[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.grpc:grpc-protobuf	1.82.1 → 1.85.1
io.grpc:grpc-stub	1.82.1 → 1.85.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

grpc/grpc-java (io.grpc:grpc-protobuf)

v1.85.1

Compare Source

What's Changed

• netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x backport) by @​AgraVator in #​13120
• core: Delayed deserialization for unary/server-streaming calls (v1.85.x backport) by @​kannanjgithub in #​13132
• xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x backport) by @​kannanjgithub in #​13133

v1.85.0

Compare Source

gRPC Java 1.85.0 Release Notes

API Changes

• netty: Support never-indexed metadata keys (#​12976) (e9a8c2b). High-cardinality metadata values provide little compression benefit and can churn the server's dynamic HPACK table. Adds NettyChannelBuilder.neverIndexMetadataKey() and neverIndexMetadataKeys() so callers can mark selected outbound metadata keys for HPACK's never-indexed literal representation.
• binder: Add Context-based hasPermissions() to SecurityPolicies and deprecate the PackageManager version.

Behavior Changes

• xds: allow wildcard listener port in LDS (5fda0c7). It now accepts a port of 0 in the LDS listener address as matching any port.
   

Bug Fixes

•  xds: Make RawMessageClientInterceptor conditional on ext_proc flags (#​13015) (e58489f). Fixes a bug that caused empty payloads on retry attempts for regular xDS channels.
• core: Reset configSelector on realChannel while entering IDLE state (#​12832) (fc43144). Because of a bug in the config selector, when ManagedChannel entered IDLE state due to resource deletion on the xDS control plane, the channel stayed stuck in IDLE state even after the resource came back online and a new rpc was executed.
• core: Gracefully handle GOAWAY frames with unrecognized error codes (#​13035) (b3ae801). When a server or proxy sent a GOAWAY with an unrecognized HTTP/2 error code, such as 70007 from Apache httpd, Netty transport clients logged NullPointerException: Http2Error cannot be null for GOAWAY and RPCs could hang until their deadline. Such codes are now treated as INTERNAL_ERROR, so the transport shuts down cleanly.

Improvements

• netty: make hostname verification configurable (#​13002) (2858db2). This configures HTTPS endpoint identification in GrpcSslContexts and updates ClientTlsHandler to preserve an explicit empty-string opt-out. A null algorithm still falls back to HTTPS, retaining hostname verification for custom contexts that do not select an algorithm.
• bazel: Adopt proto_lang_toolchain for java_grpc_library() (#​12994) (c9ee3f8). java_grpc_library and java_lite_grpc_library now invoke protoc through Protobuf's proto_lang_toolchain instead of always using @com_google_protobuf//:protoc. They now use the same protoc and protoc options as java_proto_library.

New Features

• api: Implement custom events framework in gRPC-Java server (#​12980) (dd00881). This adds triggerEvent/onEvent APIs to ServerCall and ServerCall.Listener. This allows events to be triggered on the ServerCall and be delivered as a listener callback.

Dependencies

• Upgrade protobuf for bazel from 36.0 to 36.0.bcr.1 (#​13013) (9799887)
• netty: Upgrade Netty to 4.2.17 (#​13036) (61b910b). netty-tcnative remains at 2.0.81.

Documentation

• stub: Clarify flow control javadoc (#​12977) (893eb70)

 

Thanks to

@​kkalin68

@​petedmarsh

v1.84.3

Compare Source

Bug Fixes

• xDS: fix DistributorWatcher thread safety in CertificateProvider- #​13087

v1.84.2

Compare Source

v1.84.1

Compare Source

• core: Gracefully handle GOAWAY frames with unrecognized error codes (#​13043). Treats unrecognized HTTP/2 GOAWAY error codes as INTERNAL_ERROR instead of throwing NullPointerException.

v1.84.0

Compare Source

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#​12925) (ac02c6f)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#​12925) (ac02c6f)
• api: Add a Supplier overload to Context (#​12935) (6966536)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#​12961) (96807d8)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#​12985) (72c6e5f)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#​12982) (3cb7007)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#​12971) (d49a589)
• core, xds: Append child channel configurators instead of overwriting (#​12921) (296c007) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#​12972) (7843bd4) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#​12933) (56205f9) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#​12732) (46f3080) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#​12990) (0f859c3) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#​12924) (0585d48)
• s2a: Default to Post Quantum Cryptography key exchange group (#​12894) (bc01994)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96)
• binder: normalize failed auth future status message (9ffa1e1)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#​12945) (6ccd065). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#​12969) (1bc2f5a)

Documentation

• api: Better explain the executors and how to configure them (ee08f53)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#​12807) (073fd5e) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

@​Zhengcy05
@​carl-mastrangelo
@​themechbro
@​JasonLunn
@​martinbaillie
@​eado
@​TimurRakhmatullin86

v1.83.1

Compare Source

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#​12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#​12944)

v1.83.0

Compare Source

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#​11901) (2b86f8f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce3). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#​12836) (1e85674) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#​12882) (c8079ee). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b1). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b)
• core: normalize service config number values (#​12826) (663c505) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df). This removes unnecessary log noise
• core: Enable child channel plugins (#​12578) (89aef90). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#​12876) (c886f0a)
• Upgrade various dependencies (064272c):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#​12811) (f94574e)

Thanks to

tian__mi__mi@
codingkiddo@
Zhengcy05@​

v1.82.4

Compare Source

gRPC Java 1.82.4 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#​12941). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#​12943)

v1.82.3

Compare Source

gRPC Java 1.82.3 Release Notes

The fixes that were supposed to go in this release were not included in the patch by mistake. Use 1.82.4 instead.

v1.82.2

Compare Source

• Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (#​12886). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 68257490-a2af-49cb-a21d-a73f4950cf0a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud