Skip to content

chore(deps): bump the backend-dependencies group across 1 directory with 14 updates - #828

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/backend/backend-dependencies-e48c34017e
Open

chore(deps): bump the backend-dependencies group across 1 directory with 14 updates#828
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/backend/backend-dependencies-e48c34017e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the backend-dependencies group with 14 updates in the /backend directory:

Package From To
org.modelmapper:modelmapper 3.2.6 3.2.8
org.springdoc:springdoc-openapi-starter-webmvc-ui 2.9.0 2.10.0
org.apache.commons:commons-lang3 3.20.0 3.21.0
com.github.ben-manes.caffeine:caffeine 3.2.4 3.3.1
com.fasterxml.jackson.core:jackson-databind 2.22.2 2.22.4
io.grpc:grpc-netty-shaded 1.84.0 1.85.1
io.grpc:grpc-protobuf 1.84.0 1.85.1
io.grpc:grpc-stub 1.84.0 1.85.1
io.grpc:grpc-services 1.84.0 1.85.1
io.grpc:grpc-protobuf 1.84.0 1.85.1
io.grpc:grpc-stub 1.84.0 1.85.1
io.grpc:grpc-services 1.84.0 1.85.1
com.google.protobuf:protobuf-java 4.36.1 4.36.2
com.google.protobuf:protobuf-java-util 4.36.1 4.36.2
com.google.protobuf:protobuf-java-util 4.36.1 4.36.2
com.google.protobuf:protoc 4.36.1 4.36.2
io.grpc:protoc-gen-grpc-java 1.84.0 1.85.1
gradle-wrapper 8.14.5 8.14.6

Updates org.modelmapper:modelmapper from 3.2.6 to 3.2.8

Commits
  • bb16c31 [maven-release-plugin] prepare release modelmapper-parent-3.2.8
  • 524873e Update typetools to v0.7.0
  • c0d4ec6 [maven-release-plugin] prepare for next development iteration
  • 7103370 [maven-release-plugin] prepare release modelmapper-parent-3.2.7
  • 095fcdc Fix protobuf map fields using putAll instead of set
  • 152f712 Docs(README): Fix links for Java 8 and Record modules
  • b492e3d Preserve large floating-point values when converting to BigInteger
  • 671134b Bump dependency versions to support Java 27
  • 7f345d2 Add modelmapper-module-record
  • 14145e1 [maven-release-plugin] prepare for next development iteration
  • See full diff in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 2.9.0 to 2.10.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v2.10.0 released!

Spring Boot 3.5.x line (built on Spring Boot 3.5.16).

⚠️ Changes you may notice

  • Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
  • Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
  • Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

  • Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
  • Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
  • ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).

Fixed

  • @ResponseStatus on a controller class is applied to its operations (#3352).
  • An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
  • The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
  • WebAsyncTask return types are unwrapped (#3368).
  • A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
  • Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
  • Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Dependencies

swagger-ui 5.34.0 · Scalar 0.6.83 · Spring Cloud Function 4.2.4 · commons-lang3 3.21.0

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​Tework123, @​awinishere.

springdoc-openapi v2.9.1 released!

Security

  • GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
  • GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
  • CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

  • #3340 – Describe JsonNullable values without their Java wrapper
  • #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
  • #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

  • The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
  • Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
  • Document the security policy and the release versioning scheme
  • #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)

... (truncated)

Commits
  • 008bcb7 [maven-release-plugin] prepare release v2.10.0
  • 74e3b92 Describe the Java nullable property customizer flag in the configuration meta...
  • 1e37dac Correct the LocalTime format in the changelog entry of gh-3351
  • 13fb7aa Upgrade Scalar to 0.6.83
  • 8216c74 Upgrade commons-lang3 to 3.21.0
  • 687d3d0 Upgrade spring-cloud-function to 4.2.4
  • 7ab2a26 Upgrade swagger-ui to version 5.34.0
  • 6453845 Use the Jackson 2 managed by Spring Boot
  • 581aff4 Add an option to emit polymorphic oneOf unions as component refs
  • fda7502 Scope the Scalar filter to the Scalar starters
  • Additional commits viewable in compare view

Updates org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0

Updates com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.1

Release notes

Sourced from com.github.ben-manes.caffeine:caffeine's releases.

3.3.1

  • Added a workaround for ForkJoinPool queue corruption caused by resubmitting a reusable ForkJoinTask (#2021)
  • Improved JCache read performance when using access expiration
  • Fixed various minor issues found using AI audits

3.3.0

  • Improved read performance by avoiding false sharing in the fast-path check
  • Improved adaptive climber for small caches and shifting workloads
  • Fixed various minor issues found using AI audits
  • Fixed over-aggressive refresh discard (#1970)
Commits
  • aabb242 record the prefix-cache and warm-up findings
  • 0117302 stop JCache access expiry from writing every hit
  • 27fc6b8 skip rewriting an unchanged deadline on a read
  • 7f87a7e restore coverage lost to recent fixes
  • 75e2dc0 minor polish
  • 5155a5a use nullRef() for null futures rejected by NullAway's generic inference (#2023)
  • 998978c Avoid reusing a ForkJoinTask for maintenance (fixes #2021)
  • 6999bfd add the Qwen Bailian prefix-cache traces
  • 76dcbb5 fix canary test races and misc cleanups
  • 7f46a43 pad the eviction sizes off the hit path's lines
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.4

Commits
  • a56a810 [maven-release-plugin] prepare release jackson-databind-2.22.4
  • c172c5d Prep for 2.22.4 release
  • 1e761c0 Merge branch '2.21' into 2.22
  • fe3780f Post-release dep version bump
  • a0e1fad [maven-release-plugin] prepare for next development iteration
  • c92512e [maven-release-plugin] prepare release jackson-databind-2.21.8
  • 0a41b7c Prep for 2.21.8 release
  • ab63665 Remove stale empty 2.23.0 section from 2.22 release notes
  • 2b5a04b Merge branch '2.21' into 2.22
  • 3402e80 Merge branch '2.20' into 2.21
  • Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.85.1

What's Changed

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

  • netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
  • binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

  • xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
     

Bug Fixes

  •  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
  • core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
  • core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

  • netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
  • bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

  • api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

  • Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
  • netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

  • stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

... (truncated)

Commits
  • 54c634a Bump version to 1.85.1
  • fcedb64 Update README etc to reference 1.85.1
  • a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
  • f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
  • ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
  • af34f7f Bump version to 1.85.1-SNAPSHOT
  • 73a9039 Bump version to 1.85.0
  • 44ef493 Update README etc to reference 1.85.0
  • 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
  • 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-protobuf from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

v1.85.1

What's Changed

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

  • netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
  • binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

  • xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
     

Bug Fixes

  •  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
  • core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
  • core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

  • netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
  • bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

  • api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

  • Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
  • netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

  • stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

... (truncated)

Commits
  • 54c634a Bump version to 1.85.1
  • fcedb64 Update README etc to reference 1.85.1
  • a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
  • f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
  • ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
  • af34f7f Bump version to 1.85.1-SNAPSHOT
  • 73a9039 Bump version to 1.85.0
  • 44ef493 Update README etc to reference 1.85.0
  • 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
  • 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-stub's releases.

v1.85.1

What's Changed

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

  • netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
  • binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

  • xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
     

Bug Fixes

  •  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
  • core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
  • core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

  • netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
  • bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

  • api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

  • Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
  • netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

  • stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

... (truncated)

Commits
  • 54c634a Bump version to 1.85.1
  • fcedb64 Update README etc to reference 1.85.1
  • a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
  • f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
  • ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
  • af34f7f Bump version to 1.85.1-SNAPSHOT
  • 73a9039 Bump version to 1.85.0
  • 44ef493 Update README etc to reference 1.85.0
  • 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
  • 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-services from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-services's releases.

v1.85.1

What's Changed

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

  • netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
  • binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

  • xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
     

Bug Fixes

  •  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
  • core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
  • core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

  • netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
  • bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

  • api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

  • Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
  • netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

  • stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

... (truncated)

Commits
  • 54c634a Bump version to 1.85.1
  • fcedb64 Update README etc to reference 1.85.1
  • a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
  • f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
  • ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
  • af34f7f Bump version to 1.85.1-SNAPSHOT
  • 73a9039 Bump version to 1.85.0
  • 44ef493 Update README etc to reference 1.85.0
  • 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
  • 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-protobuf from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

v1.85.1

What's Changed

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

  • netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
  • binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

  • xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
     

Bug Fixes

  •  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
  • core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
  • core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

  • netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
  • bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

  • api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

  • Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
  • netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

  • stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

... (truncated)

Commits
  • 54c634a Bump version to 1.85.1
  • fcedb64 Update README etc to reference 1.85.1
  • a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
  • f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
  • ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
  • af34f7f Bump version to 1.85.1-SNAPSHOT
  • 73a9039 Bump version to 1.85.0
  • 44ef493 Update README etc to reference 1.85.0
  • 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
  • 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-stub's releases.

v1.85.1

What's Changed

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

  • netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
  • binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

  • xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
     

Bug Fixes

  •  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
  • core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
  • core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

  • netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
  • bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

  • api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

  • Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
  • netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

  • stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

... (truncated)

Commits
  • 54c634a Bump version to 1.85.1
  • fcedb64 Update README etc to reference 1.85.1
  • a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
  • f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
  • ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
  • af34f7f Bump version to 1.85.1-SNAPSHOT
  • 73a9039 Bump version to 1.85.0
  • 44ef493 Update README etc to reference 1.85.0
  • 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
  • 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-services from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-services's releases.

v1.85.1

What's Changed

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

  • netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
  • binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

  • xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
     

Bug Fixes

  •  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
  • core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE s...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 14, 2026
@coderabbitai

coderabbitai Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot
dependabot Bot force-pushed the dependabot/gradle/backend/backend-dependencies-e48c34017e branch from df3ea12 to abc9aef Compare October 20, 2026 15:35
@dependabot
chore(deps): bump the backend-dependencies group across 1 directory w…
94f29f9 
…ith 14 updates

Bumps the backend-dependencies group with 14 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [org.modelmapper:modelmapper](https://github.com/modelmapper/modelmapper) | `3.2.6` | `3.2.8` |
| [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://github.com/springdoc/springdoc-openapi) | `2.9.0` | `2.10.0` |
| org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` |
| [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) | `3.2.4` | `3.3.1` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.2` | `2.22.4` |
| [io.grpc:grpc-netty-shaded](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [io.grpc:grpc-protobuf](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [io.grpc:grpc-stub](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [io.grpc:grpc-services](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [io.grpc:grpc-protobuf](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [io.grpc:grpc-stub](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [io.grpc:grpc-services](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) | `4.36.1` | `4.36.2` |
| com.google.protobuf:protobuf-java-util | `4.36.1` | `4.36.2` |
| com.google.protobuf:protobuf-java-util | `4.36.1` | `4.36.2` |
| [com.google.protobuf:protoc](https://github.com/protocolbuffers/protobuf) | `4.36.1` | `4.36.2` |
| [io.grpc:protoc-gen-grpc-java](https://github.com/grpc/grpc-java) | `1.84.0` | `1.85.1` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `8.14.5` | `8.14.6` |



Updates `org.modelmapper:modelmapper` from 3.2.6 to 3.2.8
- [Changelog](https://github.com/modelmapper/modelmapper/blob/master/CHANGES.md)
- [Commits](modelmapper/modelmapper@modelmapper-parent-3.2.6...modelmapper-parent-3.2.8)

Updates `org.springdoc:springdoc-openapi-starter-webmvc-ui` from 2.9.0 to 2.10.0
- [Release notes](https://github.com/springdoc/springdoc-openapi/releases)
- [Changelog](https://github.com/springdoc/springdoc-openapi/blob/main/CHANGELOG.md)
- [Commits](springdoc/springdoc-openapi@v2.9.0...v2.10.0)

Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0

Updates `com.github.ben-manes.caffeine:caffeine` from 3.2.4 to 3.3.1
- [Release notes](https://github.com/ben-manes/caffeine/releases)
- [Commits](ben-manes/caffeine@v3.2.4...v3.3.1)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.2 to 2.22.4
- [Commits](FasterXML/jackson-databind@jackson-databind-2.22.2...jackson-databind-2.22.4)

Updates `io.grpc:grpc-netty-shaded` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `io.grpc:grpc-protobuf` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `io.grpc:grpc-stub` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `io.grpc:grpc-services` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `io.grpc:grpc-protobuf` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `io.grpc:grpc-stub` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `io.grpc:grpc-services` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `com.google.protobuf:protobuf-java` from 4.36.1 to 4.36.2
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `com.google.protobuf:protobuf-java-util` from 4.36.1 to 4.36.2

Updates `com.google.protobuf:protobuf-java-util` from 4.36.1 to 4.36.2

Updates `com.google.protobuf:protoc` from 4.36.1 to 4.36.2
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `io.grpc:protoc-gen-grpc-java` from 1.84.0 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.84.0...v1.85.1)

Updates `gradle-wrapper` from 8.14.5 to 8.14.6
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v8.14.5...v8.14.6)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: com.github.ben-manes.caffeine:caffeine
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: com.google.protobuf:protobuf-java
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: com.google.protobuf:protobuf-java-util
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: com.google.protobuf:protobuf-java-util
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: com.google.protobuf:protoc
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: gradle-wrapper
  dependency-version: 8.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:grpc-protobuf
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:grpc-protobuf
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:grpc-services
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:grpc-services
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:grpc-stub
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:grpc-stub
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: io.grpc:protoc-gen-grpc-java
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: org.modelmapper:modelmapper
  dependency-version: 3.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: org.springdoc:springdoc-openapi-starter-webmvc-ui
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/gradle/backend/backend-dependencies-e48c34017e branch from abc9aef to 94f29f9 Compare October 27, 2026 15:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants