chore(deps): update upper bound dependencies file

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
com.google.auth:google-auth-library-bom	1.53.0 → 1.54.0
com.google.cloud:grpc-gcp (source)	1.16.0 → 1.17.0
com.google.crypto.tink:tink	1.23.0 → 1.24.0
com.google.guava:guava	33.7.1-jre → 33.7.2-jre
commons-codec:commons-codec (source)	1.22.1 → 1.23.0
io.grpc:grpc-bom	1.84.0 → 1.85.0
io.opentelemetry:opentelemetry-bom	1.66.0 → 1.67.0
org.apache.httpcomponents.client5:httpclient5 (source)	5.6.4 → 5.6.5
org.threeten:threeten-extra (source)	1.10.0 → 1.11.0
org.threeten:threetenbp (source)	1.7.4 → 1.7.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

googleapis/google-cloud-java (com.google.cloud:grpc-gcp)

v1.17.0

Compare Source

⚠ BREAKING CHANGES

• [analyticsadmin] update the ReportingAttributionModel enum to rename CROSS_CHANNEL_DATA_DRIVEN to PAID_AND_ORGANIC_CHANNELS_DATA_DRIVEN, CROSS_CHANNEL_LAST_CLICK to PAID_AND_ORGANIC_CHANNELS_LAST_CLICK, CROSS_CHANNEL_FIRST_CLICK to `P... (#​9705)
• [analyticsadmin] update the ReportingAttributionModel enum to rename CROSS_CHANNEL_DATA_DRIVEN to PAID_AND_ORGANIC_CHANNELS_DATA_DRIVEN, CROSS_CHANNEL_LAST_CLICK to PAID_AND_ORGANIC_CHANNELS_LAST_CLICK, CROSS_CHANNEL_FIRST_CLICK to `P... (#​9706)

Features

• [advisorynotifications] adding notification types to advisorynotifications.googleapis.com libraries (#​9716) (43f4842)
• [aiplatform] add RaySepc to ResourceRuntimeSpec, and add ResourceRuntime to PersistentResource (#​9674) (f7a6838)
• [alloydb connectors] new module for alloydb connectors (#​9737) (bb4271e)
• [batch] Add comment to the unsupported order_by field of ListTasksRequest (#​9684) (c27566e)
• [batch] Clarify Batch API proto doc about pubsub notifications (#​9741) (e580ede)
• [bigquerydatatransfer] add EncryptionConfiguration to TransferConfig (#​9717) (dbed6d2)
• [cloudbuild] add update_mask to UpdateBuildTriggerRequest proto (#​9704) (4659951)
• [cloudcommerceconsumerprocurement] Consumer Procurement API v1 (#​9681) (4814ee4)
• [clouddeploy] added support for predeploy and postdeploy actions (#​9708) (46dcfbe)
• [compute] Update Compute Engine API to revision 2023071 (#​836) (#​9696) (0f6b9f2)
• [confidentialcomputing] Added support for signed container image and custom audience and nonce requests (#​9701) (c5c0b87)
• [confidentialcomputing] Mark all fields Optional for ContainerImageSignagure proto (#​9736) (39a8e82)
• [container] add policy_name to PlacementPolicy message within a node pool (#​9676) (a0715a8)
• [datacatalog] add support for admin_search in SearchCatalog() API method (#​9728) (aee140e)
• [dataplex] new service DataTaxonomyService and related messages (#​9688) (205f373)
• [datastream] Add precision and scale to MysqlColumn (#​9677) (fd13336)
• [discoveryengine] support conversational / multi-turn search (#​9710) (e1fba2b)
• [documentai] exposed Import PV external_processor_version_source to v1beta3 public (#​9697) (3e685df)
• [netapp] add initial version of NetApp v1 APIs (#​9713) (1ecb036)
• [netapp] add RestrictedAction to Volume (#​9734) (d05cb98)
• [servicemanagement] Add a proto message to describe the resource_type and resource_permission for an API method (#​9687) (2c7313c)
• [tpu] Add spot tier in v2alpha Create QueuedResource API request (#​9686) (cbf3dd5)
• [translate] Added shadow removal and rotation correction options to Document Translation and Batch Document Translation API (#​9740) (2b945d1)

Bug Fixes

• [analyticsadmin] update the ReportingAttributionModel enum to rename CROSS_CHANNEL_DATA_DRIVEN to PAID_AND_ORGANIC_CHANNELS_DATA_DRIVEN, CROSS_CHANNEL_LAST_CLICK to PAID_AND_ORGANIC_CHANNELS_LAST_CLICK, CROSS_CHANNEL_FIRST_CLICK to `P... (#​9705) (52c03af)
• [analyticsadmin] update the ReportingAttributionModel enum to rename CROSS_CHANNEL_DATA_DRIVEN to PAID_AND_ORGANIC_CHANNELS_DATA_DRIVEN, CROSS_CHANNEL_LAST_CLICK to PAID_AND_ORGANIC_CHANNELS_LAST_CLICK, CROSS_CHANNEL_FIRST_CLICK to `P... (#​9706) (f62e341)
• [dataplex] remove unused annotation in results_table (#​9739) (037b24a)
• deps: update dependency com.google.cloud:google-cloud-pubsub-bom to v1.123.19 (#​9690) (7f43cb6)
• deps: update dependency com.google.cloud:google-cloud-pubsub-bom to v1.123.20 (#​9699) (2f431cd)
• deps: update dependency com.google.cloud:google-cloud-pubsub-bom to v1.124.0 (#​9709) (1230b77)
• deps: update dependency com.google.cloud:google-cloud-shared-dependencies to v3.14.0 (#​9722) (c7011db)
• deps: update dependency com.google.cloud:google-cloud-storage to v2.25.0 (#​9682) (db953a0)
• remove netapp v1beta1 project remnants (#​9729) (967bee2)

Documentation

• [analyticsdata] Minor formatting (#​9738) (47fbbd6)
• [cloudkms] Minor formatting (#​9726) (94a00ba)
• [cloudtasks] minor formatting (#​9683) (9ebc18f)
• [datacatalog] Minor formatting (#​9718) (5103a7a)
• [dataproc] Minor formatting (#​9721) (c14b376)
• [dialogflow] Minor formatting (#​9719) (c26f79b)
• [dialogflow] Minor formatting (#​9731) (c5ac114)
• [gke-backup] Minor formatting (#​9725) (d3a4a76)
• [translate] Minor formatting (#​9712) (09a957d)

tink-crypto/tink-java (com.google.crypto.tink:tink)

v1.24.0: Tink Java v1.24.0

Tink is a multi-language, cross-platform library that provides simple and
misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.24.0

The complete list of changes since 1.23.0 can be found here.

New Features

• APIs which depend on what algorithms are registered now have an overload taking a configuration argument. Using these overloads allows to ensure that behavior is independent of what else is linked in the binary. For example, instead of keysetHandle.getPrimitive(Aead.class), users can now write keysetHandle.getPrimitive(TinkConfig2026.get(), Aead.class). Similary for key generation and serialization of keysets.

  The following configs are available: AeadConfig2026 (which does not contain the KMS algorithms; use KmsAeadConfig2026 for those), DeterministicAeadConfig2026, HybridConfig2026, JwtConfig2026, KeyDerivationConfig2026, MacConfig2026, PrfConfig2026, SignatureConfig2026, StreamingAeadConfig2026. In addition, TinkConfig2026 contains all of the above algorithms (except the KMS algorithms). Finally, RegistryConfiguration.java is available to make previous behavior (examining the registered algorithms) explicit.

  Finally, the Configuration interface needed to implement new behavior is completely public, and users can implement it themselves.

• Added support for JWT ML-DSA signatures.

• Added support for MLDSA44-Ed25519-SHA512 and MLDSA65-Ed25519-SHA512 Composite ML-DSA algorithms.

• X-Wing HPKE is now also available on Android. In particular, it is available natively on Android 17 (or above), or otherwise on Android 12 (or above) with SDK Extensions version 22 or later.

• Added predefined HPKE parameters.

• Added the Prehash primitive interface for computing prehashes of messages, to support the prehash-and-sign paradigm (such as ML-DSA External Mu).

• Updated 'org.conscrypt:conscrypt-openjdk-uber' to version 2.7.0.

Changes

• Changed the named parameter name for SLH-DSA-SHA2-128S with Tink output prefix type from SLH_DSA_SHA2_128S_TINK to SLH_DSA_SHA2_128S for consistency with the other Tink languages.
• In SignaturePemKeysetReader, treat Base64 decoding failures like other PEM key parsing errors.
• In SignaturePemKeysetReader, continue parsing multi-key PEM bundles after encountering an unparsable key.
• In SignaturePemKeysetReader, preserve the parsed RSA public exponent when importing RSA public keys instead of hardcoding 65537 (F4).
• Fixed unchecked runtime exceptions in JwkSetConverter.toPublicKeysetHandle and SignatureJwkSetConverter.toPublicKeysetHandle when importing malformed JWK sets, ensuring they consistently throw a GeneralSecurityException.
• Validate coordinate lengths against curve field size in JwkSetConverter and SignatureJwkSetConverter.
• Fixed unchecked runtime exceptions in JsonKeysetReader.read and JsonKeysetReader.readEncrypted when reading malformed keysets, ensuring they consistently throw an IOException.
• AesGcmSiv now uses Conscrypt if it's available on the class path, even if it is not installed. Previously, a Conscrypt provider needed to be installed for it to work.
• Enforce canonical Base64url encoding in JwtFormat.strictUrlSafeDecode, preventing signature/MAC malleability from unused trailing bits.
• Fixed StreamingAeadSeekableDecryptingChannel.read to always authenticate the final ciphertext segment when reaching the end of the plaintext, ensuring valid empty plaintexts return -1 (EOF) and rejecting truncated or unauthenticated empty trailing segments with an IOException.

Maven:

<dependency>
    <groupId>com.google.crypto.tink</groupId>
    <artifactId>tink</artifactId>
    <version>1.24.0</version>
</dependency>

Gradle:

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.24.0'
}

Bazel:

Using bzlmod

bazel_dep(name = "tink_java")

git_override(
    module_name = "tink_java",
    remote = "https://github.com/tink-crypto/tink-java",
    tag = "v1.24.0",
)

apache/commons-codec (commons-codec:commons-codec)

v1.23.0

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.23.0.

The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

grpc/grpc-java (io.grpc:grpc-bom)

v1.85.0

Compare Source

gRPC Java 1.85.0 Release Notes

API Changes

• netty: Support never-indexed metadata keys (#​12976) (e9a8c2b). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
• binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

• xds: allow wildcard listener port in LDS (5fda0c7). It now accepts a port of 0 in the LDS listener address as matching any port.
   

Bug Fixes

•  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#​13015) (e58489f). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
• core: Reset configSelector on realChannel while entering IDLE state (#​12832) (fc43144). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
• core: Gracefully handle GOAWAY frames with unrecognized error codes (#​13035) (b3ae801). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

• netty: make hostname verification configurable (#​13002) (2858db2). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
• bazel: Adopt proto_lang_toolchain for java_grpc_library() (#​12994) (c9ee3f8). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

• api: Implement custom events framework in gRPC-Java server (#​12980) (dd00881). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

• Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#​13013) (9799887)
• netty: Upgrade Netty to 4.2.17 (#​13036) (61b910b). netty-tcnative remains at 2.0.81.

Documentation

• stub: Clarify flow control javadoc (#​12977) (893eb70)

 

Thanks to

@​kkalin68

@​petedmarsh

v1.84.3

Compare Source

Bug Fixes

• xDS: fix DistributorWatcher thread safety in CertificateProvider- #​13087

v1.84.2

Compare Source

v1.84.1

Compare Source

• core: Gracefully handle GOAWAY frames with unrecognized error codes (#​13043). Treats unrecognized HTTP/2 GOAWAY error codes as INTERNAL_ERROR instead of throwing NullPointerException.

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)

v1.67.0

API

• Deprecate TextMapGetter.keys() and make TextMapGetter a functional interface
  (#​8531)
• Add null guards and API usage logging for tracing, baggage, attributes, logging, and metrics
  (#​8803, #​8863, #​8864)
• Fix GHSA-ccrj-gw8r-854m: Bound allocations and avoid regex backtracking when parsing W3C tracestate
  (#​8817, #​8914)

Incubating

• Add type introspection methods to DeclarativeConfigProperties
  (#​8883)

Extensions

• Trace propagators: Bound allocations when parsing Jaeger baggage and B3 single-header propagation
  (#​8817)

SDK

• Run CompletableResultCode completion actions outside internal locks to avoid deadlocks
  (#​8773)
• Do not count attribute overwrites as dropped attributes
  (#​8833)
• Avoid regex backtracking in glob matching
  (#​8909)
• Add experimental resource entity support, OTLP export, and configuration through otel.entities
  and declarative resource detectors
  (#​8464)

Traces

• Return noop tracers when no span processors are configured
  (#​8815)
• Catch Throwable in SimpleSpanProcessor and MultiSpanExporter
  (#​8848)
• Use {span} units for span processor self-observability metrics
  (#​8873)

Metrics

• Stabilize PeriodicMetricReaderBuilder.setMaxExportBatchSize(int)
  (#​8829)
• Delete experimental metric attribute / baggage processing
  (#​8818)
• Fix: Reset exemplar span context when a reservoir cell is overwritten outside a span
  (#​8871)

Logs

• Return noop loggers from SdkLoggerProvider.get() when no log record processors are configured
  (#​8838)
• Catch Throwable in SimpleLogRecordProcessor and MultiLogRecordExporter
  (#​8848)

Profiles

• Fix KeyValueAndUnitData.create() to return the public KeyValueAndUnitData interface
  (#​8875)

Exporters

• OTLP: Fix missing request size limits, defaulting to 64 MiB, configurable through
  setMaxRequestBodySize(long) and setMaxRequestMessageSize(long) and through declarative config
  OtlpGrpcExporter, OtlpHttpExporter (see full schema docs here)
  (#​8446)
• OTLP: Reduce failure logs to FINE after shutdown
  (#​8819)
• OTLP: retry gRPC based on response status codes in trailer headers
  (#​8854)
• Prometheus: Avoid regex backtracking when removing unit annotations
  (#​8910)

Extensions

• Autoconfigure: Stabilize ServiceInstanceIdResourceProvider and generate service.instance.id by default
  (#​8770)
• Autoconfigure: Preserve unencoded non-ASCII characters when decoding resource attributes
  (#​8893)
• Autoconfigure: Add missing artifact hints for experimental-otlp/stdout span and metric exporters
  (#​8897)
• Declarative config: Update to schema v1.2.0 and support the always_record sampler
  (#​8801)
• Declarative config: Ignore resource attributes with null values
  (#​8889)
• Declarative config: Match array attributes element-wise in the rule_based sampler
  (#​8895)
• Jaeger remote sampler: Reduce failure logs to FINE after shutdown
  (#​8819)
• Jaeger remote sampler: Preserve per-operation sampling strategies when the rate limit is zero
  (#​8888)
• Incubator: Make OnEndSpanProcessor.create() public
  (#​8892)
• Incubator: Fix the class name in ComposableProbabilitySampler descriptions
  (#​8891)

Testing

• Fix assertion failure messages reporting the wrong value or type
  (#​8872)

Shims

• OpenCensus: Skip W3C multi-tenant tracestate keys when converting spans
  (#​8810)
• OpenTracing: Propagate baggage to the parent context in SpanBuilderShim
  (#​8812)

Project tooling

• Kotlin extension: Raise the minimum Kotlin version to 2.2
  (#​8804)

ThreeTen/threeten-extra (org.threeten:threeten-extra)

v1.11.0

Compare Source

See the change notes for more information.

What's Changed

• Add LocalDateRange.from(Temporal) by @​jodastephen in #​382
• Add LocalDateRange.withEndInclusive(TemporalAdjuster) by @​jodastephen in #​383
• Comparators for TemporalField and TemporalUnit by @​jodastephen in #​388
• Fix date value for unreleased version 1.11.0 in release notes by @​homeworkprod in #​391
• Add Temporal queries to obtain start/end of a date range by @​jodastephen in #​392
• Fix InternationalFixedDate.ofEpochDay losing Year Day of leap years by @​dylanpulver in #​385
• Derive HalfOfYear from QuarterOfYear by @​jodastephen in #​397
• Bump GH actions versions by @​jodastephen in #​398
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @​dependabot[bot] in #​361
• Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 by @​dependabot[bot] in #​351
• Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 by @​dependabot[bot] in #​350
• Bump guava.version from 33.6.0-jre to 33.7.2-jre by @​dependabot[bot] in #​341
• Ensure classes are validated when deserialized by @​jodastephen in #​399

New Contributors

• @​homeworkprod made their first contribution in #​391
• @​dylanpulver made their first contribution in #​385

Full Changelog: ThreeTen/threeten-extra@v1.10.0...v1.11.0

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.5

Compare Source

See the change notes for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the Google Guava dependency version from 33.7.1-jre to 33.7.2-jre in sdk-platform-java/dependencies.txt. There are no review comments, and I have no feedback to provide.