Bump the gradle-minor-and-patch group across 1 directory with 54 updates

[dependabot]

Bumps the gradle-minor-and-patch group with 54 updates in the / directory:

Package	From	To
org.yaml:snakeyaml	2.6	2.7
com.squareup:kotlinpoet	2.3.0	2.4.0
gradle-wrapper	9.5.1	9.7.1
org.apache.commons:commons-collections4	4.5.0	4.6.0
commons-codec:commons-codec	1.22.0	1.22.1
nl.jqno.equalsverifier:equalsverifier	4.5	4.5.2
org.apache.groovy:groovy	5.0.6	5.1.2
com.google.protobuf:protobuf-java-util	4.34.1	4.36.1
io.grpc:grpc-protobuf	1.81.0	1.84.0
io.grpc:grpc-inprocess	1.81.0	1.84.0
io.grpc:grpc-stub	1.81.0	1.84.0
io.grpc:grpc-netty	1.81.0	1.84.0
io.grpc:grpc-testing	1.81.0	1.84.0
io.grpc:grpc-services	1.81.0	1.84.0
org.apache.httpcomponents.client5:httpclient5	5.6.1	5.6.4
com.fasterxml.jackson.core:jackson-core	2.21.3	2.22.2
com.fasterxml.jackson.core:jackson-databind	2.21.3	2.22.2
com.fasterxml.jackson.datatype:jackson-datatype-jdk8	2.21.3	2.22.2
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	2.21.3	2.22.2
com.fasterxml.jackson.module:jackson-module-kotlin	2.21.3	2.22.2
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml	2.21.3	2.22.2
org.jetbrains.kotlin:kotlin-stdlib-jdk8	2.3.21	2.4.20
org.jetbrains.kotlin:kotlin-reflect	2.3.21	2.4.20
org.jetbrains.kotlin.jvm	2.3.21	2.4.20
io.lettuce:lettuce-core	7.5.2.RELEASE	7.7.0.RELEASE
io.prometheus:prometheus-metrics-exporter-httpserver	1.6.1	1.8.0
io.micrometer:micrometer-registry-prometheus	1.16.5	1.17.1
io.netty:netty-common	4.2.13.Final	4.2.18.Final
io.netty:netty-transport	4.2.13.Final	4.2.18.Final
io.netty:netty-handler	4.2.13.Final	4.2.18.Final
io.netty:netty-handler-proxy	4.2.13.Final	4.2.18.Final
io.netty:netty-resolver	4.2.13.Final	4.2.18.Final
io.netty:netty-resolver-dns	4.2.13.Final	4.2.18.Final
io.netty:netty-codec	4.2.13.Final	4.2.18.Final
io.netty:netty-codec-http	4.2.13.Final	4.2.18.Final
io.netty:netty-codec-http2	4.2.13.Final	4.2.18.Final
io.netty:netty-buffer	4.2.13.Final	4.2.18.Final
io.netty:netty-resolver-dns-native-macos	4.2.13.Final	4.2.18.Final
io.netty:netty-tcnative	2.0.77.Final	2.0.84.Final
io.netty:netty-tcnative-boringssl-static	2.0.77.Final	2.0.84.Final
org.objenesis:objenesis	3.5	3.6
io.projectreactor:reactor-core	3.8.5	3.8.7
io.projectreactor:reactor-core-micrometer	3.8.5	3.8.7
io.projectreactor:reactor-test	3.8.5	3.8.7
io.projectreactor.netty:reactor-netty	1.3.5	1.3.7
io.projectreactor.addons:reactor-extra	3.6.0	3.6.1
io.projectreactor.kotlin:reactor-kotlin-extensions	1.3.0	1.3.2
org.springframework.boot:spring-boot-starter	4.0.6	4.1.1
org.springframework.boot:spring-boot-starter-actuator	4.0.6	4.1.1
org.springframework.boot:spring-boot-starter-test	4.0.6	4.1.1
com.auth0:java-jwt	4.5.2	4.6.1
com.google.cloud.tools.jib	3.5.3	3.5.4
org.springframework.boot	4.0.6	4.1.1
com.palantir.git-version	5.0.0	5.1.0

Updates org.yaml:snakeyaml from 2.6 to 2.7

Updates com.squareup:kotlinpoet from 2.3.0 to 2.4.0

Release notes

Sourced from com.squareup:kotlinpoet's releases.

2.4.0

Thanks to @​eyupcanakman and @​arimu1 for contributing to this release.

• New: Kotlin 2.4.20.
• New: KSP 2.3.11.
• New: Support for explicit backing fields. (#2325)
• New: value class validations have been relaxed to support multi-field value classes. (#2329)
• New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
• New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
• New: Add CodeBlockHolder.Builder.addComment(). (#2347)
• New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
• Fix: Keep the // prefix on wrapped file comment lines. (#2315)
• Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
• Fix: get and set operator function names are no longer escaped with backticks. (#2338)
• Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
• Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
• Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
• Fix: An expression body no longer leaks indentation into later declarations. (#2365)

Changelog

Sourced from com.squareup:kotlinpoet's changelog.

Version 2.4.0

Thanks to [@​eyupcanakman][eyupcanakman] and [@​arimu1][arimu1] for contributing to this release.

2026-09-07

• New: Kotlin 2.4.20.
• New: KSP 2.3.11.
• New: Support for explicit backing fields. (#2325)
• New: value class validations have been relaxed to support multi-field value classes. (#2329)
• New: Extract CodeBlockHolder interface for constructs that can hold a CodeBlock body and their builders. (#2331)
• New: Add CodeBlock.Builder.addComment() for adding // comments. (#2340)
• New: Add CodeBlockHolder.Builder.addComment(). (#2347)
• New: Use [] syntax instead of arrayOf when emitting annotation arguments. (#2361)
• Fix: Keep the // prefix on wrapped file comment lines. (#2315)
• Fix: TypeVariableName.equals/hashCode no longer overflow on recursively bound generics like Enum<E : Enum<E>>. (#2320)
• Fix: get and set operator function names are no longer escaped with backticks. (#2338)
• Fix: Don't special case varargs in KSAnnotation.toAnnotationSpec. (#2360)
• Fix: KSType.toTypeName() with the default TypeParameterResolver.EMPTY now resolves type parameters from their enclosing declarations instead of throwing. (#2368)
• Fix: Emit context parameters after annotations in FunSpec and PropertySpec. (#2374)
• Fix: An expression body no longer leaks indentation into later declarations. (#2365)

Commits

• 97e504b Prepare for release 2.4.0.
• fcd0f3c Update kotlin monorepo to v2.4.20 (#2379)
• 354c921 Update plugin spotless to v8.10.2
• 789311f Update plugin kotlinBinaryCompatibilityValidator to v0.18.2 (#2377)
• c0d8293 Don't throw when toTypeName() hits type parameters with EMPTY resolver (#2368)
• ae26f24 Don't leak an expression body's indent into later declarations (#2365)
• c42a4ef Update plugin spotless to v8.10.1
• 422f3b4 Emit context parameters after annotations in FunSpec and PropertySpec (#2374)
• 4e91626 Update dependency click to v8.5.0 (#2371)
• c6742fd Update actions/setup-java action to v6 (#2370)
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.5.1 to 9.7.1

Release notes

Sourced from gradle-wrapper's releases.

9.7.1

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• Resilient Sync helps you fix broken builds
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.7.0

The Gradle team is excited to announce Gradle 9.7.0.

... (truncated)

Commits

• 92f0512 update fixed issues for 9.7.1 (#38892)
• 820ee75 update fixed issues for 9.7.1
• 82c23f9 Fix annotation parameter ordering problem in KTS (#38878)
• ef11a72 Fix annotation parameter ordering issue
• bb0d8a9 Make relevant tests polyglot (run for multiple DSLs)
• 336e129 Update signing configuration (#38874)
• 4bdf0da Update signing configuration
• cd9b92c List issues resolved in 9.7.1 (#38839)
• 5f4e381 List issues resolved in 9.7.1
• 1e08ab5 Keep type-use annotations in extracted ABI classes (#38810)
• Additional commits viewable in compare view

Updates org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

• CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.

•         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.
  

Changes

•         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.
  

•         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.
  

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

---

Commits

• dc8f6c8 Prepare for the release candidate 1.22.1 RC1
• 8203c1c Prepare for the next release candidate
• 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
• 00c27a9 Reduce vertical whitespace
• 568f2d7 Remove unused method
• 316fb15 Remove unused method
• bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
• e14cdfe Extract redundant code.
• 3351e63 Add messages when throwing NullPointerException.
• f22dab7 Update SCM tag
• Additional commits viewable in compare view

Updates nl.jqno.equalsverifier:equalsverifier from 4.5 to 4.5.2

Release notes

Sourced from nl.jqno.equalsverifier:equalsverifier's releases.

Release equalsverifier-4.5.2

For a list of changes in this version, see CHANGELOG.md.

Release equalsverifier-4.5.1

For a list of changes in this version, see CHANGELOG.md.

Changelog

Sourced from nl.jqno.equalsverifier:equalsverifier's changelog.

[4.5.2] - 2026-08-27

Fixed

• Significant fields error when first implementation of a sealed interface is a single-value enum. (Issue 1236)

[4.5.1] - 2026-08-21

Fixed

• Adds prefab values for java.util.LinkedHashSet. (Issue 1231, Issue 1232; thanks kalayciburak!)

Commits

• 2e0dae0 Bumps version to 4.5.2
• 8818df1 Updates CHANGELOG for release
• ff374a3 Adds PR number to changelog
• f051bc7 Fixes singificant fields error when first sealed interface implementation is ...
• 2669ffa Prepares for next development iteration
• d890771 Bumps version to 4.5.1
• cec51b8 Updates CHANGELOG for release
• 1e5a37a Merge pull request #1235 from jqno/dependabot/maven/dependencies-1b33e0e210
• 7b46e33 Merge pull request #1234 from jqno/dependabot/github_actions/dependencies-9c0...
• 5706e86 Bump the dependencies group with 2 updates
• Additional commits viewable in compare view

Updates org.apache.groovy:groovy from 5.0.6 to 5.1.2

Commits

• See full diff in compare view

Updates com.google.protobuf:protobuf-java-util from 4.34.1 to 4.36.1

Updates io.grpc:grpc-protobuf from 1.81.0 to 1.84.0

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Updates io.grpc:grpc-inprocess from 1.81.0 to 1.84.0

Release notes

Sourced from io.grpc:grpc-inprocess's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.81.0 to 1.84.0

Release notes

Sourced from io.grpc:grpc-stub's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Updates io.grpc:grpc-netty from 1.81.0 to 1.84.0

Release notes

Sourced from io.grpc:grpc-netty's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (

[dependabot]

Labels

The following labels could not be found: gradle. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.