chore(deps): bump the version-updates group with 6 updates by dependabot[bot] · Pull Request #156 · qdrant/java-client

dependabot · 2026-09-11T04:44:05Z

Bumps the version-updates group with 6 updates:

Package	From	To
com.uber.nullaway:nullaway	`0.14.0`	`0.14.1`
io.grpc:grpc-protobuf	`1.83.1`	`1.84.0`
io.grpc:grpc-stub	`1.83.1`	`1.84.0`
io.grpc:grpc-netty-shaded	`1.83.1`	`1.84.0`
io.grpc:grpc-testing	`1.83.1`	`1.84.0`
io.grpc:protoc-gen-grpc-java	`1.83.1`	`1.84.0`

Updates com.uber.nullaway:nullaway from 0.14.0 to 0.14.1

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.14.1

Several bug fixes in this release, particularly for JSpecifyExperimental. Thanks to all who tested out this mode, reported bugs, and contributed! Please continue to test and send feedback. See the 0.14.0 release notes below for more information on JSpecifyExperimental.

Fix restoring nullness annotations from an unbounded wildcard to a captured type (#1717)

JSpecify: support anonymous diamond classes by @subhramit (#1710)

Fix attribute errors reported during dataflow (#1736)

Apply library models to an overridden method type when checking overrides (#1722)

Deduplicate generic inference failure warnings (#1741)

Preserve nested nullness annotations through inheritance (#1742)

Fix crash for generic qualifiers in method references (#1744)

Cache immutable stubx library models (#1745)

Allow nullable method references for void functions (#1747)

Preserve nested nullness in enhanced-for variable types (#1748)

Track nullable elements in enhanced-for dataflow (#1749)

Honor ignored methods in null-marked library models (#1753)

Avoid crashes on malformed @Contract arity (fixes #1726) (#1756)

Inherit null-implies-null models across overrides (#1758)

Fix inference for annotated type variable uses (#1759)

Preserve contract unreachability across store joins (#1761)

Prevent recursion on self-referential wildcard bounds (#1763)

Work around pre-JDK-25 limitations in reading upper bounds from wildcard arguments in bytecode (#1764)

Improve diagnostics for non-null type variable bounds (#1770)

Fix override checks for method type variables bounded by a class type variable by @pivovarit (#1775)

Maintenance

Migrate FrameworkTests to addSourceLines by @abdeltaehass (#1712)

Attribute errors reported during dataflow to the right file by @vlsi (#1734)

Disable CodeRabbit summaries (#1755)

Add tests for overrides of Collection.toArray (#1757)

Assert the full set of diagnostics for annotated type-variable uses by @vlsi (#1768)

Document that a nullImpliesNull model applies to overriding methods by @vlsi (#1771)

Add tests for the JSpecify nullness operator by @vlsi (#1767)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.14.1

Several bug fixes in this release, particularly for JSpecifyExperimental. Thanks to all who tested out this mode, reported bugs, and contributed! Please continue to test and send feedback. See the 0.14.0 release notes below for more information on JSpecifyExperimental.

Fix restoring nullness annotations from an unbounded wildcard to a captured type (#1717)

JSpecify: support anonymous diamond classes by @subhramit (#1710)

Fix attribute errors reported during dataflow (#1736)

Apply library models to an overridden method type when checking overrides (#1722)

Deduplicate generic inference failure warnings (#1741)

Preserve nested nullness annotations through inheritance (#1742)

Fix crash for generic qualifiers in method references (#1744)

Cache immutable stubx library models (#1745)

Allow nullable method references for void functions (#1747)

Preserve nested nullness in enhanced-for variable types (#1748)

Track nullable elements in enhanced-for dataflow (#1749)

Honor ignored methods in null-marked library models (#1753)

Avoid crashes on malformed @Contract arity (fixes #1726) (#1756)

Inherit null-implies-null models across overrides (#1758)

Fix inference for annotated type variable uses (#1759)

Preserve contract unreachability across store joins (#1761)

Prevent recursion on self-referential wildcard bounds (#1763)

Work around pre-JDK-25 limitations in reading upper bounds from wildcard arguments in bytecode (#1764)

Improve diagnostics for non-null type variable bounds (#1770)

Fix override checks for method type variables bounded by a class type variable by @pivovarit (#1775)

Maintenance

Migrate FrameworkTests to addSourceLines by @abdeltaehass (#1712)

Attribute errors reported during dataflow to the right file by @vlsi (#1734)

Disable CodeRabbit summaries (#1755)

Add tests for overrides of Collection.toArray (#1757)

Assert the full set of diagnostics for annotated type-variable uses by @vlsi (#1768)

Document that a nullImpliesNull model applies to overriding methods by @vlsi (#1771)

Add tests for the JSpecify nullness operator by @vlsi (#1767)

Commits

b3d442a Prepare for release 0.14.1.
d6df98b Release notes for 0.14.1 (#1784)
ecb763e fix override checks for method type variables bounded by a class type variabl...
915b287 Add tests for the JSpecify nullness operator (#1767)
f142e85 Improve diagnostics for non-null type variable bounds (#1770)
bb5cf51 Work around pre-JDK-25 limitations in reading upper bounds from wildcard argu...
17d7ca7 Document that a nullImpliesNull model applies to overriding methods (#1771)
cc156e4 Assert the full set of diagnostics for annotated type-variable uses (#1768)
b9efa0f Prevent recursion on self-referential wildcard bounds (#1763)
177ad18 Preserve contract unreachability across store joins (#1761)
Additional commits viewable in compare view

Updates io.grpc:grpc-protobuf from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-stub's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-testing from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-testing's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:protoc-gen-grpc-java from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:protoc-gen-grpc-java's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-stub's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e...
Description has been truncated

Bumps the version-updates group with 6 updates: | Package | From | To | | --- | --- | --- | | [com.uber.nullaway:nullaway](https://github.com/uber/NullAway) | `0.14.0` | `0.14.1` | | [io.grpc:grpc-protobuf](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [io.grpc:grpc-stub](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [io.grpc:grpc-netty-shaded](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [io.grpc:grpc-testing](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [io.grpc:protoc-gen-grpc-java](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | Updates `com.uber.nullaway:nullaway` from 0.14.0 to 0.14.1 - [Release notes](https://github.com/uber/NullAway/releases) - [Changelog](https://github.com/uber/NullAway/blob/master/CHANGELOG.md) - [Commits](uber/NullAway@v0.14.0...v0.14.1) Updates `io.grpc:grpc-protobuf` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-stub` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-netty-shaded` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-testing` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:protoc-gen-grpc-java` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-stub` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-netty-shaded` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-testing` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:protoc-gen-grpc-java` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) --- updated-dependencies: - dependency-name: com.uber.nullaway:nullaway dependency-version: 0.14.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: version-updates - dependency-name: io.grpc:grpc-protobuf dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:grpc-stub dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:grpc-netty-shaded dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:grpc-testing dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:protoc-gen-grpc-java dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:grpc-stub dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:grpc-netty-shaded dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:grpc-testing dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates - dependency-name: io.grpc:protoc-gen-grpc-java dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 11, 2026

Anush008 merged commit 4f6414d into master Sep 11, 2026
2 checks passed

Anush008 deleted the dependabot/gradle/version-updates-a2b67244de branch September 11, 2026 06:08

Navigation Menu

Uh oh!

chore(deps): bump the version-updates group with 6 updates - #156

chore(deps): bump the version-updates group with 6 updates#156
Anush008 merged 1 commit into
masterfrom
dependabot/gradle/version-updates-a2b67244de

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 11, 2026

NullAway 0.14.1

Version 0.14.1

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant