build(deps): bump the gradle-production-dependencies group across 3 directories with 25 updates

[dependabot]

Bumps the gradle-production-dependencies group with 19 updates in the /src/ad directory:

Package	From	To
io.opentelemetry:opentelemetry-bom	1.55.0	1.65.0
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom	2.21.0	2.31.1
com.google.api.grpc:proto-google-common-protos	2.62.0	2.74.0
com.google.protobuf:protobuf-java	4.33.0	4.36.0
com.google.protobuf:protoc	4.33.0	4.36.0
io.grpc:grpc-protobuf	1.76.0	1.83.1
io.grpc:grpc-stub	1.76.0	1.83.1
io.grpc:grpc-netty	1.76.0	1.83.1
io.grpc:grpc-services	1.76.0	1.83.1
io.grpc:protoc-gen-grpc-java	1.76.0	1.83.1
org.apache.logging.log4j:log4j-core	2.25.2	2.26.1
dev.openfeature.contrib.providers:flagd	0.11.17	0.14.1
dev.openfeature:sdk	1.18.2	1.22.0
com.fasterxml.jackson.core:jackson-core	2.20.0	2.22.2
com.fasterxml.jackson.core:jackson-databind	2.20.0	2.22.2
io.netty:netty-tcnative-boringssl-static	2.0.74.Final	2.0.81.Final
com.google.protobuf	0.9.5	0.10.0
com.github.ben-manes.versions	0.53.0	0.61.0
gradle-wrapper	8.12.1	9.7.1

Bumps the gradle-production-dependencies group with 18 updates in the /src/fraud-detection directory:

Package	From	To
com.google.api.grpc:proto-google-common-protos	2.62.0	2.74.0
com.google.protobuf:protobuf-java	4.33.0	4.36.0
com.google.protobuf:protobuf-kotlin	4.33.0	4.36.0
com.google.protobuf:protoc	4.33.0	4.36.0
io.grpc:grpc-protobuf	1.76.0	1.83.1
io.grpc:grpc-stub	1.76.0	1.83.1
io.grpc:grpc-netty	1.76.0	1.83.1
io.grpc:grpc-services	1.76.0	1.83.1
io.grpc:protoc-gen-grpc-java	1.76.0	1.83.1
org.apache.logging.log4j:log4j-core	2.25.2	2.26.1
dev.openfeature.contrib.providers:flagd	0.11.17	0.14.1
dev.openfeature:sdk	1.18.2	1.22.0
com.google.protobuf	0.9.5	0.10.0
gradle-wrapper	8.12.1	9.7.1
org.apache.kafka:kafka-clients	4.1.0	4.3.1
io.opentelemetry:opentelemetry-api	1.55.0	1.65.0
org.slf4j:slf4j-api	2.0.17	2.0.18
jvm	2.2.21	2.4.10

Bumps the gradle-production-dependencies group with 1 update in the /src/react-native-app/android directory: gradle-wrapper.

Updates io.opentelemetry:opentelemetry-bom from 1.55.0 to 1.65.0

Release notes

Sourced from io.opentelemetry:opentelemetry-bom's releases.

Version 1.65.0

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)
• Record error.type on failed collections in PeriodicMetricReader (#8650)
• Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact attribute matching (#8518)

Logs

• Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp (#8504)

Profiles

• Fix profiles data model attribute count parameter name and timestamp doc unit (#8514)

Exporters

• WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published (#8677)
• OTLP: Use HTTP error response bodies in HttpExporter warning logs (#8428)
• OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store (#8565)
• OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler (#8493)
• OTLP: Standardize OkHttpHttpSender, JdkHttpSender, and UpstreamGrpcSender shutdown to await executor/channel termination (#8495, #8627, #8624)
• OTLP: Log the underlying except/ion when a gRPC response frame is invalid (#8626)

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits

• 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
• 60d7ecf Prepare 1.65.0 (#8700)
• 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
• db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
• 995cb3c Avoid unsafe string encoder on Android (#8637)
• 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• 2009d58 Avoid exposing configuration values in errors (#8669)
• 3cafbbb Deprecate OpenCensus shim public API (#8674)
• 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
• 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
• Additional commits viewable in compare view

Updates io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom from 2.21.0 to 2.31.1

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom's releases.

Version 2.31.1

This release targets the OpenTelemetry SDK 1.65.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

🛠️ Bug fixes

• Restore stable semantic convention APIs to the compile classpaths of the Spring Boot autoconfigure and starter artifacts. (#19754)

Version 2.31.0

This release targets the OpenTelemetry SDK 1.65.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove the deprecated ConfigPropertiesBackedConfigProvider and its create(ConfigProperties) compatibility API from the declarative config bridge. (#19305)
• Stop exposing opentelemetry-instrumentation-api-incubator on library instrumentation compile classpaths. (#19612)

🚫 Deprecations

• Deprecate otel.instrumentation.experimental.span-suppression-strategy in favor of Experimental.setSpanSuppressionStrategy(...). (#19180)
• Deprecate HostIdResource.REGISTRY_QUERY in favor of the absolute-path reg.exe lookup used by HostIdResource. (#19293)
• Deprecate MessageOperation in favor of MessagingOperationType, and the MessageOperation overloads of MessagingAttributesExtractor, MessagingConsumerMetrics, MessagingProducerMetrics, MessagingSpanKindExtractor, and MessagingSpanNameExtractor in favor of the corresponding MessagingOperationType APIs. (#19357)
• Deprecate otel.traces.exporter=zipkin in favor of otel.traces.exporter=otlp, and otel.exporter.zipkin.endpoint in favor of otel.exporter.otlp.traces.endpoint. (#19400)
• Deprecate OpenTelemetryMeterRegistryBuilder#setMicrometerHistogramGaugesEnabled(boolean) in favor of Experimental#setMicrometerHistogramGaugesEnabled(OpenTelemetryMeterRegistryBuilder, boolean). (#19404)
• Deprecate legacy gRPC metadata, messaging header, and servlet request-parameter capture properties and APIs in favor of selector-based .included / .excluded configuration and IncludeExclude APIs. (#19494, #19522, #19523, #19638)
• Deprecate otel.instrumentation.runtime-telemetry.experimental.prefer-jfr in favor of otel.instrumentation.runtime-telemetry.experimental.jfr-metrics.included, and setPreferJfrMetrics(...) in favor of setJfrMetrics(RuntimeTelemetryBuilder, IncludeExclude). (#19495)
• Deprecate boolean and capture-list configuration for MDC/context data, map messages, key-value pairs, logger context, Logstash markers, and structured arguments in favor of .included / .excluded selectors and IncludeExclude APIs. (#19519, #19520, #19521, #19599, #19600, #19605, #19609, #19610)
• Deprecate the declarative configuration field general.semconv_stability.opt_in in favor of general.stability_opt_in_list, and general.sanitization.url.sensitive_query_parameters/development in favor of general.sanitization.url.sensitive_query_parameters. (#19561)
• Deprecate otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of otel.instrumentation.graphql.operation-name-in-span-name.enabled, and otel.instrumentation.runtime-telemetry.package-emitter.enabled / jars-per-second in favor of otel.instrumentation.runtime-telemetry.experimental.package-emitter.enabled / jars-per-second. (#19573)
• Deprecate captured request and response header builder methods across HTTP library instrumentations in favor of selector-based requestHeaders(IncludeExclude) and responseHeaders(IncludeExclude) APIs. (#19598, #19601, #19602, #19603, #19604, #19606, #19607, #19608)
• Deprecate otel.instrumentation.micrometer.histogram-gauges.enabled in favor of otel.instrumentation.micrometer.experimental.histogram-gauges.enabled. (#19613)

🌟 New javaagent instrumentation

• Add Apache Commons Pool 2 instrumentation for object pool metrics. (#19091)
• Add Apache HBase client 1.0 javaagent instrumentation. (#19243)
• Add Redisson connection pool metrics for 3.26+. (#19392)
• Add support for OpenTelemetry API 1.65 incubator metrics in the Java agent. (#19456)
• Add Tomcat DBCP 8.0 javaagent instrumentation for database pool metrics. (#19472)

📈 Enhancements

• Add opt-in OSGi bundle metadata for selected instrumentation, API, and SDK extension artifacts so they can be consumed directly in OSGi runtimes. (#18995)
• Add cassandra.compaction.progress.completed and cassandra.compaction.progress.size gauges for in-flight Cassandra compactions. (#19290)
• Preview the upcoming 3.0 messaging semantic conventions behind otel.semconv-stability.opt-in=messaging across AWS SQS and Lambda, JMS, Kafka, NATS, Pulsar, RabbitMQ, RocketMQ, Spring Integration, and Spring messaging instrumentations. (#19347, #19348, #19349, #19350, #19351, #19353, #19354, #19355, #19356, #19476, #19477, #19478, #19479, #19480, #19481, #19482, #19486, #19487, #19499, #19500, #19504, #19505, #19507, #19508, #19535, #19544, #19565, #19567, #19639, #19640)
• Under the upcoming 3.0 RPC semantic conventions behind otel.semconv-stability.opt-in=rpc, Dubbo requests to unknown services emit server spans even when decoding fails before DubboProtocol.getInvoker(), and record the original method in rpc.method_original. (#16668)
• Log4j context data now includes baggage.* entries even when there is no current span. (#19378)
• When otel.instrumentation.common.v3-preview=true, the Micrometer bridge no longer exports .max gauges for Timer and DistributionSummary. (#19397)

... (truncated)

Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom's changelog.

Version 2.31.1 (2026-08-23)

This release targets the OpenTelemetry SDK 1.65.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

🛠️ Bug fixes

• Restore stable semantic convention APIs to the compile classpaths of the Spring Boot autoconfigure and starter artifacts. (#19754)

Version 2.31.0 (2026-08-20)

This release targets the OpenTelemetry SDK 1.65.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove the deprecated ConfigPropertiesBackedConfigProvider and its create(ConfigProperties) compatibility API from the declarative config bridge. (#19305)
• Stop exposing opentelemetry-instrumentation-api-incubator on library instrumentation compile classpaths. (#19612)

🚫 Deprecations

• Deprecate otel.instrumentation.experimental.span-suppression-strategy in favor of Experimental.setSpanSuppressionStrategy(...). (#19180)
• Deprecate HostIdResource.REGISTRY_QUERY in favor of the absolute-path reg.exe lookup used by HostIdResource. (#19293)
• Deprecate MessageOperation in favor of MessagingOperationType, and the MessageOperation overloads of MessagingAttributesExtractor, MessagingConsumerMetrics, MessagingProducerMetrics, MessagingSpanKindExtractor, and MessagingSpanNameExtractor in favor of the corresponding MessagingOperationType APIs. (#19357)
• Deprecate otel.traces.exporter=zipkin in favor of otel.traces.exporter=otlp, and otel.exporter.zipkin.endpoint in favor of otel.exporter.otlp.traces.endpoint. (#19400)
• Deprecate OpenTelemetryMeterRegistryBuilder#setMicrometerHistogramGaugesEnabled(boolean) in

... (truncated)

Commits

• 8ad06a0 [release/v2.31.x] Prepare release 2.31.1 (#19765)
• e0306a2 [release/v2.31.x] Prepare changelog for 2.31.1 (#19760)
• 75576d4 [release/v2.31.x] Retain semconv API for Spring artifacts until 3.0 (#19754)
• 18da99b [release/v2.31.x] Prepare release 2.31.0 (#19731)
• dbe5c09 chore: update instrumentation list [automated] (#19701)
• 1035b5b Change log for upcoming release + Improve automated release note drafting (#1...
• 64310fc [jmx] add recommendation for naming percentile metrics (#19727)
• 4225fbe Update pinned latest dep versions (#19720)
• 26c08ac fix redisson connection pool leak on cancellation (#19340)
• 200efae Emit db.namespace for jedis 2.0 and 3.0 (#19707)
• Additional commits viewable in compare view

Updates com.google.api.grpc:proto-google-common-protos from 2.62.0 to 2.74.0

Release notes

Sourced from com.google.api.grpc:proto-google-common-protos's releases.

v2.68.0

2.68.0 (2026-03-17)

Features

• Add client request duration metric. (#4132) (6a76397)
• Add more attributes to golden signals metrics. (#4135) (59d0624)
• gax-httpjson: add HttpJsonErrorParser utility (#4137) (a1b7565)
• generator: add extra allowed modules that will not be removed from the monorepo if they are present (#4124) (774fe6e)
• o11y: introduce gcp.client.repo and gcp.client.artifact attributes (#4120) (105f644)
• o11y: Introduce rpc.system.name and rpc.method in gRPC (#4121) (7ab6d2e)
• o11y: introduce server.port attribute (#4128) (56aa343)

Bug Fixes

• add null checks for ApiTracerFactory in ClientContext (#4122) (4b3dbe2)
• Decrease log level for directpath warnings outside GCE (#4139) (c9651e7)
• gax-grpc: add pick_first fallback to direct path service config (#4143) (b150fe9)
• Populate method level attributes in metrics recording (#4149) (7b7e6c9)
• suppress warnings in generated projects for non-idiomatic durations (#4119) (4206e6e)
• Use ServiceName + MethodName as the regex for Otel (#2543) (b9ae73f)

Documentation

• hermetic_build: fix config field name in readme (#4130) (a0c8f67)

v2.67.0

2.67.0 (2026-02-18)

Features

• observability: introduce minimal tracing implementation (#4105) (e4e5e89)

Dependencies

• Upgrade Google-Auth-Library to v1.43.0 (#4114) (825298b)
• Upgrade grpc to 1.76.3 (#4106) (c6555f5)

v2.66.1

2.66.1 (2026-02-04)

Documentation

• [common-protos] update reference documentation for SelectionInput.DROPDOWN to include dynamic data sources and autosuggestion (9960262)

... (truncated)

Changelog

Sourced from com.google.api.grpc:proto-google-common-protos's changelog.

Changelog

2.68.0 (2026-03-17)

Features

• Add client request duration metric. (#4132) (6a76397)
• Add more attributes to golden signals metrics. (#4135) (59d0624)
• gax-httpjson: add HttpJsonErrorParser utility (#4137) (a1b7565)
• generator: add extra allowed modules that will not be removed from the monorepo if they are present (#4124) (774fe6e)
• o11y: introduce gcp.client.repo and gcp.client.artifact attributes (#4120) (105f644)
• o11y: Introduce rpc.system.name and rpc.method in gRPC (#4121) (7ab6d2e)
• o11y: introduce server.port attribute (#4128) (56aa343)

Bug Fixes

• add null checks for ApiTracerFactory in ClientContext (#4122) (4b3dbe2)
• Decrease log level for directpath warnings outside GCE (#4139) (c9651e7)
• gax-grpc: add pick_first fallback to direct path service config (#4143) (b150fe9)
• Populate method level attributes in metrics recording (#4149) (7b7e6c9)
• suppress warnings in generated projects for non-idiomatic durations (#4119) (4206e6e)
• Use ServiceName + MethodName as the regex for Otel (#2543) (b9ae73f)

Documentation

• hermetic_build: fix config field name in readme (#4130) (a0c8f67)

2.67.0 (2026-02-18)

Features

• observability: introduce minimal tracing implementation (#4105) (e4e5e89)

Dependencies

• Upgrade Google-Auth-Library to v1.43.0 (#4114) (825298b)
• Upgrade grpc to 1.76.3 (#4106) (c6555f5)

2.66.1 (2026-02-04)

Documentation

• [common-protos] update reference documentation for SelectionInput.DROPDOWN to include dynamic data sources and autosuggestion (9960262)

... (truncated)

Commits

• 29cbd0a chore(main): release 2.66.0 (#4072)
• ad9ee07 deps: update auth library to 1.42.0 (#4087)
• 9cf0352 tests: Add java-showcase-3.25.8. (#4088)
• 3db61c2 tests: Add java-showcase-3.21.0 (#4081)
• d8bc8f5 deps: update http-client to 2.1.0 (#4086)
• 7934c24 chore(deps): update upper bound dependencies file (#4083)
• 28cc591 tests: Add protobuf 3.x compatibility tests with a third party library tensor...
• 22446d5 chore: update googleapis commit at Wed Jan 21 02:42:16 UTC 2026 (#4073)
• 3e37376 feat: Upgrade protobuf runtime and gen code to 4.33.x (#4000) (#4074)
• cf65482 deps: Downgrade opentelemetry to 1.51.0 (#4075)
• Additional commits viewable in compare view

Updates com.google.protobuf:protobuf-java from 4.33.0 to 4.36.0

Commits

• See full diff in compare view

Updates com.google.protobuf:protoc from 4.33.0 to 4.36.0

Commits

• See full diff in compare view

Updates io.grpc:grpc-protobuf from 1.76.0 to 1.83.1

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
• core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
• core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
• Upgrade various dependencies (064272c61d):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits

• 8f621c0 Bump version to 1.83.1
• 2bafe5e Update README etc to reference 1.83.1
• e1f2dbd netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83....
• ee8232f core: Coalesce Contiguous Small Buffers for ReadableBuffer (v1.83.x backport)...
• b4ca099 Fix docker tagging failure in upload_artifacts by using stable tag name (#12922)
• b4fb7f4 build: Allow downloading pkgconfiglite with empty checksum
• 1fbfa86 Bump version to 1.83.1-SNAPSHOT
• 8ab6e0a Bump version to 1.83.0
• 33ad6a4 Update README etc to reference 1.83.0
• 17d5bd6 Revert "enable child channel plugins (#12578)" (v1.83.x backport) (#12913)
• Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.76.0 to 1.83.1

Release notes

Sourced from io.grpc:grpc-stub's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
• core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
• core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
• Upgrade various dependencies (064272c61d):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits

• 8f621c0 Bump version to 1.83.1
• Description has been truncated