Bump io.grpc:grpc-protobuf from 1.75.0 to 1.76.0 (#360)

dependabot[bot] · web-flow · commit 8d0d3fa95ca5 · 2025-10-13T07:12:07.000-07:00
Bumps [io.grpc:grpc-protobuf](https://github.com/grpc/grpc-java) from 1.75.0 to 1.76.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-java/releases">io.grpc:grpc-protobuf's releases</a>.</em></p> <blockquote> <h2>v1.76.0</h2> <h3>Bug Fixes</h3> <ul> <li><strong>xds:</strong> ClusterResolverLb has been converted to use XdsDepManager, which finishes the changes for <a href="https://github.com/grpc/proposal/blob/master/A74-xds-config-tears.md">gRFC A74 xDS Config Tears</a>. This change should resolve some unnecessary reconnections introduced in v1.75.0 when using weighted_round_robin and maybe other policies.</li> <li><strong>compiler:</strong> A fix has been implemented for the blockingV2 stub to mangle generated method names that conflict with java.lang.Object methods.</li> <li><strong>servlet:</strong> A race condition in AsyncServletOutputStreamWriter has been fixed to prevent threads from getting stuck.</li> <li><strong>servlet:</strong> An issue where AsyncContext.complete() was called multiple times, causing an IllegalStateException, has been resolved.</li> <li><strong>binder:</strong> The REMOTE_UID is now required to hold the exact UID passed to the SecurityPolicy.</li> <li><strong>binder:</strong> The server will now only accept post-setup transactions from the authorized server UID.</li> <li><strong>util:</strong> AdvancedTlsX509TrustManager now errors with a message to say that files don’t exist instead of the previous “Files were unmodified before their initial update. Probably a bug.”</li> <li><strong>android:</strong> A fix has been implemented for network change handling on API levels below 24.</li> </ul> <h3>Improvements</h3> <ul> <li><strong>api:</strong> Allocations of Attributes.Builder have been reduced. This mostly benefits attributes.toBuilder(), but that’s not expected to be visible in regular workloads.</li> <li><strong>api:</strong> An empty array allocation in LoadBalancer.CreateSubchannelArgs.Builder has been avoided. It is a small optimization and is not expected to have any performance impact.</li> <li><strong>servlet:</strong> A configurable methodNameResolver has been added to configure the mapping from servlet request paths to gRPC method name</li> <li><strong>servlet:</strong> Avoid a race by increasing the AsyncContext timeout by 5 seconds. The gRPC Context timeout should trigger first</li> <li><strong>xds:</strong> Pretty-print envoy.service.discovery.v3.Resource in debug logs</li> <li><strong>bazel:</strong> The java/proto rules from rules_java/rules_proto are now used instead of native rules.</li> <li><strong>bazel:</strong> Unnecessary direct build dependencies were removed from some targets</li> <li><strong>netty:</strong> Support for the BCJSSE provider has been added in GrpcSslContexts.</li> <li><strong>netty:</strong> Huffman coding in server response headers has been disabled; it was already disabled for client request headers</li> <li><strong>netty:</strong> Include allow header for HTTP response code 405</li> <li><strong>okhttp:</strong> Include allow header for HTTP response code 405</li> <li><strong>binder:</strong> Error descriptions for ServiceConnection callbacks have been improved</li> <li><strong>binder:</strong> Apps can now call SecurityPolicy.checkAuthorization() by PeerUid.</li> </ul> <h3>New Features</h3> <ul> <li><strong>stub:</strong> Trailers are now propagated in StatusException when thrown by BlockingClientCall.</li> <li><strong>compiler:</strong> Support for macOS aarch64 with a universal binary has been added.</li> <li><strong>opentelemetry:</strong> grpc.subchannel.* metrics as described in <a href="https://github.com/grpc/proposal/blob/master/A94-subchannel-otel-metrics.md">gRFC A94 OTel metrics for Subchannels</a> have been added. grpc.disconnect_error will show as “unknown” until transports implement support</li> <li><strong>binder:</strong> A NameResolver for Android's intent: URIs has been introduced.</li> <li><strong>binder:</strong> A basic SocketStats with just the local and remote addresses has been added for channelz.</li> </ul> <h3>Documentation</h3> <ul> <li><strong>SECURITY.md:</strong> The documentation now describes how to use gcompat with LD_PRELOAD for Alpine.</li> <li><strong>examples:</strong> The documentation now explains Bazel BCR releases and the git_override option.</li> </ul> <h3>Dependencies</h3> <ul> <li>Upgraded Guava version to 33.4.8.</li> <li>The org.apache.tomcat:annotations-api dependency has been removed from the examples.</li> </ul> <h3>Thanks to</h3> <p>@<a href="https://github.com/JoeCqupt">JoeCqupt</a> @<a href="https://github.com/Sangamesh1997">Sangamesh1997</a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-java/commit/d0db12973952b6269a7fa36e2222ed9cd69177b6"><code>d0db129</code></a> Bump version to 1.76.0</li> <li><a href="https://github.com/grpc/grpc-java/commit/aa672ca1253a88466330b6feee6a7be2e9a79335"><code>aa672ca</code></a> Update README etc to reference 1.76.0</li> <li><a href="https://github.com/grpc/grpc-java/commit/70b7249da82ccb069e1657e635ef54d88088ac79"><code>70b7249</code></a> netty: Unconditionally disable adaptive cumulator (<a href="https://redirect.github.com/grpc/grpc-java/issues/12390">#12390</a>)</li> <li><a href="https://github.com/grpc/grpc-java/commit/f89d1d8fd449da2fe8e619fcf92003992eeadaa2"><code>f89d1d8</code></a> api: remove nullable from StatusOr value methods (<a href="https://redirect.github.com/grpc/grpc-java/issues/12338">#12338</a>)</li> <li><a href="https://github.com/grpc/grpc-java/commit/040665f2438ec04c1d5144a99c84cf7aa4ade3c1"><code>040665f</code></a> examples: Explain Bazel BCR releases and git_override option</li> <li><a href="https://github.com/grpc/grpc-java/commit/4995700069ad31d11d846900cc62df35001653fb"><code>4995700</code></a> xds: Remove verify TODO for onResult2 error status</li> <li><a href="https://github.com/grpc/grpc-java/commit/afe72220d0aaa205b9d7cc8a291c2707510854f1"><code>afe7222</code></a> SECURITY.md: Mention gcompat for Alpine (<a href="https://redirect.github.com/grpc/grpc-java/issues/12365">#12365</a>)</li> <li><a href="https://github.com/grpc/grpc-java/commit/1a7042ac98a8fda6d4332563891131f75b1edb36"><code>1a7042a</code></a> android: fix network change handling on API levels &lt; 24</li> <li><a href="https://github.com/grpc/grpc-java/commit/8f0db07d5d1a0f7b234db5740f7419e996c84425"><code>8f0db07</code></a> api: Avoid allocating empty array in LoadBalancer (<a href="https://redirect.github.com/grpc/grpc-java/issues/12337">#12337</a>)</li> <li><a href="https://github.com/grpc/grpc-java/commit/0c179e3f9e8c4306578f00ecdab2b37480ea780e"><code>0c179e3</code></a> xds: Convert ClusterResolverLb to XdsDepManager</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-java/compare/v1.75.0...v1.76.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.grpc:grpc-protobuf&package-manager=gradle&previous-version=1.75.0&new-version=1.76.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -13,7 +13,7 @@ buf = { module = "build.buf:buf", version.ref = "buf" }
 cel = { module = "dev.cel:cel", version.ref = "cel" }
 errorprone-annotations = { module = "com.google.errorprone:error_prone_annotations", version.ref = "error-prone" }
 errorprone-core = { module = "com.google.errorprone:error_prone_core", version.ref = "error-prone" }
-grpc-protobuf = { module = "io.grpc:grpc-protobuf", version = "1.75.0" }
+grpc-protobuf = { module = "io.grpc:grpc-protobuf", version = "1.76.0" }
 jspecify = { module ="org.jspecify:jspecify", version = "1.0.0" }
 junit-bom = { module = "org.junit:junit-bom", version.ref = "junit" }
 maven-plugin = { module = "com.vanniktech:gradle-maven-publish-plugin", version.ref = "maven-publish" }
