feat(pqc): upgrade gRPC to v1.83.0 and add gRPC PQC Showcase integration tests

- Upgrade <grpc.version> from 1.82.2 to 1.83.0 in gapic-generator-java-pom-parent and grpc-gcp-java.
- Upgrade <gson.version> to 2.14.0 and <errorprone.version> to 2.50.0 to satisfy Maven Enforcer rules for gRPC 1.83.0.
- Add testGrpcPqc_withTls Showcase TLS integration test in ITPostQuantumCryptography.java using built-in default gRPC transport, configured to trust the Showcase TLS server certificate directly.
- Include concise Javadoc documenting gRPC 1.83.0 built-in PQC behavior and explaining the purpose of GrpcTlsCapturingClientInterceptor and HTTP/2 metadata helper methods.
- Simplify GrpcTlsCapturingClientInterceptor to only capture initial response headers (onHeaders).
- Assert negotiated group is equal to EXPECTED_PQC_GROUP for gRPC without asserting a supported groups list.
- Leave all HTTP/JSON tests and setUp() 100% untouched.
- Exclude all mTLS test resources, keys, certs, and mTLS logic.

TAG=agy
CONV=385b9ab5-874c-4c9a-b331-66dab51fef61

Author: lqiu96

google-auth-library-java/pom.xml

@@ -80,7 +80,7 @@
     <project.appengine.version>2.0.33</project.appengine.version>
     <project.findbugs.version>3.0.2</project.findbugs.version>
     <deploy.autorelease>false</deploy.autorelease>
-    <project.error-prone.version>2.48.0</project.error-prone.version>
+    <project.error-prone.version>2.50.0</project.error-prone.version>
     <project.protobuf.version>4.33.6</project.protobuf.version>
     <project.cel.version>0.9.0-proto3</project.cel.version>
     <project.tink.version>1.15.0</project.tink.version>

grpc-gcp-java/pom.xml

@@ -66,10 +66,10 @@
     <auto-value.version>1.11.0</auto-value.version>
     <error-prone-annotations.version>2.48.0</error-prone-annotations.version>
     <google-http-client.version>2.2.0</google-http-client.version>
-    <gson.version>2.13.2</gson.version>
+    <gson.version>2.14.0</gson.version>
     <guava.version>33.6.0-jre</guava.version>
     <protobuf.version>4.33.6</protobuf.version>
-    <grpc.version>1.82.2</grpc.version>
+    <grpc.version>1.83.0</grpc.version>
     <jsr305.version>3.0.2</jsr305.version>
     <junit.version>4.13.2</junit.version>
     <opencensus.version>0.31.1</opencensus.version>

java-showcase/gapic-showcase/src/test/java/com/google/showcase/v1beta1/it/ITPostQuantumCryptography.java

@@ -29,6 +29,17 @@
 import com.google.showcase.v1beta1.EchoResponse;
 import com.google.showcase.v1beta1.EchoSettings;
 import com.google.showcase.v1beta1.it.util.HttpJsonCapturingClientInterceptor;
+import com.google.api.gax.grpc.InstantiatingGrpcChannelProvider;
+import io.grpc.CallOptions;
+import io.grpc.Channel;
+import io.grpc.ClientCall;
+import io.grpc.ClientInterceptor;
+import io.grpc.ForwardingClientCall;
+import io.grpc.ForwardingClientCallListener;
+import io.grpc.Metadata;
+import io.grpc.MethodDescriptor;
+import io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts;
+import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder;
 import java.io.File;
 import java.io.InputStream;
 import java.nio.file.Files;
@@ -266,4 +277,107 @@ private static KeyStore loadCaCert(String certPath) throws Exception {
     }
     return trustStore;
   }
+
+  /**
+   * Integration test to verify Post-Quantum Cryptography (PQC) TLS negotiation for gRPC clients.
+   *
+   * <p>In gRPC-Java 1.83.0+, the default Netty transport (`grpc-netty-shaded`) bundles BoringSSL
+   * (`netty-tcnative-boringssl-static`) with built-in PQC hybrid key exchange support (e.g.,
+   * X25519MLKEM768). No custom socket configurator or security provider swapping is needed.
+   *
+   * <p>Because the local Showcase test server uses a self-signed CA certificate (written to
+   * {@link #DEFAULT_CA_CERT_PATH}), we configure the gRPC transport channel builder directly to
+   * trust this certificate via {@link GrpcSslContexts#forClient()}. This avoids mutating global JVM
+   * system properties in {@code setUp()} and ensures HTTP/JSON tests remain completely isolated.
+   */
+  @Test
+  void testGrpcPqc_withTls() throws Exception {
+    GrpcTlsCapturingClientInterceptor interceptor = new GrpcTlsCapturingClientInterceptor();
+
+    InstantiatingGrpcChannelProvider transportChannelProvider =
+        EchoSettings.defaultGrpcTransportProviderBuilder()
+            .setEndpoint(SECURE_ENDPOINT)
+            .setInterceptorProvider(() -> Collections.singletonList(interceptor))
+            .setChannelConfigurator(
+                managedChannelBuilder -> {
+                  if (managedChannelBuilder instanceof NettyChannelBuilder) {
+                    try {
+                      // Explicitly trust the self-signed CA certificate created by the local
+                      // Showcase TLS connection without altering JVM-wide SSL trust stores.
+                      ((NettyChannelBuilder) managedChannelBuilder)
+                          .sslContext(
+                              GrpcSslContexts.forClient()
+                                  .trustManager(new File(DEFAULT_CA_CERT_PATH))
+                                  .build());
+                    } catch (Exception e) {
+                      throw new RuntimeException("Failed to configure gRPC SSL context", e);
+                    }
+                  }
+                  return managedChannelBuilder;
+                })
+            .build();
+
+    EchoSettings settings =
+        EchoSettings.newBuilder()
+            .setCredentialsProvider(NoCredentialsProvider.create())
+            .setTransportChannelProvider(transportChannelProvider)
+            .build();
+
+    try (EchoClient client = EchoClient.create(settings)) {
+      EchoResponse response =
+          client.echo(EchoRequest.newBuilder().setContent("pqc-grpc-tls-test").build());
+      assertThat(response.getContent()).isEqualTo("pqc-grpc-tls-test");
+
+      Metadata capturedHeaders = interceptor.capturedMetadata;
+      assertThat(capturedHeaders).isNotNull();
+
+      // Verify that TLS 1.3 key exchange negotiated the expected PQC hybrid group (X25519MLKEM768).
+      String negotiatedGroup = getGrpcSingleHeaderString(capturedHeaders, TLS_GROUP_HEADER);
+      assertThat(negotiatedGroup).isEqualTo(EXPECTED_PQC_GROUP);
+    }
+  }
+
+  /**
+   * Private gRPC client interceptor to capture the response headers from the Showcase server to
+   * verify the PQC algorithm.
+   */
+  private static class GrpcTlsCapturingClientInterceptor implements ClientInterceptor {
+    final Metadata capturedMetadata = new Metadata();
+
+    @Override
+    public <ReqT, RespT> ClientCall<ReqT, RespT> interceptCall(
+        MethodDescriptor<ReqT, RespT> method,
+        CallOptions callOptions,
+        Channel next) {
+      return new ForwardingClientCall.SimpleForwardingClientCall<ReqT, RespT>(
+          next.newCall(method, callOptions)) {
+        @Override
+        public void start(Listener<RespT> responseListener, Metadata headers) {
+          super.start(
+              new ForwardingClientCallListener.SimpleForwardingClientCallListener<RespT>(
+                  responseListener) {
+                @Override
+                public void onHeaders(Metadata headers) {
+                  capturedMetadata.merge(headers);
+                  super.onHeaders(headers);
+                }
+              },
+              headers);
+        }
+      };
+    }
+  }
+
+  /**
+   * Private helper method required to extract a single string header from gRPC {@link Metadata}.
+   *
+   * @param metadata the captured gRPC response metadata
+   * @param name the case-insensitive HTTP/2 header name
+   * @return the string header value, or {@code null} if not present
+   */
+  private static String getGrpcSingleHeaderString(Metadata metadata, String name) {
+    Metadata.Key<String> key =
+        Metadata.Key.of(name, Metadata.ASCII_STRING_MARSHALLER);
+    return metadata.get(key);
+  }
 }

sdk-platform-java/gapic-generator-java-pom-parent/pom.xml

@@ -27,13 +27,13 @@
     <!-- External dependencies, especially gRPC and Protobuf version, should be
         consistent across modules in this repository -->
     <javax.annotation-api.version>1.3.2</javax.annotation-api.version>
-    <grpc.version>1.82.2</grpc.version>
+    <grpc.version>1.83.0</grpc.version>
     <google.http-client.version>2.2.0</google.http-client.version>
-    <gson.version>2.13.2</gson.version>
+    <gson.version>2.14.0</gson.version>
     <guava.version>33.6.0-jre</guava.version>
     <protobuf.version>4.33.6</protobuf.version>
     <opentelemetry.version>1.62.0</opentelemetry.version>
-    <errorprone.version>2.48.0</errorprone.version>
+    <errorprone.version>2.50.0</errorprone.version>
     <jspecify.version>1.0.0</jspecify.version>
     <j2objc-annotations.version>3.1</j2objc-annotations.version>
     <threetenbp.version>1.7.0</threetenbp.version>