Repository navigation
chore: sync agentic-identities-bound-token with main - #14622
Merged
macastelaz merged 344 commits intoOct 9, 2026
Merged
macastelaz merged 344 commits into
macastelaz merged 344 commits into
Conversation
…ingSubscriberConnectionTest (googleapis#14146) Flakiness exists again even though the test was disabled. After another look, it seems this test is most likely the cause (spawning new threads). From googleapis#13706
…ction (googleapis#14129) Error: ``` JUnit Jupiter:ITBigQueryStorageTest ClassSource [className = 'com.google.cloud.bigquery.storage.v1beta2.it.ITBigQueryStorageTest', filePosition = null] => java.lang.IllegalStateException: Failed to initialize SSLSocketFactory. com.google.api.client.http.javanet.NetHttpTransport$Builder.createDefaultSslSocketFactory(NetHttpTransport.java:476) com.google.api.client.http.javanet.NetHttpTransport$Builder.resolveSslSocketFactory(NetHttpTransport.java:446) com.google.api.client.http.javanet.NetHttpTransport$Builder.build(NetHttpTransport.java:485) com.google.cloud.http.HttpTransportOptions$DefaultHttpTransportFactory.create(HttpTransportOptions.java:75) com.google.cloud.bigquery.spi.v2.HttpBigQueryRpc.<init>(HttpBigQueryRpc.java:108) [...] Caused by: java.security.NoSuchAlgorithmException: class configured for SSLContext (provider: Conscrypt) cannot be found. java.base@21.0.2/java.security.Provider$Service.getImplClass(Provider.java:2004) java.base@21.0.2/java.security.Provider$Service.getDefaultConstructor(Provider.java:2020) java.base@21.0.2/java.security.Provider$Service.newInstanceOf(Provider.java:1934) java.base@21.0.2/java.security.Provider$Service.newInstanceUtil(Provider.java:1942) java.base@21.0.2/java.security.Provider$Service.newInstance(Provider.java:1917) [...] Caused by: java.lang.ClassNotFoundException: org.conscrypt.OpenSSLContextImpl$TLSv13 java.base@21.0.2/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:52) java.base@21.0.2/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188) java.base@21.0.2/java.lang.ClassLoader.loadClass(ClassLoader.java:121) java.base@21.0.2/java.security.Provider$Service.getImplClass(Provider.java:1991) [...] ```
…#14130) PiperOrigin-RevId: 966248502 Fixes b/548103139
…uery to v2-rev20260731-2.0.0 (googleapis#14149) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [com.google.apis:google-api-services-bigquery](http://nexus.sonatype.org/oss-repository-hosting.html) ([source](http://svn.sonatype.org/spice/tags/oss-parent-7)) | `v2-rev20260707-2.0.0` → `v2-rev20260731-2.0.0` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](..googleapis/issues/7649) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/googleapis/google-cloud-java). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zNS40IiwidXBkYXRlZEluVmVyIjoiNDQuMzUuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
…oogleapis#14150) This PR is **part 1 of 3** in a stacked series of JSpecify nullability fixes for `google-auth-library-java`: 1. **This PR (googleapis#14150)**: `fix(auth): fix JSpecify nullability in UserAuthorizer and TokenStore` (resolves googleapis#14147) 2. googleapis#14153: `fix(auth): add missing @nullable annotations across credential types and providers` 3. googleapis#14154: `fix(auth): annotate builder fields, setters, and getters as @nullable across credential builders` --- Fixes googleapis#14147 ### Description In `google-auth-library-java`, classes were recently annotated with `@NullMarked` at the class level. This PR specifically addresses the incompatibilities reported in googleapis#14147: 1. **`TokenStore#load` and `MemoryTokensStorage#load`**: Annotates the return type of `load(String id)` with `@Nullable`, as `null` is the expected result when no token data is found for a given identifier. 2. **`UserAuthorizer#getAuthorizationUrl` and `UserAuthorizer#getAndStoreCredentialsFromCode`**: Annotates the `baseUri` parameter with `@Nullable` across `getAuthorizationUrl`, `getAndStoreCredentialsFromCode`, `getCredentialsFromCode`, `getTokenResponseFromAuthCodeExchange`, and `getCallbackUri`, as `baseUri` is optional and only required when using relative callback URIs. --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
…TableResult` (googleapis#14145) b/549680449 This PR exposes `StatementType` and jobless query execution metrics on `TableResult` by plumbing them from `QueryResponse` and `JobStatistics.QueryStatistics`. This enables downstream consumers (such as the BigQuery JDBC driver) to inspect query statement types and execution statistics directly from `TableResult` without needing to issue secondary jobs or dry-run queries. ## Changes - **Dependency Update**: Bumped `google-api-services-bigquery` to `v2-rev20260731-2.0.0` in `google-cloud-jar-parent/pom.xml` and `java-bigquery/pom.xml`. - **TableResult**: Added getters, builder setters, pagination propagation (`getNextPage()`), `toString()`, `hashCode()`, and `equals()` for: - `getStatementType()` (`StatementType`) - `getTotalBytesBilled()` (`Long`) - `getTotalBytesProcessed()` (`Long`) - `getTotalSlotMs()` (`Long`) - `getNumDmlAffectedRows()` (`Long`) - **BigQueryImpl**: Plumbed these fields from `QueryResponse` when building `TableResult` in `queryRpc()`. - **Job**: Plumbed `StatementType` and query metrics from `QueryStatistics` when creating `TableResult` in `getQueryResults()`. - **Tests**: Added unit tests in `TableResultTest` and `BigQueryImplTest` verifying field retrieval, pagination propagation, builder modifications, and serialization.
…and UserCredentials (googleapis#14159) ## Description Refines JSpecify nullability annotations and checks for `ServiceAccountCredentials`, `UserCredentials`, and their base hierarchy (`GoogleCredentials`, `OAuth2Credentials`, `QuotaProjectIdProvider`). - **JSpecify Type-Use Nullability**: Annotates return types, fields, and builder methods with standard type-use `@Nullable` annotations. - **Guava Preconditions**: Migrates from `com.google.api.client.util.Preconditions` to `com.google.common.base.Preconditions`. - **Null-Check Cleanup**: Removes redundant null checks on constructor-validated non-null fields in `UserCredentials`.
…oogleapis#14158) Fix remaining nullability annotations, builder defaults, and safe token storage in `UserAuthorizer`. - Make `UserAuthorizer.Builder` fields `@Nullable` so unconfigured fields default to null before `build()` resolves defaults. - Enforce non-null parameters across all `UserAuthorizer.Builder` setters. - In `UserAuthorizer.storeCredentials`, safely guard expiration time checking to avoid NullPointerException when `credentials.getAccessToken()` is null. - Update `TokenResponseWithConfig` to mark `clientSecret` as `@Nullable` for public OAuth clients, and mark `refreshToken` return type as `@Nullable`. - Add unit tests in `UserAuthorizerTest` covering `toBuilder()`, builder defaults, `TokenResponseWithConfig`, and `storeCredentials` with null access token. --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
…gleapis#14156) b/549675845 This PR eliminates the pre-execution dry-run query previously required to determine `StatementType` during query execution in the BigQuery JDBC driver. ### Changes 1. **Direct `StatementType` Resolution**: Updated `BigQueryStatement.runQuery()` to extract `StatementType` directly from `TableResult` (for stateless/jobless queries) or `JobStatistics` (for job-based queries), removing the dry-run query fallback. 2. **DML Row Count Optimization**: Updated `BigQueryStatement.handleQueryResult()` to retrieve `numDmlAffectedRows` directly from `TableResult`, avoiding extra `getJob()` polling RPCs for DML statements. 3. **Unit Tests**: Added test cases in `BigQueryStatementTest` verifying that `bigquery.create()` and `bigquery.getJob()` are never invoked during stateless query and DML executions.
…ed (googleapis#14161) b/543829068 --------- Co-authored-by: Keshav Dandeva <keshavdandeva@google.com>
Update gRPC versions in java-storage-expected-flattened-dependencies.txt from 1.82.2 to 1.82.4 following gRPC upgrade in googleapis#14088.
…try (googleapis#14061) b/538177258 This PR executes Part 1 of Phase 4 of the Type Registry consolidation. It migrates all parameter binding (Write Path) and metadata sizing away from the legacy \`BigQueryJdbcTypeMappings\` and onto the unified \`BigQueryTypeRegistry\`. ### Changes: - **Write Path**: Re-routed parameter SQL type binding in \`BigQueryParameterHandler\`, \`BigQueryPreparedStatement\`, and \`BigQueryCallableStatement\` to use the registry. - **Metadata Integration**: Migrated \`ColumnTypeInfo\` metadata map into \`BigQueryTypeRegistry\`. - **Metadata Classes**: Updated \`BigQueryResultSetMetadata\`, \`BigQueryParameterMetaData\`, and \`BigQueryDatabaseMetaData\` to extract sizes and types exclusively from the registry.
🤖 I have created a release *beep* *boop* --- <details><summary>1.90.0</summary> ## [1.90.0](googleapis/google-cloud-java@v1.89.0...v1.90.0) (2026-08-24) ### Features * **bigquery-jdbc:** implement TypeRegistry and TypeDescriptor ([googleapis#13947](googleapis#13947)) ([0557e69](googleapis@0557e69)) * **bigquery:** add QueryResultsFormat and ArrowSerializationOptions configurations ([googleapis#13942](googleapis#13942)) ([ff03e19](googleapis@ff03e19)) * **bigquery:** expose `StatementType` and query execution stats on `TableResult` ([googleapis#14145](googleapis#14145)) ([7d16de8](googleapis@7d16de8)) * **bigtable:** enable microsecond timestamps in client ([googleapis#14057](googleapis#14057)) ([57aaf8d](googleapis@57aaf8d)) * **bigtable:** route single-entry MutateRows through a point-write c… ([googleapis#14028](googleapis#14028)) ([a403703](googleapis@a403703)) * **datastore:** add support for request tags ([googleapis#13732](googleapis#13732)) ([b1f6186](googleapis@b1f6186)) * **ftp:** onboard a new library ([googleapis#14068](googleapis#14068)) ([f41b2d9](googleapis@f41b2d9)) * **gax:** add ResumableUploadCallable and ResumableUploadCallSettings ([googleapis#14052](googleapis#14052)) ([a5e26e8](googleapis@a5e26e8)) * **google/cloud/biglake/hive/v1:** onboard a new library ([googleapis#14130](googleapis#14130)) ([650c839](googleapis@650c839)) * **google/maps/mapmanagement/v2:** onboard a new library ([googleapis#14131](googleapis#14131)) ([7d00726](googleapis@7d00726)) * **spanner:** support user-provided OpenTelemetry for client metrics export ([googleapis#13741](googleapis#13741)) ([da74dee](googleapis@da74dee)) * update API sources and regenerate ([googleapis#14000](googleapis#14000)) ([9337a93](googleapis@9337a93)) * **workloadidentity:** onboard a new library ([googleapis#14060](googleapis#14060)) ([ab226ee](googleapis@ab226ee)) ### Bug Fixes * add documentation for insertall api that there's no default retry ([googleapis#13953](googleapis#13953)) ([1fdb4f1](googleapis@1fdb4f1)) * add retry behavior documentation to insertall interface to clarify the behavior ([googleapis#14058](googleapis#14058)) ([1b8f9e3](googleapis@1b8f9e3)) * **auth:** fix JSpecify nullability in UserAuthorizer and TokenStore ([googleapis#14150](googleapis#14150)) ([0d5fac0](googleapis@0d5fac0)) * **auth:** fix remaining nullability in UserAuthorizer and Builder ([googleapis#14158](googleapis#14158)) ([a51bb8d](googleapis@a51bb8d)) * **auth:** refine JSpecify nullability for ServiceAccountCredentials and UserCredentials ([googleapis#14159](googleapis#14159)) ([a929250](googleapis@a929250)) * **bigquery-jdbc:** enable ITOpenTelemetryTest ([googleapis#13991](googleapis#13991)) ([fa6641b](googleapis@fa6641b)) * **bigquery-jdbc:** pass connection proxy settings to OpenTelemetry exporters ([googleapis#14011](googleapis#14011)) ([115b9b3](googleapis@115b9b3)) * **bigquery-jdbc:** session context propagation when session is enabled ([googleapis#14161](googleapis#14161)) ([1e74dda](googleapis@1e74dda)) * **bigtable:** remove heartbeat miss logging ([googleapis#14054](googleapis#14054)) ([ec17637](googleapis@ec17637)) * **deps:** update dependency com.google.apis:google-api-services-bigquery to v2-rev20260731-2.0.0 ([googleapis#14149](googleapis#14149)) ([95f6c38](googleapis@95f6c38)) * **deps:** update dependency com.google.cloud:libraries-bom to v26.86.0 ([googleapis#14103](googleapis#14103)) ([cf5697e](googleapis@cf5697e)) * **gax-httpjson:** reduce Conscrypt fallback error to debug level ([googleapis#13962](googleapis#13962)) ([8236771](googleapis@8236771)) * **gax-httpjson:** remove unsupported and deprecated PQC named groups ([googleapis#14107](googleapis#14107)) ([7604971](googleapis@7604971)) * **gax:** register Conscrypt SSLContext SPI classes for GraalVM reflection ([googleapis#14129](googleapis#14129)) ([73c0243](googleapis@73c0243)) * **samples:** align native profile junit and surefire versions with shared config ([googleapis#14096](googleapis#14096)) ([2b84133](googleapis@2b84133)) * **spanner:** add closeAsync to ReadContext and make transaction closing non-blocking ([googleapis#14076](googleapis#14076)) ([671f892](googleapis@671f892)) * **spanner:** scope server-timing metrics per call and guard interceptor lifecycle callbacks ([googleapis#14053](googleapis#14053)) ([f35c570](googleapis@f35c570)) * **storage:** use JsonUtils for StorageObject serialization in resumable writes and read channels ([googleapis#13976](googleapis#13976)) ([d94922f](googleapis@d94922f)) ### Performance Improvements * **bigquery-jdbc:** eliminate dry run to resolve statement type ([googleapis#14156](googleapis#14156)) ([7109ecd](googleapis@7109ecd)) * **spanner-jdbc:** cache commonly used query parameter names ([googleapis#14036](googleapis#14036)) ([1eb6aa3](googleapis@1eb6aa3)) * **spanner-jdbc:** cache JDBC metadata query strings ([googleapis#14041](googleapis#14041)) ([31c628f](googleapis@31c628f)) * **spanner-jdbc:** cache positional to named param conversion ([googleapis#14034](googleapis#14034)) ([30e031b](googleapis@30e031b)) ### Dependencies * **gax-httpjson:** upgrade conscrypt-openjdk-uber to 2.6.2 ([googleapis#14117](googleapis#14117)) ([2f5481a](googleapis@2f5481a)) * Update gRPC to v1.82.3 ([googleapis#13997](googleapis#13997)) ([a786107](googleapis@a786107)) * Upgrade gRPC to v1.82.4 ([googleapis#14088](googleapis#14088)) ([0c482fe](googleapis@0c482fe)) ### Documentation * **bigquery-jdbc:** add user guide with connection property and custom endpoint reference ([googleapis#13878](googleapis#13878)) ([2dde172](googleapis@2dde172)) * **gax:** update LRO troubleshooting documentation link ([googleapis#14108](googleapis#14108)) ([4c5bbae](googleapis@4c5bbae)) * **spanner-jdbc:** update connection_properties.md documentation ([googleapis#14035](googleapis#14035)) ([b576fe8](googleapis@b576fe8)) * **spanner:** update CHANGELOG.md for releases 6.117.0 through 6.120.0 ([googleapis#13970](googleapis#13970)) ([2413811](googleapis@2413811)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Remove flatten-plugin-check job from java-shared-config-downstream-dependencies workflow, client-library-check.sh, and delete java-storage-expected-flattened-dependencies.txt. Fixes: googleapis#13965
…ePointWriteCallableTest (googleapis#14179) Fixes googleapis#14174 ### Problem During GraalVM native presubmit CI compilation under JDK 21 with ErrorProne enabled, `MaybePointWriteCallableTest.java` failed with: `[NullArgumentForNonNullParameter]` at line 59: `assertThat((Object) future.get()).isNull()`. - `future.get()` on `ApiFuture<Void>` evaluates to `null` (or throws an exception). - ErrorProne failed to resolve Truth's `@Nullable` parameter annotation on `assertThat(@nullable Object actual)` inside the `@NullMarked` package when reading bytecode in CI, flagging passing a known-null value. ### Solution Replace `assertThat((Object) future.get()).isNull()` with direct `future.get()` to verify successful completion without exception.
Fixes googleapis#14110 ### Description Removes the `java-datacatalog` module and all references to Data Catalog across the repository, as the service has reached end-of-life and was shut down on 2026-06-01 (https://docs.cloud.google.com/data-catalog/docs) Users are suggested to move to dataplex: https://docs.cloud.google.com/dataplex/docs/reference/libraries ### Changes - Deleted `java-datacatalog/` module directory. - Removed `<module>java-datacatalog</module>` from root `pom.xml`. - Removed `google-cloud-datacatalog-bom` from `gapic-libraries-bom/pom.xml`. - Removed `Data Catalog` entry from root `README.md`. - Removed `google-cloud-datacatalog` entries from `versions.txt`. - Removed `datacatalog` configuration block from `librarian.yaml`. - Removed `google-cloud-datacatalog` from `java-cloud-bom/` metadata, README, and dependency-convergence tests. - Removed `datacatalog` test dependencies and obsolete policy tag integration test from `java-bigquery/google-cloud-bigquery`.
🤖 I have created a release *beep* *boop* --- <details><summary>1.91.0-SNAPSHOT</summary> ### Updating meta-information for bleeding-edge SNAPSHOT release. </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
…oogleapis#14063) This PR migrates the BigQuery JDBC read-path implementations (Arrow and Json) to utilize the newly introduced `BigQueryTypeRegistry` for unified type lookups and high-performance coercion. Also made the following fixes in implementation and tests: ### **Type Registry Consolidation & Read-Path Migration** * **Unified Coercion:** Replaced the legacy `BigQueryTypeCoercer` with `BigQueryTypeRegistry` as the single source of truth for all type casting and format mapping. * **Result Set Integration:** Refactored `BigQueryBaseResultSet`, `BigQueryArrowResultSet`, and `BigQueryJsonResultSet` (along with their nested Struct and Array counterparts) to funnel all `getObject()` and primitive getter calls through the registry. ### **Temporal Type & JDBC 4.2 Spec Compliance** * **Strict UTC Anchoring:** Anchored `java.sql.Date` to strictly format at UTC midnight, and `java.sql.Time` to `1970-01-01` in the local JVM, ensuring correct String serialization and civil time preservation. * **Illegal Coercion Blocking:** Added explicit guards to throw `BigQueryJdbcException` for invalid cross-temporal conversions (e.g., blocking `java.sql.Date` -> `java.sql.Time` and `java.sql.Time` -> `java.sql.Date`), preserving backward compatibility with legacy strictness. * **Formatter Optimization:** Extracted `DateTimeFormatter` compilations into `static final` constants to guarantee fast-path string serialization for `TIMESTAMP` (6 decimal precision) and `TIME` (3 decimal precision) without per-row object allocation penalties. ### **Complex Types & Boundary Protection** * **Arrow Primitives:** Handled raw Arrow `Integer` (days since epoch) and `Long` (microseconds since epoch) unboxing explicitly inside Arrow structures to bypass global registry mutations, fixing nested `RANGE` and `ARRAY` rendering. * **Strict Bounds Checking:** Implemented explicit overflow/underflow protections (`MAX_VALUE` / `MIN_VALUE` guards) when coercing `BigDecimal` and `Long` values down to smaller primitives (`Integer`, `Short`, `Byte`) to prevent silent data corruption.
…nt credentials (googleapis#14164) Stacked on googleapis#14162. Refines JSpecify nullability annotations across ExternalAccountCredentials and subclasses: - **Type-Use Placement & Nullability**: Annotate optional fields, getters, and builder setters/fields with `@Nullable` across: - `ExternalAccountCredentials` - `IdentityPoolCredentials` - `AwsCredentials` - `PluggableAuthCredentials` - `ExternalAccountAuthorizedUserCredentials` - **Preconditions**: Standardize on `com.google.common.base.Preconditions` over `com.google.api.client.util.Preconditions`. - **Builder Copy Constructors**: Ensure builder copy constructors properly preserve all fields.
Temp fix for lint issue and skip generate to avoid this overriden by generation run. This is a temporarily solution to unblock development (e.g., googleapis#13928), while we figure out a longer term solution. For googleapis/librarian#7146 --------- Co-authored-by: Lawrence Qiu <lawrenceqiu@google.com>
Updated googleapis commitish in librarian.yaml to googleapis/googleapis@de3c0d3 💡 **Note:** If this PR is still open when the daily update workflow runs next, it will be closed and replaced with a new PR containing the latest updates.
Use a copy-on-write test metric recorder because synchronized-list iteration raced with asynchronous exports.
…tpRequestRunnable (googleapis#14134) GAX HTTP infrastructure currently assumes that - request content is always JSON - request URLs are always based on the client context associated with the service stub This PR relaxes those assumptions to allow non-JSON content and arbitrary URLs, which will be needed for resumable upload support.
…teClasses check (googleapis#14142) ## Summary Separates the Maven Enforcer configuration into two distinct executions: 1. **`enforce` (Fast Metadata Checks)**: Checks `requireUpperBoundDeps`, `requireMavenVersion`, and `requireJavaVersion`. Runs on every PR directly in memory (~15s) without needing a full-repo build. 2. **`enforce-banned-duplicate-classes` (Bytecode Scanner)**: Checks `banDuplicateClasses`. Runs only on Release-Please (non-SNAPSHOT) PRs after compiling and installing all module JARs to disk. --- ### Key Changes * **`java-shared-config/pom.xml`**: * Separated `<id>enforce</id>` into fast metadata rules (`requireUpperBoundDeps`, `requireMavenVersion: [3.8.0,)`, `requireJavaVersion: [1.8,)`). * Added `<id>enforce-banned-duplicate-classes</id>` execution containing the `<banDuplicateClasses>` rule. * **`.github/workflows/ci.yaml`**: * `enforcer` job: Runs on every PR using `mvn -B -ntp enforcer:enforce@enforce -T 1C` (executes in ~15 seconds across all modules without pre-installing JARs). * `ban-duplicate-classes` job: Runs on Release-Please PRs (`release-please--branches--main` non-SNAPSHOT) with the full `JOB_TYPE: install` step followed by `mvn -B -ntp enforcer:enforce@enforce-banned-duplicate-classes -T 1C`. * **`grpc-gcp-java`**: * Updated parent POM to inherit the local `google-cloud-shared-config:1.21.0-SNAPSHOT` parent via relative path and Release-Please tracking comment (`<!-- {x-version-update:google-cloud-shared-config:current} -->`), directly inheriting the split enforcer configuration. * **`google-auth-library-java`**: * Added temporary enforcer configuration overrides with `<rules combine.self="override">` to prevent running the old `banDuplicateClasses` rule inherited from the remote `google-cloud-shared-config:1.17.0` release artifact. * *Note*: These overrides are temporary until the new version of `google-cloud-shared-config` is published to Maven Central, at which point the parent version will be bumped and the overrides removed. * **`java-samples`**: * Added `<enforcer.skip>true</enforcer.skip>` to sample parent POM. --- ### Benefits * **Fast PR Turnaround**: Developers get immediate feedback on dependency convergence (`requireUpperBoundDeps`) and tool versions in ~15 seconds rather than waiting 20+ minutes. * **Full Classpath Safety**: Releases remain protected against duplicate class conflicts (JAR hell) via `banDuplicateClasses` before publishing.
b/549675845 ### 1. Summary of Changes in this PR 1. **Eliminate redundant synchronous `jobs.get` on fast path** - `BigQueryStatement.executeJob()` no longer calls `bigQuery.getJob()` when query execution returns inline as a `TableResult`. - Because `TableResult` contains `statementType`, `numDmlAffectedRows`, and `sessionInfo` directly, this reduces fast-path queries from **2 network round-trips (`jobs.query` + `jobs.get`) to 1 single round-trip (`jobs.query`)**, saving ~400–500ms of latency per query. 2. **Jobful Path Metadata Refresh (`JobCreationMode=1` / Storage API)** - In `BigQueryStatement.executeJob()`, when a query executes via the jobful path (`result instanceof Job`), safely refreshes the completed `Job` via `bigQuery.getJob(jobId)` after `job.getQueryResults()` completes so statement type and query statistics are populated. ### 2. Remaining Dry Runs in the Driver | Location | Context / Flow | Why It Exists | Current Status & Evaluation | |---|---|---|---| | **`BigQueryStatement.addBatch(sql)`** | Statement Batching | Runs a dry run on every `addBatch(sql)` call to validate upfront that the query is a DML statement (`INSERT`/`UPDATE`/`DELETE`). | **Follow-up**: Filed b/553463265 for resolving this issue. | | **`BigQueryStatement.execute(sql)`** (`isLargeResultsEnabled`) | Large Results Destination Check | Verifies statement is a `SELECT` before attaching destination dataset/table configs (BigQuery API rejects DDL/DML if destination tables are set). | **Retained**: Only triggers when `DestinationDataset`/`DestinationTable` is configured; skipped for normal queries (`isLargeResultsEnabled() == false`). | | **`BigQueryPreparedStatement.executeBatch()`** | Storage Write API Batch Setup | Discovers destination table ID and schema from query text to serialize binary Arrow/JSON records for streaming gRPC ingestion. | **Retained**: Executes **at most once** per `PreparedStatement` lifecycle to initialize Write API streams; skipped when standard query batching is used. | | **`BigQueryStatement.getQueryType()`** | Statement Type Fallback | Defensive fallback if `statementType` is unpopulated. | **Retained**: Skipped on the fast path because `TableResult.getStatementType()` is populated directly by `jobs.query`. |
…leapis#14586) Removes a duplicate `google-cloud-storage` dependency declaration in `java-bigquery/google-cloud-bigquery/pom.xml`. The duplicate entry caused Maven project model validation failures during CI builds. The other declaration is in line 34 - 37.
…leapis#14569) Co-authored-by: cloud-java-bot <cloud-java-bot@google.com>
) Fixes googleapis#12058. `LocalDatastoreHelper` still hands `e0d1170519cf52e2e5f9f93892cdf70c` to `DownloadableEmulatorRunner`, and that is the checksum of the *2.0.2* archive, not the 2.3.1 one it now points at. Found the culprit while going through the file history: `e17b57b6` moved `MIN_VERSION` to 2.0.2 and set the checksum that matched, then `9eb86f06` (googleapis#1698) moved `MIN_VERSION` on to 2.3.1 and didn't bring the checksum along. `curl -I` on the old zip still reports `ETag: e0d1170519cf52e2e5f9f93892cdf70c`, which is how I spotted it. Since `downloadZipFile()` compares the two and re-fetches on mismatch, the condition was true on every call and each `start()` pulled ~36 MB again even with a perfectly good copy sitting in `java.io.tmpdir`. Verified against the real artifact rather than just eyeballing the string. The 2.3.1 zip is 37,929,131 bytes; downloading it and running `md5sum` gives `7c1f5a3276241a8f78cb1a837daaaa47`, and GCS agrees (`ETag` plus the `x-goog-hash` md5, base64 `fB9aMnYkGo94yxqDfaqqRw==`). I also replayed the check from `BaseEmulatorHelper` over the downloaded file: the old constant makes it re-download, the new one lets it use the cached copy. The second commit is a separate small thing I ran into in the same constructor, so it's easy to drop if you'd rather keep this to one change: the gcloud command line is built from the raw `builder.consistency` while the downloadable runner's uses `getConsistency()`. `newBuilder().build()` leaves `builder.consistency` at 0.0 while `getConsistency()` resolves to `DEFAULT_CONSISTENCY` (0.9), so the two runners disagree for the same helper. Using `getConsistency()` in both makes them match. --------- Co-authored-by: rootkiller6788 <rootkiller6788@users.noreply.github.com>
…lters for flatten-maven-plugin (googleapis#14598) ## Summary Fixes `java.lang.VerifyError` in downstream tests (such as `java-bigquery-jdbc`) on GitHub Actions runners upgraded to **Apache Maven `3.10.0`**. ## Cause Maven `3.10.0` (Maven Resolver `2.0.24`) enables `aether.remoteRepositoryFilter.prefixes` and `aether.remoteRepositoryFilter.groupId` by default. Because `flatten-maven-plugin:1.3.0` reads dependency POMs with `repositories = null` (`[]`), the active remote repository filter rejects cached POMs in `~/.m2/repository`, causing `flatten-maven-plugin` to drop `<exclusions>` (such as `protobuf-javalite` on `io.grpc:grpc-protobuf-lite`) when generating `.flattened-pom.xml`. ## Fix Disable the default remote repository filters in `.mvn/maven.config`: ```text -Daether.remoteRepositoryFilter.prefixes=false -Daether.remoteRepositoryFilter.groupId=false ```
…patibility (googleapis#14609) Support for '#' comments in .mvn/maven.config was introduced in Apache Maven 3.9.0 (MNG-7682). Prior versions of Maven (such as 3.8.x) and IDE Maven parsers split the entire file on whitespace and reject '#' comment tokens with: Unable to parse maven.config: Unrecognized maven.config entries: [#, TODO:, ...] Remove the comment line from .mvn/maven.config so that it parses cleanly across both Maven 3.8.x and 3.9+.
This fixes a timeout in `roleWithNoPermissions` and `grantAndRevokeDatabaseRolePermissions` where the Spanner `DatabaseClient` instance was not closed before dropping the role, causing the backend `DROP ROLE` DDL to block on active session pool connections.
…MultiThreaded (googleapis#14604) ### Root Cause `ITBulkConnectionTest.testBulkCreateConnectionsMultiThreaded` submits 250 connection and query tasks across a 50-thread pool and calls `executor.awaitTermination(10L, TimeUnit.SECONDS)` without asserting its return value or waiting for the submitted task `Future`s. When initial Spanner client and metrics setup plus 250 connection handshakes exceed 10 seconds, `awaitTermination` returns `false` while worker threads still have open connections in flight, causing `closeSpanner()` in `@AfterClass` to fail with `FAILED_PRECONDITION: There is/are 1 connection(s) still open. Close all connections before calling closeSpanner()`. ### Fix - Collect all submitted task `Future`s and assert `assertNull(future.get())` to propagate any worker exception and ensure all connections are closed before test completion. - Increase `executor.awaitTermination` timeout from 10 seconds to 60 seconds and assert `assertTrue(executor.awaitTermination(60L, TimeUnit.SECONDS))`.
…oogleapis#14608) Re-enable dataBoostRead and dataBoostQuery in ITBatchReadTest on cloud-devel (staging-wrenchworks.sandbox.googleapis.com) now that the DataBoost backend capacity fix has rolled out, while keeping them skipped on cloud-staging.
…MultiThreaded (googleapis#14610) ### Summary Follow-up to googleapis#14604 to address review feedback on `ITBulkConnectionTest.testBulkCreateConnectionsMultiThreaded`: - Wrap the `ExecutorService` execution in a `try-finally` block calling `executor.shutdownNow()` and `executor.awaitTermination(5L, TimeUnit.SECONDS)` if the executor has not terminated when the test exits. - Include a descriptive failure message in `assertTrue(..., executor.awaitTermination(60L, TimeUnit.SECONDS))` and use JUnit `assertTrue` / `assertNotNull` assertions inside the worker task.
…s#14602) `java-shared-config` is the root parent POM for the monorepo. Update CI path filters and Kokoro scripts so changes to `java-shared-config` trigger: - `ci.yaml`: `units`, `units-8-runtime`, and `split-*` jobs for downstream split modules. - `.kokoro/common.sh`: `should_test_all_modules()` for Kokoro integration and GraalVM tests. - Core & standalone workflows: `sdk-platform-java-ci.yaml`, `showcase.yaml`, `java-cloud-bom-ci.yaml`, `java-bigquery-jdbc-ci.yaml`, `java-spanner-jdbc-ci.yaml`, and `java-storage-nio-ci.yaml`.
Fixes googleapis#14572. The Surefire `<test>` value in gax-grpc ended with an entry without a `!`. Surefire treats that as an inclusion pattern, so only `InstantiatingGrpcChannelProviderTest#testLogDirectPathMisconfigWrongCredential` ran in CI. - **`gax-grpc/pom.xml`:** drop the stray inclusion and keep both existing exclusions. - **`InstantiatingGrpcChannelProviderTest#testLogDirectPathMisconfigWrongCredential`:** set `.setEnvProvider(name -> null)`, so the test no longer depends on the machine's `GOOGLE_CLOUD_DISABLE_DIRECT_PATH`. With it set to `true`, the test fails because the provider takes the "DirectPath disabled" branch. It passed on GitHub runners only because the variable isn't set there. **Testing:** `mvn test -pl gax-grpc` now runs 209 tests, all passing, locally on JDK 21. Before, it ran 1.
…#14562) Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[googleapis#5044](urllib3/urllib3#5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[googleapis#4945](urllib3/urllib3#4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[googleapis#5092](urllib3/urllib3#5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.6.3...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/googleapis/google-cloud-java/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…tion completion (googleapis#14459) This PR links RPC attempt spans to the parent OpenTelemetry context and ensures active attempt spans are safely cleaned up upon operation completion. b/564460690
…googleapis#14597) Fixes googleapis#12604 ### Summary Clarifies the Javadoc on `ImpersonatedCredentials` (`Builder.setQuotaProjectId`, `idTokenWithAudience`, and `create` overloads) regarding how `quotaProjectId` is applied: - The `quotaProjectId` configured on `ImpersonatedCredentials` is sent via the `x-goog-user-project` header on **downstream API requests** authenticated with the impersonated credentials. - Requests to the IAM Credentials API (`generateAccessToken` and `generateIdToken`) used to mint tokens are authenticated using `sourceCredentials`. To specify a quota project (`x-goog-user-project` header) for those IAM Credentials API calls, the quota project ID should be configured on `sourceCredentials`.
…ogleapis#14460) Implement operationFailed in LoggingTracer to log actionable errors for logical operation failures. b/564459813
macastelaz
merged commit Oct 9, 2026
03af200
into
googleapis:agentic-identities-bound-token
256 of 261 checks passed
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces significant performance optimizations to the Kokoro CI scripts by replacing slow Maven evaluations with native Bash and sed processing, and switches dependency analysis to use test-compile to save build time. It also updates the google-auth-library-java codebase with comprehensive @Nullable annotations for JSpecify compatibility and fixes a serialization issue in AWS credentials. Major enhancements are made to the grpc-gcp-java library, introducing channel priming for scaled-up channels, improving scale-down draining, and adding error penalty load tracking to avoid degraded channels. The review feedback correctly identifies two critical active stream count leaks in GcpClientCall.java where state checks are performed after incrementing the stream count; moving the state checks before the increments will resolve these leaks.
Comment on lines
127
to
+128
| delegateChannelRef.activeStreamsCountIncr(); | ||
| Preconditions.checkState(countState.compareAndSet(0, 1)); |
Contributor
There was a problem hiding this comment.
If Preconditions.checkState throws an IllegalStateException because countState is already in an unexpected state, the active streams count will have already been incremented via delegateChannelRef.activeStreamsCountIncr(). Since the exception is thrown before entering the try-catch block, the incremented count is never decremented, leading to a permanent leak of the active streams count. Checking the state condition before incrementing the active streams count prevents this leak.
Suggested change
| delegateChannelRef.activeStreamsCountIncr(); | |
| Preconditions.checkState(countState.compareAndSet(0, 1)); | |
| Preconditions.checkState(countState.compareAndSet(0, 1)); | |
| delegateChannelRef.activeStreamsCountIncr(); |
Comment on lines
+263
to
+264
| channelRef.activeStreamsCountIncr(); | ||
| Preconditions.checkState(countState.compareAndSet(0, 1)); |
Contributor
There was a problem hiding this comment.
Similar to the issue in sendMessage, if Preconditions.checkState throws an IllegalStateException because countState is already in an unexpected state, the active streams count will have already been incremented via channelRef.activeStreamsCountIncr(). Since the exception is thrown before entering the try-catch block, the incremented count is never decremented, leading to a permanent leak of the active streams count. Checking the state condition before incrementing the active streams count prevents this leak.
Suggested change
| channelRef.activeStreamsCountIncr(); | |
| Preconditions.checkState(countState.compareAndSet(0, 1)); | |
| Preconditions.checkState(countState.compareAndSet(0, 1)); | |
| channelRef.activeStreamsCountIncr(); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync
agentic-identities-bound-tokenwith latestmain(27559f433ae), including the Maven 3.10.0.mvn/maven.configfixes (#14598, #14609).