chore(deps): update upper bound dependencies file

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
com.fasterxml.jackson:jackson-bom	2.22.0 → 2.22.1
com.google.auth:google-auth-library-bom	1.48.0 → 1.49.0
com.google.cloud:grpc-gcp (source)	1.11.0 → 1.12.0
com.google.crypto.tink:tink	1.22.0 → 1.23.0
com.google.http-client:google-http-client	2.1.1 → 2.2.0
io.grpc:grpc-bom	1.82.1 → 1.83.0
io.opentelemetry.semconv:opentelemetry-semconv	1.42.0 → 1.43.0
io.opentelemetry:opentelemetry-bom	1.63.0 → 1.64.0
org.apache.httpcomponents.client5:httpclient5 (source)	5.6.1 → 5.6.2
org.conscrypt:conscrypt-openjdk-uber (source)	2.6.0 → 2.6.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

googleapis/google-cloud-java (com.google.cloud:grpc-gcp)

v1.12.0

Compare Source

Features

• [aiplatform] add match service in aiplatform v1 (#​9438) (4ab7b4f)
• [analyticsadmin] add GetAdSenseLink, CreateAdSenseLink, DeleteAdSenseLink, ListAdSenseLinks methods to the Admin API v1alpha (#​9434) (d9f948e)
• [batch] add support for placement policies (#​9439) (f30b899)
• [batch] add TaskStatus's new terminated state UNEXECUTED (720796b)
• [batch] support order_by in ListJobs and ListTasks requests (720796b)
• [batch] support order_by in ListJobs and ListTasks requests (#​21) (720796b)
• [batch] support order_by in ListJobs and ListTasks requests (#​9359) (720796b)
• [cloudchannel] added partition_keys field to filter results from FetchReportResults (#​9437) (0857e33)
• [cloudfunctions] ListFunctions now include metadata which indicates whether a function is a GEN_1 or GEN_2 function (#​9462) (d945618)
• [cloudkms] added VerifyConnectivity RPC (#​9429) (81b9849)
• [datamigration] add Oracle to PostgreSQL migration APIs (#​9442) (d3ca29b)
• [discoveryengine] enable safe search feature for site search (#​9428) (7b673de)
• [language] Added client library support for ModerateText in the Natural Language API (V1) (#​9463) (14fea71)
• [rapidmigrationassessment] new module for rapidmigrationassessment (#​9467) (0123f56)
• [webrisk] add SubmitUri endpoint (#​9443) (dd5ddba)
• [workstations] add output field for the control plane IP address (#​9430) (3cba89a)
• add auditd support (3cba89a)
• add output field for the number of pooled instances (3cba89a)
• add scheduling_policy IN_ORDER enum to support sequential task executions (720796b)
• add support for accelerators (3cba89a)
• add support for placement policies (720796b)
• add support for readiness checks (3cba89a)
• add support for workstation-level environment variables (3cba89a)
• allow users to provide additional labels in search (7b673de)
• allow users to provide user info in search (7b673de)
• per-Runnable labels (720796b)
• per-Runnable labels (720796b)

Bug Fixes

• [discoveryengine] fix the field name typo for search service user_labels (#​9440) (eea5883)
• deps: update dependency com.google.cloud:google-cloud-pubsub-bom to v1.123.12 (#​9436) (5df87b6)
• deps: update dependency com.google.cloud:google-cloud-shared-dependencies to v3.10.0 (#​9461) (d9fd655)
• deps: update dependency com.google.cloud:google-cloud-shared-dependencies to v3.10.1 (#​9468) (75847f7)
• deps: update dependency com.google.cloud:google-cloud-storage to v2.22.2 (#​9426) (57a66df)

Documentation

• [container] clarified release channel defaulting behavior for create cluster requests when release channel is unspecified (#​9441) (a9e8b90)
• adjust documentation wording (3cba89a)
• fix book disk typo (720796b)
• update block_external_network field comment to reduce confusion (720796b)
• update comments on boot disk fields for clearer usage scope (720796b)
• update disk and network field comment for better readability (720796b)
• Update reservation field API doc (720796b)

tink-crypto/tink-java (com.google.crypto.tink:tink)

v1.23.0: Tink Java v1.23.0

Compare Source

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.23.0.

The complete list of changes since 1.22.0 can be found here.

• Upgraded dependencies:
  • com.google.protobuf:protobuf-java -> 4.33.6
• Upgraded Bazel version to 9.

Maven:

<dependency>
    <groupId>com.google.crypto.tink</groupId>
    <artifactId>tink</artifactId>
    <version>1.23.0</version>
</dependency>

Gradle:

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.23.0'
}

Bazel:

Using bzlmod

bazel_dep(name = "tink_java")

git_override(
    module_name = "tink_java",
    remote = "https://github.com/tink-crypto/tink-java",
    tag = "v1.23.0",
)

googleapis/google-http-java-client (com.google.http-client:google-http-client)

v2.2.0

Compare Source

Features

• pqc: Replace provider-specific PQC TLS setup with generic SslSocketConfigurator callback (#​2167) (93e1ee7)

grpc/grpc-java (io.grpc:grpc-bom)

v1.83.0

Compare Source

gRPC Java 1.83.0 Release Notes

API Changes

• api: Turn on RFC 3986 parsing by default and update javadoc. (4456721)
• api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#​11901) (2b86f8f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

• okhttp: enable TLS 1.3 for servers on Android (3018ce3). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
• xds: enable orca to lrs propagation by default (#​12836) (1e85674) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
• xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#​12882) (c8079ee). This only has an effect when using aggregate clusters
• xds: Hold parsed service config in CdsUpdate (3db3235). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
• xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b1). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

• api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b)
• core: normalize service config number values (#​12826) (663c505) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
• core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
• netty: Reduce TcpMetrics log from INFO to FINE (4ec83df). This removes unnecessary log noise
• core: Enable child channel plugins (#​12578) (89aef90). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

• Upgrade to Netty 4.2.15 (66c6ab1). If you need Netty 4.1 support, please file an issue
• Upgrade codegen plugin to C++ Protobuf 35.1 (#​12876) (c886f0a)
• Upgrade various dependencies (064272c):
  • gson to 2.14.0
  • guava to 33.6.0
  • cel-java to 0.13.0
  • protobuf-java to 3.25.9
  • error-prone-annotations to 2.50.0
  • opentelemetry to 1.63.0

Documentation

• Document how to build with Bazel and introduce bazel support for building android and binder (#​12811) (f94574e)

Thanks to

tian__mi__mi@
codingkiddo@
Zhengcy05@​

v1.82.2

• Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (#​12886). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

open-telemetry/semantic-conventions-java (io.opentelemetry.semconv:opentelemetry-semconv)

v1.43.0

Compare Source

• Bump to semconv v1.43.0
  (#​518)

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)

v1.64.0

API

• Fix W3CBaggagePropagator to allow empty baggage values per W3C spec
  (#​8468)
• Fix baggage parsing for invalid percent-encoded members
  (#​8480)

Incubating

• BREAKING Remove deprecated InstrumentationConfigUtil.peerServiceMapping
  (#​8542)
• Fix EnvironmentGetter/EnvironmentSetter to not enumerate or normalize carrier entries, and
  normalize empty names consistently
  (#​8474,
  #​8481)

SDK

Traces

• Add BatchSpanProcessor.create(SpanExporter) convenience factory to mirror
  SimpleSpanProcessor.create(SpanExporter)
  (#​8564)
• Fix BatchSpanProcessor benchmark aux counters (exportedSpans/droppedSpans) always
  reporting zero
  (#​8539)

Metrics

• Fix PooledHashMap dropping live entries when an entry is removed during forEach
  (#​8499)
• Safely initialize exemplar reservoir storage in FixedSizeExemplarReservoir
  (#​8524)
• Use failExceptionally in PeriodicMetricReader when the exporter is busy
  (#​8525)
• Only set valuesRecorded in AggregatorHandle when false
  (#​8559)
• Use volatile instead of atomics in Double/LongLastValueAggregator
  (#​8560)
• Randomize per-thread recording order in metric benchmarks to avoid concurrency hotspots
  (#​8550)

Logs

• Fix BatchLogRecordProcessor worker thread being killed by non-runtime exceptions
  (#​8529)

Exporters

• BREAKING Prometheus: Drop deprecated PrometheusMetricReader constructors
  (#​8541)
• OTLP: Reject host-less endpoints in EndpointUtil.validateEndpoint
  (#​8489)
• OTLP: Replace Jackson OTLP JSON serialization with a hand-rolled implementation
  (#​8545)
• OTLP Profiles: Fix OtlpGrpcProfileExporter toString class name
  (#​8492)
• Prometheus: Add translation strategy support
  (#​8346)
• Prometheus: Fix serialization of array-valued scope and resource attributes to JSON strings
  (#​8497)

Extensions

• BREAKING Declarative config: Move experimental types to internal package
  (#​8530)
• Declarative config: Commit generated schema POJOs to git
  (#​8408)
• Declarative config: Update to opentelemetry-configuration v1.1.0
  (#​8451)
• Declarative config: Adjust POJO toString/hashCode/equals to match AutoValue semantics
  (#​8526)
• Declarative config: Add ref descriptions to generated model classes
  (#​8540)
• Declarative config: Emit consistent @JsonProperty annotations on generated models
  (#​8563)
• Declarative config: Remove duplicate resolver in DeclarativeConfigPropertyUtil
  (#​8579)

Project tooling

• Add configuration policy guidance
  (#​8429)
• Exclude certain GitHub Actions from running on forks
  (#​8466)
• Add guidance to prefer parameterized tests
  (#​8469)
• Make benchmark path configurable
  (#​8557)

google/conscrypt (org.conscrypt:conscrypt-openjdk-uber)

v2.6.1

Compare Source

• Fixes #​1519
• Fixes #​1499 (comment)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the dependency version of org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 in sdk-platform-java/dependencies.txt. There are no review comments, and I have no feedback to provide.