chore(deps): bump the backend-dependencies group in /backend with 8 updates by dependabot[bot] · Pull Request #692 · Shadowfit/init

dependabot · 2026-09-08T15:34:48Z

Bumps the backend-dependencies group in /backend with 8 updates:

Package	From	To
io.grpc:grpc-netty-shaded	`1.83.1`	`1.84.0`
io.grpc:grpc-protobuf	`1.83.1`	`1.84.0`
io.grpc:grpc-stub	`1.83.1`	`1.84.0`
io.grpc:grpc-services	`1.83.1`	`1.84.0`
com.google.protobuf:protobuf-java	`4.36.0`	`4.36.1`
com.google.protobuf:protobuf-java-util	`4.36.0`	`4.36.1`
com.google.protobuf:protoc	`4.36.0`	`4.36.1`
io.grpc:protoc-gen-grpc-java	`1.83.1`	`1.84.0`

Updates io.grpc:grpc-netty-shaded from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-protobuf from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-stub's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-services from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-services's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-protobuf from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-stub from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-stub's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()
7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
Additional commits viewable in compare view

Updates io.grpc:grpc-services from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-services's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)

xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)

api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.

xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)

xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)

core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.

rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.

servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.

okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates

core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)

s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)

binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)

binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.

api: Bump Context to JDK 8 (5d0a012fa)

netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

api: Better explain the executors and how to configure them (ee08f5337)

New Features

core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

b3838c0 Bump version to 1.84.0
eb21854 Update README etc to reference 1.84.0
118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
292a361 binder,cronet: Handle double-ClientTransportFactory.close()

Bumps the backend-dependencies group in /backend with 8 updates: | Package | From | To | | --- | --- | --- | | [io.grpc:grpc-netty-shaded](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [io.grpc:grpc-protobuf](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [io.grpc:grpc-stub](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [io.grpc:grpc-services](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | | [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) | `4.36.0` | `4.36.1` | | com.google.protobuf:protobuf-java-util | `4.36.0` | `4.36.1` | | [com.google.protobuf:protoc](https://github.com/protocolbuffers/protobuf) | `4.36.0` | `4.36.1` | | [io.grpc:protoc-gen-grpc-java](https://github.com/grpc/grpc-java) | `1.83.1` | `1.84.0` | Updates `io.grpc:grpc-netty-shaded` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-protobuf` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-stub` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-services` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-protobuf` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-stub` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `io.grpc:grpc-services` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) Updates `com.google.protobuf:protobuf-java` from 4.36.0 to 4.36.1 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `com.google.protobuf:protobuf-java-util` from 4.36.0 to 4.36.1 Updates `com.google.protobuf:protobuf-java-util` from 4.36.0 to 4.36.1 Updates `com.google.protobuf:protoc` from 4.36.0 to 4.36.1 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `io.grpc:protoc-gen-grpc-java` from 1.83.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-java/releases) - [Commits](grpc/grpc-java@v1.83.1...v1.84.0) --- updated-dependencies: - dependency-name: io.grpc:grpc-netty-shaded dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: io.grpc:grpc-protobuf dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: io.grpc:grpc-stub dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: io.grpc:grpc-services dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: io.grpc:grpc-protobuf dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: io.grpc:grpc-stub dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: io.grpc:grpc-services dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protobuf-java dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protoc dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: io.grpc:protoc-gen-grpc-java dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 8, 2026

Navigation Menu

Uh oh!

chore(deps): bump the backend-dependencies group in /backend with 8 updates - #692

chore(deps): bump the backend-dependencies group in /backend with 8 updates#692
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/backend/backend-dependencies-af366e0ed0

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 8, 2026

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

V1.84.0

API Changes

Behavior Changes

Bug Fixes

Improvements

Dependencies

Documentation

New Features

Thanks to

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants