Bump the gradle-all group across 9 directories with 13 updates

[dependabot]

Bumps the gradle-all group with 10 updates in the /samples/durable-task-sdks/java/async-http-api directory:

Package	From	To
org.springframework.boot:spring-boot-dependencies	4.1.0	4.1.1
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
org.projectlombok:lombok	1.18.46	1.18.48
org.springframework.boot	4.1.0	4.1.1
gradle-wrapper	9.6.1	9.8.0

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/entities directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/eternal-orchestrations directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/fan-out-fan-in directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/function-chaining directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/human-interaction directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/monitoring directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0

Bumps the gradle-all group with 10 updates in the /samples/durable-task-sdks/java/opentelemetry-tracing directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0
io.opentelemetry:opentelemetry-api	1.63.0	1.66.0
io.opentelemetry:opentelemetry-sdk	1.63.0	1.66.0
io.opentelemetry:opentelemetry-exporter-otlp	1.63.0	1.66.0
io.opentelemetry:opentelemetry-sdk	1.63.0	1.66.0
io.opentelemetry:opentelemetry-exporter-otlp	1.63.0	1.66.0

Bumps the gradle-all group with 7 updates in the /samples/durable-task-sdks/java/sub-orchestrations directory:

Package	From	To
ch.qos.logback:logback-classic	1.5.37	1.6.4
org.slf4j:slf4j-api	2.0.18	2.0.20
io.grpc:grpc-protobuf	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
io.grpc:grpc-stub	1.82.1	1.84.0
io.grpc:grpc-netty-shaded	1.82.1	1.84.0
com.azure:azure-identity	1.18.4	1.18.6
gradle-wrapper	9.6.1	9.8.0

Updates org.springframework.boot:spring-boot-dependencies from 4.1.0 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.1.1

⚠️ Attention Required

• Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

• Kafka consumer-specific security protocol is not taken into account #51369
• Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
• Micrometer registries pin the application context #51135
• Temporary file is not deleted when ExportedImageTar construction fails #51132
• Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
• spring-boot-h2-console pulls servlet-api as transitive dependency #51095
• PropertiesLauncher does not log nested archive paths #51089
• Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
• NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
• Fix ordering of Kotlinx Serialization CodecCustomizer #50961
• JarFile is not closed when finding main class from archive #50959
• Application-managed JUL bridge handler should only be removed if installed #50950
• CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
• Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
• Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
• GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
• Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
• Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
• Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
• IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
• High number of connections due to Mongo health indicator #50852
• Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
• Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
• PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
• Exposing gRPC test server port should backoff if gRPC is not present #50825
• JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
• spring.grpc.server.health.include-overall-health is not taken into account #50799
• Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
• Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
• Map properties bound from empty strings fail with ConverterNotFoundException #50773
• Protobuf Common Protos should not be a managed dependency #50772
• An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
• W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

• Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
• spring.profiles.group should have a 'spring-profile-name' hint provider #51284
• Remove reference to removed InfluxDB auto-configuration #51176
• Use JacksonJsonSerde in Kafka Streams documentation #51161
• Document alternatives to HttpMessageConverters #51129
• Fix stale type reference for OTLP logging transport metadata #51119
• Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits

• 6fdf67e Release 4.1.1
• fde599b Upgrade to Spring Pulsar 2.0.7
• 9daa58f Upgrade to Spring HATEOAS 3.1.2
• 353993e Upgrade to Spring Data Bom 2026.0.1
• 24ba596 Upgrade to Spring Session 4.1.1
• 5cb5c29 Upgrade to Spring Security 7.1.1
• 4adc8eb Upgrade to Spring LDAP 4.1.1
• 4d9c19c Upgrade to Spring Kafka 4.1.1
• f30f612 Upgrade to Spring Integration 7.1.1
• b930283 Upgrade to Spring gRPC 1.1.1
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.37 to 1.6.4

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: qos-ch/logback@v_1.6.3...v_1.6.4

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

... (truncated)

Commits

• 07d291c preapre release 1.6.4
• 9627daf revert to Collections.unmodifiableMap instead of
• aa42fb5 disabled RollingCalendarTest#testVaryingNumberOfHalfDailyPeriods to shave off...
• ddc7459 Support HALF_DAY periodicity for AM/PM date patterns
• 42d75d7 disable LoggerContextTest#concurrentGetLoggerKeepsSizeConsistent to shave exe...
• bffd55e add warnings about missing jline.jansi classes
• 8de0b9b Fix data race on LoggerContext.size (#1038)
• 76c73d1 add MinimalUnmodifiableMap and return it in LogbackMDCAdapter#getPropertyMap
• a2c416a Fix formatting of email instruction in README
• 2c89727 mailing lists have been deactivated
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.20

Updates io.grpc:grpc-protobuf from 1.82.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.82.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-stub's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.82.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.82.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-stub's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...