[12.0.x Root pom] Bump the dev-dependencies group across 1 directory with 33 updates

[dependabot]

Bumps the dev-dependencies group with 33 updates in the / directory:

Package	From	To
com.fasterxml.jackson:jackson-bom	2.22.1	2.22.2
io.netty:netty-bom	4.2.16.Final	4.2.17.Final
ch.qos.logback:logback-core	1.5.38	1.6.3
ch.qos.logback:logback-classic	1.5.38	1.6.3
com.google.guava:guava	33.6.0-jre	33.7.1-jre
commons-codec:commons-codec	1.22.0	1.22.1
io.grpc:grpc-core	1.82.2	1.83.1
io.grpc:grpc-netty-shaded	1.82.2	1.83.1
io.smallrye.common:smallrye-common-annotation	2.19.0	2.20.0
io.smallrye.common:smallrye-common-cpu	2.19.0	2.20.0
org.bouncycastle:bctls-jdk18on	1.84	1.85
org.bouncycastle:bcpkix-jdk18on	1.84	1.85
org.bouncycastle:bcprov-jdk18on	1.84	1.85
org.bouncycastle:bcutil-jdk18on	1.84	1.85
org.codehaus.plexus:plexus-classworlds	2.12.0	2.12.1
org.codehaus.plexus:plexus-utils	4.0.3	4.1.0
org.codehaus.plexus:plexus-xml	4.1.1	4.2.0
org.conscrypt:conscrypt-openjdk-uber	2.6.0	2.6.3
org.eclipse.sisu:org.eclipse.sisu.inject	1.0.1	1.1.0
org.eclipse.sisu:org.eclipse.sisu.plexus	1.0.1	1.1.0
org.mariadb.jdbc:mariadb-java-client	3.5.9	3.5.10
org.eclipse.jetty.toolchain:jetty-build-support	1.5	1.6
eu.maveniverse.maven.njord:extension3	0.9.9	0.9.10
eu.maveniverse.maven.plugins:njord	0.9.9	0.9.10
org.apache.maven.extensions:maven-build-cache-extension	1.2.3	1.3.0
org.cyclonedx:cyclonedx-maven-plugin	2.9.2	2.9.3
org.apache.directory.api:api-asn1-api	2.1.7	2.1.8
org.apache.directory.api:api-ldap-model	2.1.7	2.1.8
org.apache.directory.api:api-ldap-schema-data	2.1.7	2.1.8
org.apache.directory.api:api-util	2.1.7	2.1.8
com.google.jimfs:jimfs	1.3.1	1.3.2
com.google.protobuf:protobuf-java	4.35.0	4.36.0
eu.maveniverse.maven.mimir:extension3	0.12.0	0.12.1

Updates com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2

Commits

• 062d76d [maven-release-plugin] prepare release jackson-bom-2.22.2
• dcf18f7 Prep for 2.22.2 release
• 9688c7b Merge branch '2.21' into 2.22
• 7796a7d Merge branch '2.20' into 2.21
• d3cd7fc Merge branch '2.19' into 2.20
• 7a28068 Merge branch '2.18' into 2.19
• 51eb465 Post-release dep version bump
• 34ff5e8 [maven-release-plugin] prepare for next development iteration
• 0b44a45 [maven-release-plugin] prepare release jackson-bom-2.18.10
• 691ec93 Prep for 2.18.10 release
• Additional commits viewable in compare view

Updates io.netty:netty-bom from 4.2.16.Final to 4.2.17.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.17.Final

What's Changed

• AsciiString.cached(String) should sanitize the provided String (#13749) by @​vpelikh in netty/netty#17007
• Fix deploy workflow by @​normanmaurer in netty/netty#17071
• Fix AsciiString.cached(String) performance regression by @​dreamlike-ocean in netty/netty#17074
• SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by @​normanmaurer in netty/netty#17059
• Avoid leak presence detector in leak profile by @​yawkat in netty/netty#17073
• Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by @​reta in netty/netty#17068
• IoUring: preserve readPending when rescheduling cancelled reads by @​dreamlike-ocean in netty/netty#17087
• Reject negative maxOrder in PooledByteBufAllocator by @​coderbruis in netty/netty#17093
• Fix AdaptiveByteBuf._setLongLE calling checked setLongLE by @​franz1981 in netty/netty#17098
• Snappy: Guard decoder against invalid chunk lengths by @​yawkat in netty/netty#17099
• Fix OCSP Tests by @​chrisvest in netty/netty#17114
• Update to latest netty-tcnative release by @​normanmaurer in netty/netty#17056
• Use safe decompressor in Lz4FrameDecoder by @​yawkat in netty/netty#17118
• Configure TestLens for the PR builds by @​chrisvest in netty/netty#17129
• IoUring: add SO_INQ support for Unix domain sockets by @​dreamlike-ocean in netty/netty#17127
• fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by @​ChunMengLu in netty/netty#17117
• Propagate the CI envionment variables through to the docker builds by @​chrisvest in netty/netty#17138
• Codec-compression: Add decompressor API by @​yawkat in netty/netty#16745
• Fix silent failures and optimize error short-circuit in multi-threaded tests by @​rajan-github in netty/netty#17106
• Codec-compression: Add Bzip2Decompressor by @​yawkat in netty/netty#17145
• Fix buddy cache evicting chunks with live buffers by @​franz1981 in netty/netty#17154
• Codec-compression: Add Snappy frame decompressor by @​yawkat in netty/netty#17153
• Codec-compression: Add zlib decompressors by @​yawkat in netty/netty#17155
• Codec-compression: Add Zstd decompressor by @​yawkat in netty/netty#17152
• Codec-compression: Add LZF decompressor by @​yawkat in netty/netty#17147
• Codec-compression: Add BrotliDecompressor by @​yawkat in netty/netty#17146
• Codec-compression: Add Lz4FrameDecompressor by @​yawkat in netty/netty#17148
• HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak when a Throwable is thrown during header encoding by @​HwangRock in netty/netty#17089
• Fix direct memory OOM on low-core containers by @​franz1981 in netty/netty#17166
• IoUring: Fix the recvmmsg emulation by @​dreamlike-ocean in netty/netty#17187
• Avoid classloader leak via GlobalEventExecutor terminationFuture failure by @​seonwooj0810 in netty/netty#17140
• BrotliEncoder: Prevent duplicate close scheduling by @​yawkat in netty/netty#17175
• Fix JdkZlibDecompressor losing the tail of highly compressible streams by @​renechoi in netty/netty#17191
• Update compress-lzf to 1.2.1 by @​yawkat in netty/netty#17194
• Do not write WebSocket handshake response to the tail of the pipeline by @​el-psy-kongroo-d in netty/netty#17192
• HttpServerCodec: do not consume the method queue for 1xx interim responses by @​HwangRock in netty/netty#17182
• Weakly reference engines from the OpenSSL engine map by @​bryce-anderson in netty/netty#17199
• OpenSSL: Allow to obtain used named group via OpenSslSession by @​normanmaurer in netty/netty#17058
• Add .editorconfig to enforce consistent coding style by @​vpelikh in netty/netty#17052
• Update surefire plugin to latest version by @​normanmaurer in netty/netty#17210
• Merge changes from forks by @​chrisvest in netty/netty#17213

New Contributors

• @​vpelikh made their first contribution in netty/netty#17007
• @​ChunMengLu made their first contribution in netty/netty#17117
• @​rajan-github made their first contribution in netty/netty#17106
• @​seonwooj0810 made their first contribution in netty/netty#17140
• @​renechoi made their first contribution in netty/netty#17191

... (truncated)

Commits

• e0789d3 [maven-release-plugin] prepare release netty-4.2.17.Final
• 1b5abc6 Merge changes from forks (#17213)
• 36fbf57 Update surefire plugin to latest version (#17210)
• a96226c Add .editorconfig to enforce consistent coding style (#17052)
• 14a4e6a OpenSSL: Allow to obtain used named group via OpenSslSession (#17058)
• 26255b1 Weakly reference engines from the OpenSSL engine map (#17199)
• ae41417 HttpServerCodec: do not consume the method queue for 1xx interim responses ...
• 41f1db5 Do not write WebSocket handshake response to the tail of the pipeline (#17192)
• 035d76e Update compress-lzf to 1.2.1 (#17194)
• 7681aff Fix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.5.38 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.38 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

• CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.

•         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.
  

Changes

•         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.
  

•         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.
  

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

---

Commits

• dc8f6c8 Prepare for the release candidate 1.22.1 RC1
• 8203c1c Prepare for the next release candidate
• 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
• 00c27a9 Reduce vertical whitespace
• 568f2d7 Remove unused method
• 316fb15 Remove unused method
• bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
• e14cdfe Extract redundant code.
• 3351e63 Add messages when throwing NullPointerException.
• f22dab7 Update SCM tag
• Additional commits viewable in compare view

Updates io.grpc:grpc-core from 1.82.2 to 1.83.1

Release notes

Sourced from io.grpc:grpc-core's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
• core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
• core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
• Upgrade various dependencies (064272c61d):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits

• 8f621c0 Bump version to 1.83.1
• 2bafe5e Update README etc to reference 1.83.1
• e1f2dbd netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83....
• ee8232f core: Coalesce Contiguous Small Buffers for ReadableBuffer (v1.83.x backport)...
• b4ca099 Fix docker tagging failure in upload_artifacts by using stable tag name (#12922)
• b4fb7f4 build: Allow downloading pkgconfiglite with empty checksum
• 1fbfa86 Bump version to 1.83.1-SNAPSHOT
• 8ab6e0a Bump version to 1.83.0
• 33ad6a4 Update README etc to reference 1.83.0
• 17d5bd6 Revert "enable child channel plugins (#12578)" (v1.83.x backport) (#12913)
• Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.82.2 to 1.83.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
• core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
• core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
• Upgrade various dependencies (064272c61d):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits

• 8f621c0 Bump version to 1.83.1
• 2bafe5e Update README etc to reference 1.83.1
• e1f2dbd netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83....
• ee8232f core: Coalesce Contiguous Small Buffers for ReadableBuffer (v1.83.x backport)...
• b4ca099 Fix docker tagging failure in upload_artifacts by using stable tag name (#12922)
• b4fb7f4 build: Allow downloading pkgconfiglite with empty checksum
• 1fbfa86 Bump version to 1.83.1-SNAPSHOT
• 8ab6e0a Bump version to 1.83.0
• 33ad6a4 Update README etc to reference 1.83.0
• 17d5bd6 Revert "enable child channel plugins (#12578)" (v1.83.x backport) (#12913)
• Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.82.2 to 1.83.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
• core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
• core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
• Upgrade various dependencies (064272c61d):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits

• 8f621c0 Bump version to 1.83.1
• 2bafe5e Update README etc to reference 1.83.1
• e1f2dbd netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83....
• ee8232f core: Coalesce Contiguous Small Buffers for ReadableBuffer (v1.83.x backport)...
• b4ca099 Fix docker tagging failure in upload_artifacts by using stable tag name (#12922)
• b4fb7f4 build: Allow downloading pkgconfiglite with empty checksum

[olamy]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with jetty-12.0.x! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.