  • camel-jbang-mcp
  • camel-jbang-plugin-edit
  • camel-jbang-plugin-generate
  • camel-jbang-plugin-kubernetes
  • camel-jbang-plugin-mcp
  • camel-jbang-plugin-route-parser
  • camel-jbang-plugin-test
  • camel-jbang-plugin-tui
  • camel-jbang-plugin-validate
  • camel-jira
  • camel-kamelet-main
  • camel-kserve
  • camel-langchain4j-embeddings
  • camel-langchain4j-embeddingstore
  • camel-langchain4j-ingest
  • camel-langchain4j-web-search
  • camel-launcher
  • camel-launcher-container
  • camel-opentelemetry
  • camel-pinecone
  • camel-protobuf
  • camel-qdrant
  • camel-report-maven-plugin
  • camel-rocketmq
  • camel-route-parser
  • camel-salesforce
  • camel-salesforce-codegen
  • camel-salesforce-maven-plugin
  • camel-spiffe
  • camel-spring-ai-vector-store
  • camel-tensorflow-serving
  • camel-weaviate
  • camel-yaml-dsl
  • camel-yaml-dsl-deserializers
  • camel-yaml-dsl-maven-plugin
  • camel-yaml-dsl-validator
  • camel-yaml-dsl-validator-maven-plugin
  • coverage
  • docs
  • dummy-component

Changed properties: grpc-version

Changed managed dependencies: io.grpc:grpc-all, io.grpc:grpc-alts, io.grpc:grpc-api, io.grpc:grpc-auth, io.grpc:grpc-benchmarks, io.grpc:grpc-census, io.grpc:grpc-context, io.grpc:grpc-core, io.grpc:grpc-gcp-csm-observability, io.grpc:grpc-gcp-observability, io.grpc:grpc-googleapis, io.grpc:grpc-grpclb, io.grpc:grpc-inprocess, io.grpc:grpc-interop-testing, io.grpc:grpc-netty, io.grpc:grpc-netty-shaded, io.grpc:grpc-okhttp, io.grpc:grpc-opentelemetry, io.grpc:grpc-protobuf, io.grpc:grpc-protobuf-lite, io.grpc:grpc-rls, io.grpc:grpc-services, io.grpc:grpc-servlet, io.grpc:grpc-servlet-jakarta, io.grpc:grpc-stub, io.grpc:grpc-testing, io.grpc:grpc-testing-proto, io.grpc:grpc-util, io.grpc:grpc-xds, io.grpc:protoc-gen-grpc-java

Skip-tests mode would test 45 modules (7 direct + 12 downstream), skip tests for 27 (generated code, meta-modules)

Modules Scalpel would test (45)
  • camel-camunda
  • camel-dapr
  • camel-geocoder
  • camel-google-bigquery
  • camel-google-calendar
  • camel-google-common
  • camel-google-drive
  • camel-google-firestore
  • camel-google-functions
  • camel-google-mail
  • camel-google-pubsub
  • camel-google-secret-manager
  • camel-google-sheets
  • camel-google-speech-to-text
  • camel-google-storage
  • camel-google-text-to-speech
  • camel-google-vertexai
  • camel-google-vision
  • camel-grpc
  • camel-jbang-mcp
  • camel-jbang-plugin-mcp
  • camel-jbang-plugin-route-parser
  • camel-jbang-plugin-tui
  • camel-jbang-plugin-validate
  • camel-jira
  • camel-kserve
  • camel-langchain4j-embeddings
  • camel-langchain4j-embeddingstore
  • camel-langchain4j-ingest
  • camel-langchain4j-web-search
  • camel-launcher-container
  • camel-opentelemetry
  • camel-pinecone
  • camel-protobuf
  • camel-qdrant
  • camel-rocketmq
  • camel-salesforce
  • camel-salesforce-codegen
  • camel-salesforce-maven-plugin
  • camel-spiffe
  • camel-spring-ai-vector-store
  • camel-tensorflow-serving
  • camel-weaviate
  • camel-yaml-dsl-validator
  • camel-yaml-dsl-validator-maven-plugin
Modules with tests skipped (27)
  • apache-camel
  • camel-allcomponents
  • camel-catalog
  • camel-catalog-console
  • camel-catalog-maven
  • camel-catalog-suggest
  • camel-componentdsl
  • camel-endpointdsl
  • camel-endpointdsl-support
  • camel-itest
  • camel-jbang-core
  • camel-jbang-it
  • camel-jbang-main
  • camel-jbang-plugin-edit
  • camel-jbang-plugin-generate
  • camel-jbang-plugin-kubernetes
  • camel-jbang-plugin-test
  • camel-kamelet-main
  • camel-launcher
  • camel-report-maven-plugin
  • camel-route-parser
  • camel-yaml-dsl
  • camel-yaml-dsl-deserializers
  • camel-yaml-dsl-maven-plugin
  • coverage
  • docs
  • dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (73 modules, 8m 34s total)

Total reactor time: 8m 34s

Module Duration Status
Camel :: YAML DSL 53.6s SUCCESS
Camel :: Salesforce 35.5s SUCCESS
Camel :: AI :: TensorFlow Serving 32.2s SUCCESS
Camel :: JIRA 28.5s SUCCESS
Camel :: AI :: Weaviate 25.9s SUCCESS
Camel :: OpenTelemetry (deprecated) 24.1s SUCCESS
Camel :: AI :: Qdrant 22.3s SUCCESS
Camel :: AI :: LangChain4j :: EmbeddingStore 20.2s SUCCESS
Camel :: AI :: LangChain4j :: Ingest 17.2s SUCCESS
Camel :: JBang :: Plugin :: TUI 16.1s FAILURE
Camel :: Component DSL 14.1s SUCCESS
Camel :: Catalog :: Camel Catalog 13.0s SUCCESS
Camel :: JBang :: Plugin :: Kubernetes 11.8s SUCCESS
Camel :: Docs 11.0s SUCCESS
Camel :: AI :: Pinecone 9.6s SUCCESS
Camel :: gRPC 9.5s SUCCESS
Camel :: Google :: Sheets 8.9s SUCCESS
Camel :: Google :: BigQuery 8.2s SUCCESS
Camel :: Spring AI :: Vector Store 8.1s SUCCESS
Camel :: Google :: Storage 7.1s SUCCESS
Camel :: Protobuf 6.9s SUCCESS
Camel :: Google :: Drive 6.7s SUCCESS
Camel :: Google :: Mail 6.4s SUCCESS
Camel :: JBang :: Plugin :: Testing 6.3s SUCCESS
Camel :: Kamelet Main 5.7s SUCCESS
Camel :: AI :: KServe 5.7s SUCCESS
Camel :: Geocoder 5.7s SUCCESS
Camel :: Catalog :: Camel Report Maven Plugin 5.7s SUCCESS
Camel :: Dapr 5.6s SUCCESS
Camel :: Salesforce :: Maven Plugin 5.4s SUCCESS
Camel :: Google :: Functions 5.2s SUCCESS
Camel :: Google :: Firestore 4.8s SUCCESS
Camel :: Catalog :: Camel Route Parser 4.7s SUCCESS
Camel :: Google :: Calendar 4.4s SUCCESS
Camel :: Google :: Secret Manager 4.2s SUCCESS
Camel :: RocketMQ 4.0s SUCCESS
Camel :: Google :: Speech To Text 4.0s SUCCESS
Camel :: SPIFFE 4.0s SUCCESS
Camel :: Google :: Vertex AI 3.9s SUCCESS
Camel :: YAML DSL :: Deserializers 3.7s SUCCESS
Camel :: Google :: Common 3.3s SUCCESS
Camel :: All Components Sync point 3.2s SUCCESS
Camel :: Camunda 3.2s SUCCESS
Camel :: AI :: LangChain4j :: Web Search 2.8s SUCCESS
Camel :: YAML DSL :: Validator 2.6s SUCCESS
Camel :: Google :: Text To Speech 2.3s SUCCESS
Camel :: YAML DSL :: Validator Maven Plugin 2.3s SUCCESS
Camel :: Google :: Vision 2.2s SUCCESS
Camel :: Catalog :: Maven 2.2s SUCCESS
Camel :: Assembly 2.0s SUCCESS
Camel :: Catalog :: Suggest 1.9s SUCCESS
Camel :: YAML DSL :: Maven Plugins 1.2s SUCCESS
Camel :: Salesforce :: CodeGen 1.1s SUCCESS
Camel :: Parent 1.0s SUCCESS
Camel :: Endpoint DSL :: Support 1.0s SUCCESS
Camel :: JBang :: Plugin :: Validate 0.6s SUCCESS
Camel :: JBang :: Plugin :: MCP 0.5s SUCCESS
Camel :: Catalog :: Dummy Component 0.5s SUCCESS
Camel :: Catalog :: Console 0.4s SUCCESS
Camel :: AI :: LangChain4j :: Embedding n/a
Camel :: Coverage n/a
Camel :: Endpoint DSL n/a
Camel :: Google :: PubSub n/a
Camel :: Integration Tests n/a
Camel :: JBang :: Core n/a
Camel :: JBang :: Integration tests n/a
Camel :: JBang :: MCP n/a
Camel :: JBang :: Main n/a
Camel :: JBang :: Plugin :: Edit n/a
Camel :: JBang :: Plugin :: Generate n/a
Camel :: JBang :: Plugin :: Route Parser n/a
Camel :: Launcher n/a
Camel :: Launcher :: Container n/a

Top 20 slowest modules:

  • Camel :: YAML DSL (53.6s)
  • Camel :: Salesforce (35.5s)
  • Camel :: AI :: TensorFlow Serving (32.2s)
  • Camel :: JIRA (28.5s)
  • Camel :: AI :: Weaviate (25.9s)
  • Camel :: OpenTelemetry (deprecated) (24.1s)
  • Camel :: AI :: Qdrant (22.3s)
  • Camel :: AI :: LangChain4j :: EmbeddingStore (20.2s)
  • Camel :: AI :: LangChain4j :: Ingest (17.2s)
  • Camel :: JBang :: Plugin :: TUI (16.1s)
  • Camel :: Component DSL (14.1s)
  • Camel :: Catalog :: Camel Catalog (13.0s)
  • Camel :: JBang :: Plugin :: Kubernetes (11.8s)
  • Camel :: Docs (11.0s)
  • Camel :: AI :: Pinecone (9.6s)
  • Camel :: gRPC (9.5s)
  • Camel :: Google :: Sheets (8.9s)
  • Camel :: Google :: BigQuery (8.2s)
  • Camel :: Spring AI :: Vector Store (8.1s)
  • Camel :: Google :: Storage (7.1s)

⚙️ View full build and test results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

core-build-and-dependencies dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant