[317787106]

What does this PR do?

• Upgrade gRPC from 1.83.1 to 1.85.0 and Netty from 4.2.15.Final to 4.2.19.Final.
• Import netty-bom in :protocol and :p2p so transitive grpc-netty modules and the directly declared protobuf codec resolve consistently to 4.2.19.Final. In particular, netty-codec-http2 no longer remains at 4.2.17.Final.
• Refresh Gradle verification metadata for the selected gRPC and Netty artifacts, including gRPC code generators for Linux ARM64, macOS ARM64, and Intel macOS. Remove obsolete gRPC 1.83.1/1.85.1 and Netty 4.2.15/4.2.17 entries.
• Retain the original real-Netty regression test for rejected multi-message unary calls.

Why are these changes required?

Dependency vulnerability review identified Netty findings in the current 4.8.3 dependency set. A version-only upgrade left netty-codec-http2:4.2.17.Final in :protocol; the BOM aligns it with the patched Netty version.

gRPC is set to 1.85.0 after review of the delayed unary/server-streaming deserialization change added in 1.85.1. This keeps the existing admission timing and the real-transport unary regression test while the impact of that upstream change is assessed separately.

This PR has been tested by:

• Local macOS ARM64 / JDK 17: strict dependency verification and ./gradlew --dependency-verification=strict :framework:distZip :plugins:distZip :p2p:buildStandaloneJar passed.
• Strict resolution of the gRPC 1.85.0 runtime artifacts and Linux ARM64, macOS ARM64, and Intel macOS code generators passed.
• Five focused framework gRPC/HTTP2/admission test classes passed: 22 tests, 0 failures. The restored real-Netty multi-message unary test also passed three uncached local runs.
• :p2p:test passed: 549 tests, 0 failures, 4 skipped. :framework:checkstyleTest and git diff --check passed.
• The framework and plugins distributions contain gRPC 1.85.0 and only Netty 4.2.19.Final JARs. The full repository test suite and a post-change Dependency-Check scan have not been completed locally; see CI for the supported JDK/platform matrix.

Extra details

No Protobuf schemas or consensus/business rules are changed.

[waynercheung]

The Netty BOM resolves the earlier version-alignment issue. I verified that the Netty modules in the :framework, :p2p and :protocol runtime classpaths resolve to 4.2.19.Final. The missing Intel macOS verification entry remains a merge blocker.

[SHOULD] Please document the observable transport and admission changes introduced by grpc/grpc-java#13132 in the PR description and release notes, and clarify that protobuf schemas and business rules remain unchanged:

• Unary parsing and admission rejection are deferred until half-close.
• Multi-message unary calls can be cancelled before admission runs, so they do not increment the admission rejection counter.

Describing this only as a transport race is incomplete.

[DISCUSS] The failing test alone does not establish that the admission guard must move. Requests that reach protobuf parsing still pass through the guarded marshaller; calls cancelled earlier may never invoke it. Neither changing interceptor order nor using ServerInterceptors.useInputStreamMessages makes message inspection run before gRPC's deferred delivery. If immediate rejection upon complete-message arrival is required, that needs a separate design evaluation.

[317787106]

@waynercheung Thanks for the distinction. Current head 7e0dd0e uses gRPC 1.85.0 and restores the real-Netty unary regression test, so the delayed-deserialization behavior introduced by grpc/grpc-java#13132 in 1.85.1 is no longer part of this PR. The PR description now records that choice and flags the omitted upstream mitigation for separate security assessment. We have not moved the admission guard or changed interceptor order, Protobuf schemas, or business rules. The Netty BOM still resolves 4.2.19, and the 1.85.0 Intel macOS generator checksum is present and passed strict artifact resolution. Cross-platform CI is still running; we are not claiming that all dependency findings are resolved.

[waynercheung]

Thanks, the earlier items are resolved on 7e0dd0e:

• The Intel macOS generator checksum is present; all 50 new checksums match Maven Central and no stale gRPC/Netty entries remain.
• :framework, :p2p, :plugins and :protocol resolve only gRPC 1.85.0 and Netty 4.2.19.Final.
• The original real-Netty test is restored unchanged.
• Locally on JDK 17, 659 framework gRPC/HTTP2/admission tests and 549 :p2p tests pass. Multi-message unary probes over plain and gzip are rejected once with INVALID_ARGUMENT without reaching the handler. CI is green.

[NIT] Non-blocking: please track the grpc/grpc-java#13132 assessment (issue or security tracker) before upgrading past 1.85.0, and consider running laterMessagesOnARejectedUnaryCallAreIgnored over gzip as well.