chore(deps): update upper bound dependencies file - #13946
Open
renovate-bot wants to merge 1 commit into
Open
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
renovate-bot
force-pushed
the
renovate/upper-bound-dependencies-file
branch
from
July 30, 2026 01:19
5faa7c4 to
41bd95e
Compare
renovate-bot
changed the title
renovate-bot
force-pushed
the
renovate/upper-bound-dependencies-file
branch
3 times, most recently
from
July 31, 2026 16:23
8e9d9eb to
a5512a3
Compare
lqiu96
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
renovate-bot
force-pushed
the
renovate/upper-bound-dependencies-file
branch
5 times, most recently
from
August 13, 2026 19:05
2d29b7b to
fab6bb7
Compare
renovate-bot
force-pushed
the
renovate/upper-bound-dependencies-file
branch
5 times, most recently
from
August 18, 2026 06:17
897b576 to
c2accc6
Compare
lqiu96
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
lqiu96
approved these changes
Aug 18, 2026
renovate-bot
force-pushed
the
renovate/upper-bound-dependencies-file
branch
5 times, most recently
from
August 25, 2026 02:38
309d5ae to
e2fc1e0
Compare
lqiu96
approved these changes
Aug 26, 2026
lqiu96
enabled auto-merge (squash)
August 26, 2026 18:41
auto-merge was automatically disabled
August 31, 2026 17:20
Head branch was pushed to by a user without write access
renovate-bot
force-pushed
the
renovate/upper-bound-dependencies-file
branch
5 times, most recently
from
September 4, 2026 10:49
9e8892f to
3901d6c
Compare
renovate-bot
force-pushed
the
renovate/upper-bound-dependencies-file
branch
from
September 5, 2026 00:59
3901d6c to
5f18bef
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.22.1→2.22.22.9.0→2.9.11.49.0→1.52.01.12.0→1.15.033.6.0-jre→33.7.1-jre4.35.1→4.36.11.22.0→1.22.10.13.1→0.14.01.83.0→1.84.01.64.0→1.65.05.6.2→5.6.42.6.2→2.7.01.0.0→1.0.12.0.18→2.0.191.7.3→1.7.4Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
googleapis/google-api-java-client (com.google.api-client:google-api-client)
v2.9.1Bug Fixes
googleapis/google-cloud-java (com.google.cloud:grpc-gcp)
v1.15.0Compare Source
Features
CreateAudienceList,QueryAudienceList,GetAudienceList,ListAudienceListsmethods to the Data API v1 alpha (#9632) (86f2bb3)2023061(#820) (#9597) (38b6cb1)2023070(#821) (#9628) (ca0d2db)KUBE_DNSoption toDNSConfig.cluster_dns(ef39c21)KUBE_DNSoption toDNSConfig.cluster_dns(#9592) (ef39c21)modelandlanguage_codesfields inRecognitionConfigmessage + enable default_recognizer (#9613) (d14537e)Bug Fixes
Documentation
v1.14.0Compare Source
Features
AdsWebConversionDataExportScopeenum to the Admin API v1alpha (a093cb3)AdsWebConversionDataExportScopeenum to the Admin API v1alpha (e2f7dc3)ads_web_conversion_data_export_scopefield to theReportingAttributionModeltype (a093cb3)ads_web_conversion_data_export_scopefield to theReportingAttributionModeltype (e2f7dc3)default_urifield of theWebStreamDatatype to be mutable (a093cb3)default_urifield of theWebStreamDatatype to be mutable (e2f7dc3)Bug Fixes
Documentation
v1.13.0Compare Source
Features
Bug Fixes
Documentation
apache/commons-codec (commons-codec:commons-codec)
v1.22.1The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.
The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
This is a feature and maintenance release. Java 8 or later is required.
cel-expr/cel-java (dev.cel:cel)
v0.14.0Compare Source
This release officially introduces formal verification capabilities to CEL-Java, adds aggregate evaluation semantics to the CEL Policy Compiler, advances runtime modernization with the Program Planner, and brings key optimizer performance gains, conformance updates, and bug fixes.
🛡️ Formal Verification Framework
We are proud to announce the open-sourcing of the CEL Java Verifier (
dev.cel:verifieranddev.cel:verifier-cli) (#1123, #1166). The verifier allows users to mathematically prove safety invariants, logical equivalence, satisfiability, and validity across CEL expressions and structured CEL Policies.Key Verifier Capabilities
isSatisfiable: Determines if an expression can ever evaluate totrueand generates a concrete satisfying model (witness input) (#1127).isAlwaysTrue: Mathematically proves validity and generates human-readable counterexamples when violations are detected (#1126, #1136, #1156, #1161, #1163).assumepreconditions andassertclauses in CEL YAML policies and prove that safety invariants are never violated (#1128, #1144).all,exists,map,filter) up to configurable unroll limits (#1129, #1132, #1174).timestampanddurationarithmetic/axioms (#1153), optional types and traversal (#1131, #1135, #1138, #1146), uninterpreted conversions (#1154, #1155), and JSON unwrapping (#1147).dev.cel:verifier-cli) and interactive REPL shell for ad-hoc inspection and CI/CD validation (#1159, #1160, #1168).🚀 Highlights & New Features
map<string, int>,list<string>, andoptional<T>to be declared as compact strings rather than verbose nested YAML structures.ConstantFoldingOptimizernow supports inlining evaluated Protobuf messages into structured message literal AST nodes, preserving field values and nested messages (#1116).⚙️ Runtime & Optimizer Improvements
🐛 Bug Fixes & Correctness
AccumulatedUnknownsduring partial evaluation (#1158).ConstantFoldingOptimizerto not treattrue && dyn_xas a tautology (#1133).x in [x]for dynamic and double-typed variables to preserve correct numeric equivalence semantics (#1162).all,exists,map,filter) to disallow identifiers starting with.and prevent collisions with internal__result__accumulator variables (#1096).optMapandoptFlatMap(#1149).👏 New Contributors
AccumulatedUnknownshandling in the planner (#1158).Full Changelog: cel-expr/cel-java@v0.13.1...v0.14.0
grpc/grpc-java (io.grpc:grpc-bom)
v1.84.0Compare Source
In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).
API Changes
ac02c6f)XdsServerBuilderwithSocketAddresses (#12925) (ac02c6f)6966536)Behavior Changes
96807d8)Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.
Bug Fixes
72c6e5f)Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
shutdownNow()becoming a no-op aftershutdown()(#12982) (3cb7007)d49a589)296c007) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.7843bd4) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.Improvements
56205f9) Configure max active streams limit directly uponDefaultHttp2Connectioninitialization. BecauseNettyServerHandlerinstantiatesDefaultHttp2Connectiondirectly rather than using Netty'sAbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.AsyncServletOutputStreamWriterdetect and handle write when not ready (#12732) (46f3080) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.0f859c3) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates0585d48)bc01994)9fdef96)9ffa1e1)Dependencies
6ccd065). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.5d0a012)1bc2f5a)Documentation
ee08f53)New Features
073fd5e) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.Thanks to
@Zhengcy05
@carl-mastrangelo
@themechbro
@JasonLunn
@martinbaillie
@eado
@TimurRakhmatullin86
v1.83.1Compare Source
gRPC Java 1.83.1 Release Notes
Improvements
open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)
v1.65.0Compare Source
NOTE: The
opentelemetry-exporter-zipkinartifact has stopped being published. It wasdeprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector
exporter.
API
ImmutableBaggage.put(#8658)
NumberFormatExceptionin baggage decoder(#8593)
TraceStateBuilder.removecorrupting the builder when the same key is removed twice(#8613)
Incubating
BoundLongCounter,BoundDoubleCounter,BoundLongHistogram,BoundDoubleHistogram,BoundLongUpDownCounter,BoundDoubleUpDownCounter,BoundLongGauge,BoundDoubleGauge) to the incubator metrics API(#8527)
Extensions
JaegerPropagatorbaggage header key case sensitivity(#8496)
JaegerPropagator(#8632)
OtTracePropagatorextract(#8631)
jaeger-baggageheader after 64 tokens, including malformedtokens (#8702)
SDK
AttributesMap) to enforce last-value-win semantics basedon string value of
AttributeKey.getKey()(#8548)
Traces
Samplershutdown lifecycle:Samplernow extendsCloseableand exposes a defaultshutdown()invoked when theSdkTracerProvideris shut down;JaegerRemoteSamplerimplementsit to stop its polling executor
(#8574)
Metrics
PeriodicMetricReaderself-observability metrics by internal telemetry version(#8597)
error.typeon failed collections inPeriodicMetricReader(#8650)
LongExemplarAssert.hasFilteredAttributesSatisfyingExactlyto enforce exactattribute matching
(#8518)
Logs
ReadWriteLogRecorddefaultgetObservedTimestampEpochNanosreturning the record timestamp(#8504)
Profiles
(#8514)
Exporters
opentelemetry-exporter-zipkin; the artifact is no longer published(#8677)
HttpExporterwarning logs(#8428)
OkHttpHttpSendermTLS when using the platform default trust store(#8565)
LogRecordflags in the low-allocation log marshaler(#8493)
OkHttpHttpSender,JdkHttpSender, andUpstreamGrpcSendershutdown toawait executor/channel termination
(#8495,
#8627,
#8624)
(#8626)
(#8637)
(#8364)
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.