fix(deps): update grpc-java monorepo to v1.84.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.grpc:grpc-stub	1.80.0 → 1.84.0
io.grpc:grpc-protobuf	1.80.0 → 1.84.0
io.grpc:grpc-okhttp	1.80.0 → 1.84.0

---

Release Notes

grpc/grpc-java (io.grpc:grpc-stub)

v1.84.0

Compare Source

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#​12925) (ac02c6f)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#​12925) (ac02c6f)
• api: Add a Supplier overload to Context (#​12935) (6966536)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#​12961) (96807d8)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#​12985) (72c6e5f)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#​12982) (3cb7007)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#​12971) (d49a589)
• core, xds: Append child channel configurators instead of overwriting (#​12921) (296c007) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#​12972) (7843bd4) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#​12933) (56205f9) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#​12732) (46f3080) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#​12990) (0f859c3) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#​12924) (0585d48)
• s2a: Default to Post Quantum Cryptography key exchange group (#​12894) (bc01994)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96)
• binder: normalize failed auth future status message (9ffa1e1)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#​12945) (6ccd065). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#​12969) (1bc2f5a)

Documentation

• api: Better explain the executors and how to configure them (ee08f53)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#​12807) (073fd5e) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

@​Zhengcy05
@​carl-mastrangelo
@​themechbro
@​JasonLunn
@​martinbaillie
@​eado
@​TimurRakhmatullin86

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#​12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#​12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#​11901) (2b86f8f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce3). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#​12836) (1e85674) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#​12882) (c8079ee). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b1). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b)
• core: normalize service config number values (#​12826) (663c505) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df). This removes unnecessary log noise
• core: Enable child channel plugins (#​12578) (89aef90). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#​12876) (c886f0a)
• Upgrade various dependencies (064272c):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#​12811) (f94574e)

Thanks to

tian__mi__mi@
codingkiddo@
Zhengcy05@​

v1.82.4

gRPC Java 1.82.4 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#​12941). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#​12943)

v1.82.3

gRPC Java 1.82.3 Release Notes

The fixes that were supposed to go in this release were not included in the patch by mistake. Use 1.82.4 instead.

v1.82.2

Compare Source

• Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (#​12886). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

v1.82.1

Compare Source

• protoc-gen-grpc-java: Fix missing osx-x86_64 binary (#​12878). This fixes a regression in v1.82.0

v1.82.0

Compare Source

This release drops support for Bazel 7. It may still run, but we are no longer testing it. We are testing Bazel 8 and 9.

We are anticipating requiring Netty 4.2 in the next release. Please file an issue if you still need Netty 4.1 support.

Behavior Changes

• xds: Disable Priority LB child policy retention cache (#​12806). Previously, when a priority became inactive, its associated child load balancer was kept in a deactivated state for potential reuse. Now, inactive child balancers are immediately torn down and removed.
• xds: skip DiscoveryRequest for unsubscribed types on stream ready (#​12782). When the bootstrap declares more than one xDS server (e.g. a default server for LDS/CDS plus an authority-specific EDS-only server), grpc-java was sending CDS/LDS DiscoveryRequests to the EDS-only server too. That server replies UNIMPLEMENTED, which tears down the stream and EDS data never arrives. This fix makes it skip DiscoveryRequests for resource types we don't actually subscribe to on a given server.

Improvements

• Remove JSR-305 @ThreadSafe annotation and replace with JavaDoc (#​12762). Removes JSR-305 annotations but instead of replacing it with ErrorProne's ThreadSafe, sticks to adding a JavaDoc comment. This is done only in public non-final classes and interfaces. This allows Java applications that have moved away from javax to compile and avoids a bug in Immutables and Lombok (and possibly other annotation processors) from failing when JSR-305 is not present.
• core: Reduce per-stream idle memory on the server by 0.5 KB (b38df6c). The main improvement here is not retaining the request Metadata for the life of the RPC. That means RPCs with larger request Metadata would see a larger benefit.
• core: Clarify missing content-type on HTTP error responses (#​12720). Adjusts the diagnostic for the missing rather than invalid content-type, in the Status description.
• core: throw IOException when ProxySelector returns null or empty list (#​12793). ProxySelector.select(URI) is required to return a non-null, non-empty list. Some implementations violate this, which previously caused an opaque crash in ProxyDetectorImpl. Now it detects this case explicitly and fails gracefully, naming the offending ProxySelector class to help with debugging.
• okhttp: enable TLS 1.3 by default for Android clients, retain TLS 1.2-only for desktop JVM (f430131)
• xds: Reduce per-endpoint memory from CDS LB (cc0d1a8). This is most noticeable when there are many endpoints returned by EDS, but the LB policy only uses a few of them, like pick_first.
• xds: pre-parse custom metric names in WRR load balancer (#​12773) (324fce7). This reduces the per-RPC overhead of the gRFC A114 support added in v1.81.0
• xds: Propagate status cause through XdsDepManager (13b4b97). This preserves more information for failures communicating with the control plane.
• binder: Give clear error when message is larger than parcel (d92ca44)

Bug Fixes

• xds: Trust Manager fix for certain scenarios where SAN validation shouldn't use the SNI sent (#​12775) (bb153a8).
• core: Cancel DelayedClientCall when application listener throws (#​12761). Align DelayedClientCall.DelayedListener with ClientCallImpl's existing behavior for listener exceptions. When the application listener throws from onHeaders/onMessage/onReady, catch the Throwable, cancel the call with CANCELLED (cause = the throwable), and swallow subsequent callbacks. Previously, a throw from the application listener escaped to the callExecutor's uncaught-exception handler. The real call was not cancelled and the transport kept delivering callbacks to an already broken listener
• core,opentelemetry: Fix server metric labels on early close (#​12774). Addresses the server-side OpenTelemetry metric labeling bug where a generated method can be recorded as grpc.method="other" if streamClosed() happens before serverCallStarted().
• core: Fix pick_first NPE with GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=true when accepting resolved addresses and in CONNECTING state (#​12814). It makes sure that whenever PickFirstLeafLoadBalancer transitions into CONNECTING the current address in the addressIndex has a corresponding subchannel. This prevents an NPE in acceptResolvedAddresses in some situations.
• okhttp: HPACK should fail on varint overflow (ec10992). This should have no visible impact in normal use. It mostly just makes it easier to debug broken implementations
• xds: When using the file watcher certificate provider, reload cert/key even if only one of them changes (f4125c5)
• compiler: Avoid compile error on weird proto file names (f021bef)

New Features

• googleapis: support ?force-xds query parameter in the google-c2p resolver (#​12760) (86fa860). This disables environment checks and uses xDS unconditionally. Please note that this feature has not yet seen comprehensive testing.

Dependencies

• Upgrade Netty to 4.1.133 (ada087b)
• bazel: Upgrade googleapis proto repo to commit 1dbb1a1 (ec0a9c9). This fixed a rules_go incompatibility issue with Bazel 9.1. But it also greatly reduced the overall transitive dependencies, as the C++ grpc repo is no longer a dependency
• bazel: Upgrade workflows to Bazel 8 (039ad77) add Bazel 9.1.0 to our CI matrix (17be0d3)
• protoc-gen-grpc-java: Linux binaries are now built with Ubuntu 20.04 instead of 18.04 (8802dc3, da98b04)

Thanks to

@​becomeStar
@​bengtsson1-flir
@​jnowjack-lucidchart
@​Kainsin
@​kenkangxgwe
@​mfperminov
@​paulmurhy123
@​schiemon
@​therepanic

v1.81.1

Compare Source

• Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (#​12887). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

v1.81.0

Compare Source

In this release we drop support for Android API level 22 or lower (Lollipop or earlier), following Google Play Service’s discontinued updates for Lollipop (API levels 21 & 22) and now requires a minimum of API level 23 (Android 6.0 Marshmallow).

API Changes

• api: Deprecate LoadBalancer.handleResolvedAddresses(). Developers maintaining custom LoadBalancer implementations should transition to using LoadBalancer.acceptResolvedAddresses(). Unlike the deprecated method, acceptResolvedAddresses() returns a Status object, allowing the load balancer to explicitly report success or reject the update if the provided addresses or configuration are invalid. (#​11623)

Behavior Changes

• core: Enable dns "caching" on Android for 30 seconds to reduce CPU impact of a refresh loop with an LB policy (0675f70). DnsNameResolver ignores re-resolution requests on OpenJDK-like platforms if it has been too soon since the last DNS query because InetAddress.getAllByName() has a cache with a fixed entry lifetime, but this logic was disabled for Android which does not have that style of cache. Android’s cache uses the result TTL, which will rarely be less than 30 seconds. This change would probably be most noticeable when 1) changing to a different network (e.g., from wifi to mobile), 2) the server has different addresses for different networks, and 3) the app is not using AndroidChannelBuilder with an android.context.Context. For reference, it seems Chrome caches for 1 minute
• xds: reuse connections to the control plane across channels (e39c38b). Previously each channel using the xds name resolver would create its own channel to communicate with the control plane. Now they share control plane channels, while still having separate RPCs

Bug Fixes

• opentelemetry: Fix baggage propagation, the baggage propagation for opentelemetry introduced in #​12389 was broken. The context is decided once and used for all recording for the call, thus guaranteeing all record()s have consistent information.
• core: Address a race condition where ManagedChannelOrphanWrapper could incorrectly log a "not shutdown properly" warning during garbage collection when using directExecutor(). (#​12705) (d459338)
• xds: Fix xDS HTTP CONNECT's transport socket name bug which is now corrected to use typeUrl. (#​12740) (eac9fe9)
• xds: Fix an issue where subchannel metrics were dropping their association with the backend_service. This ensures xDS load balancing metrics are reported accurately. (#​12735)

New Features

• netty: Add tcp metrics, by implementing a few of the metrics defined in A80.
• api: Add a CallOption for a custom label on per-RPC metrics (0e39b29). This CallOption is copied by grpc-opentelemetry to the grpc.client.call.custom label as defined by gRFC A108. See also the gRPC OpenTelemetry Metrics guide (update in-progress)
• xds: Add support for Weighted Round Robin (WRR) load balancing driven by custom backend metrics, implementing the behavior defined in gRFC A114. (#​12645)
• utils: Update AdvancedTlsX509KeyManager so that developers can now preserve and use key aliases when dynamically reloading TLS certificates. (#​12686)

Documentation

• Update the "Outgoing Flow Control" section in the Manual Flow Control example to say onNext() does not block, but rather queues the messages in memory and advises developers to use CallStreamObserver.isReady() to prevent this memory exhaustion (#​12700) (a3a9ffc) (#​12726) (65ae2ef)
• examples: Clean up Health example, and document need for grpc-services (3ed732f)

Dependencies

• Upgrade Dependencies (#​12719) (16e17ab). Google-auth-library: 1.42.1, animal-sniffer: 1.27, assertj-core:3.27.7, error_prone_annotations:2.48.0, proto-google-common-protos:2.64.1, google-cloud-logging:3.23.10, jetty-http2-server:12.1.7, jetty-ee10-servlet:12.1.7, lincheck:3.4, opentelemetry-api:1.60.1, opentelemetry-exporter-prometheus:1.60.1-alpha, opentelemetry-gcp-resources:1.54.0-alpha, opentelemetry-sdk-extension-autoconfigure:1.60.1, opentelemetry-sdk-testing:1.60.1, robolectric:4.16.1, tomcat-embed-core:10.1.52, tomcat-embed-core9: 9.0.115,
• Upgrade Netty to 4.1.132 and netty-tcnative to 2.0.75 (1528f80)

Thanks to

• @​becomeStar
• @​benjaminp
• @​JoeCqupt
• @​Kainsin
• @​merlimat
• @​SreeramdasLavanya
• @​themechbro
• @​zhangweikop

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.