[dependabot]

Bumps the maven-dependencies group with 3 updates: io.grpc:grpc-bom, com.google.guava:guava and org.sonatype.central:central-publishing-maven-plugin.

Updates io.grpc:grpc-bom from 1.84.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-bom's releases.

v1.85.1

What's Changed

• netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x backport) by @​AgraVator in grpc/grpc-java#13120
• core: Delayed deserialization for unary/server-streaming calls (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13132
• xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13133

v1.85.0

gRPC Java 1.85.0 Release Notes

API Changes

• netty: Support never-indexed metadata keys (#12976) (e9a8c2bf83). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
• binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

• xds: allow wildcard listener port in LDS (5fda0c7c35). It now accepts a port of 0 in the LDS listener address as matching any port.
   

Bug Fixes

•  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#13015) (e58489ffa0). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
• core: Reset configSelector on realChannel while entering IDLE state (#12832) (fc4314419d). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
• core: Gracefully handle GOAWAY frames with unrecognized error codes (#13035) (b3ae8010c9). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

• netty: make hostname verification configurable (#13002) (2858db2862). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
• bazel: Adopt proto_lang_toolchain for java_grpc_library() (#12994) (c9ee3f8a79). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

• api: Implement custom events framework in gRPC-Java server (#12980) (dd00881a6e). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

• Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#13013) (9799887b74)
• netty: Upgrade Netty to 4.2.17 (#13036) (61b910bb43). netty-tcnative remains at 2.0.81.

Documentation

• stub: Clarify flow control javadoc (#12977) (893eb70807)

 

Thanks to

@​kkalin68

@​petedmarsh

... (truncated)

Commits

• 54c634a Bump version to 1.85.1
• fcedb64 Update README etc to reference 1.85.1
• a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
• f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
• ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
• af34f7f Bump version to 1.85.1-SNAPSHOT
• 73a9039 Bump version to 1.85.0
• 44ef493 Update README etc to reference 1.85.0
• 4d0d548 api: move ATTR_ADDRESS_NAME to EquivalentAddressGroup (#13072)
• 9e0ff28 xds: fix TSAN data race in ext_proc client interceptor test cleanup (#13071)
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.7.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

Commits

• See full diff in compare view

Updates org.sonatype.central:central-publishing-maven-plugin from 0.11.0 to 0.12.0

Release notes

Sourced from org.sonatype.central:central-publishing-maven-plugin's releases.

release-0.12.0

What's Changed

• feat: add skipUpload property to build the bundle without uploading it by @​madpah in sonatype-nexus-community/central-publishing-maven-plugin#6
• fix: remove local repository files from the bundle on Maven 3.10 by @​madpah in sonatype-nexus-community/central-publishing-maven-plugin#3

Full Changelog: sonatype-nexus-community/central-publishing-maven-plugin@release-0.11.1...release-0.12.0

0.11.1

This is the same source as for release 0.11.0, but now open-sourced under Apache-2.0 license.

Full Changelog: https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/commits/release-0.11.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[gaugebot]

@dependabot[bot] Thank you for contributing to gauge-java. Your pull request has been labeled as a release candidate 🎉🎉.

Merging this PR will trigger a release.

Please bump up the version as part of this PR.

Instructions to bump the version can found at CONTRIBUTING.md

If the CONTRIBUTING.md file does not exist or does not include instructions about bumping up the version, please looks previous commits in git history to see what changes need to be done.