deps: Bump grpc-java to v1.76.0 #3942

lqiu96 · 2025-10-15T18:53:04Z

This PR bumps the gRPC gen code and runtime versions from v1.71.0 to v1.76.0.

Notable in this version bump, the V2 gen code unary call API from gRPC now throws a new CheckedException StatusException that users will need to catch. This was part of gRPC 1.74.0 (compiler: generate blocking v2 unary calls that throw StatusException grpc/grpc-java#12126)

Changes

Bump the gRPC runtime in the pom to v1.76.0
Bump the gRPC gen code version in the hermetic build docker image to v1.76.0
Add new GraalVM configs for some JCTool classes. These classes are pulled in from gRPC -> shaded netty -> shaded JCTools. This came from gRPC-Java upgrading the Netty version to v4.1.124. Netty v4.1.115 uses a new method in JCTools (Use unpadded JCtools qs for MemoryRegionCache (#12496) netty/netty#14426)
Update the WORKSPACE file to download bazel_jar_jar as part of this PR (bazel: Use jarjar to avoid xds deps grpc/grpc-java#12243) in gRPC-Java v1.75.0

gemini-code-assist · 2025-10-15T18:53:15Z

Summary of Changes

Hello @lqiu96, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the grpc-java dependency to version 1.76.0. This ensures the project benefits from the latest features, bug fixes, and performance enhancements provided by the gRPC library, maintaining compatibility and leveraging the most current stable release.

Highlights

gRPC Java Version Update: The grpc.version in the pom.xml has been updated from 1.71.0 to 1.76.0.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

mpeddada1 · 2025-10-15T18:53:48Z

/gcbrun

lqiu96 · 2025-10-15T18:55:33Z

Enforcer:

Error: Require upper bound dependencies error for com.google.guava:guava:33.4.0-jre paths to dependency are: Error: +-com.google.api.grpc:grpc-google-common-protos:2.61.4-SNAPSHOT Error: +-com.google.guava:guava:33.4.0-jre Error: and Error: +-com.google.api.grpc:grpc-google-common-protos:2.61.4-SNAPSHOT Error: +-io.grpc:grpc-api:1.76.0 Error: +-com.google.guava:guava:33.4.0-jre [runtime] (managed) <-- com.google.guava:guava:33.4.8-android [runtime]

Looks like I'll need to bump guava in sdk-platform-java

mpeddada1

Ah looks like the enforcer check is failing:

 Require upper bound dependencies error for com.google.guava:guava:33.4.0-jre paths to dependency are: Error: +-com.google.api.grpc:grpc-google-common-protos:2.61.4-SNAPSHOT Error: +-com.google.guava:guava:33.4.0-jre Error: and Error: +-com.google.api.grpc:grpc-google-common-protos:2.61.4-SNAPSHOT Error: +-io.grpc:grpc-api:1.76.0 Error: +-com.google.guava:guava:33.4.0-jre [runtime] (managed) <-

gemini-code-assist

Code Review

This pull request updates the grpc-java dependency from version 1.71.0 to 1.76.0. The version is updated in the parent pom.xml, which is the correct approach for managing dependency versions consistently across the project. The change is straightforward and looks good.

Update to the `chore:` type so it doesn't show up in the release notes

lqiu96 · 2025-10-16T15:46:11Z

Error:

(15:45:05) DEBUG: Repository com_google_googleapis instantiated at: /home/runner/work/sdk-platform-java/sdk-platform-java/WORKSPACE:27:13: in <toplevel> Repository rule http_archive defined at: /home/runner/.cache/bazel/_bazel_runner/cf5fb8c2c66b8a944ea6af7c9b248db5/external/bazel_tools/tools/build_defs/repo/http.bzl:387:31: in <toplevel> (15:45:05) ERROR: Failed to load Starlark extension '@@envoy_api//bazel:repositories.bzl'. Cycle in the workspace file detected. This indicates that a repository is used prior to being defined. The following chain of repository dependencies lead to the missing definition. - @@envoy_api This could either mean you have to add the '@@envoy_api' repository with a statement like `http_archive` in your WORKSPACE file (note that transitive dependencies are not added automatically), or move an existing definition earlier in your WORKSPACE file. (15:45:05) ERROR: Error computing the main repository mapping: cycles detected during computation of main repo mapping

lqiu96 · 2025-10-16T20:27:44Z

Going to mark this as Do not merge for now. This has some changes in the gRPC gen code tool that seem to be source breaking changes for customers who directly interact with our gRPC stubs.

Will figure out a direction once we coordinate with the gRPC folks.

lqiu96 · 2025-10-27T19:01:40Z

Going to mark this as Do not merge for now. This has some changes in the gRPC gen code tool that seem to be source breaking changes for customers who directly interact with our gRPC stubs.

Will figure out a direction once we coordinate with the gRPC folks.

After some discussions, we are fine with upgrading to grpc-java v1.76.0. Merging this in for the next release cycle.

lqiu96 · 2025-10-30T15:06:49Z

/gcbrun

lqiu96 · 2025-10-30T15:28:05Z

/gcbrun

lqiu96 · 2025-10-30T15:53:59Z

/gcbrun

lqiu96 · 2025-10-30T19:29:11Z

gax-java/gax-grpc/src/main/java/com/google/api/gax/grpc/nativeimage/GrpcNettyFeature.java

+ registerForUnsafeFieldAccess(
+ access,
+ NETTY_SHADED_PACKAGE
+ + "org.jctools.queues.unpadded.MpscUnpaddedArrayQueueProducerIndexField",
+ "producerIndex");
+ registerForUnsafeFieldAccess(
+ access,
+ NETTY_SHADED_PACKAGE
+ + "org.jctools.queues.unpadded.MpscUnpaddedArrayQueueProducerLimitField",
+ "producerLimit");
+ registerForUnsafeFieldAccess(
+ access,
+ NETTY_SHADED_PACKAGE
+ + "org.jctools.queues.unpadded.MpscUnpaddedArrayQueueConsumerIndexField",
+ "consumerIndex");


These are essentially copies of the padded versions of above Mpsc classes. I think it's possible just to replace the padded above since new version of netty shaded within gRPC doesn't call the padded variant anymore.

I have kept both padded and unpadded for now as I don't know the impact if I just replace it. I don't think there is any harm is "overregistering" for GraalVM but can remove if there is.

diegomarquezp

LGTM, just a minor question and nit. Thanks for the upgrade.

diegomarquezp · 2025-10-30T20:07:35Z

...-protos/grpc-google-common-protos/src/main/java/com/google/cloud/location/LocationsGrpc.java

 * [Location.metadata][google.cloud.location.Location.metadata] field.
 * </pre>
 */
-@javax.annotation.Generated(


I think everything here comes strictly from grpc-gen, right? Otherwise I wonder if some postprocessing step stopped adding this annotation.

This is from grpc gen code. grpc/grpc-java@f8700a1

diegomarquezp · 2025-10-30T20:10:34Z

WORKSPACE

 grpc_java_repositories()

-load("@envoy_api//bazel:repositories.bzl", "api_dependencies")
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")


nit: would it make sense to add a quick explainer on how grpc needs this and maybe reference grpc/grpc-java#12243?

Added a few comments above about the changes

I think the WORKSPACE file in googleapis needs this change as well, can we follow up on that once this change is released?

Yes! That is the plan!

sonarqubecloud · 2025-10-30T20:43:26Z

Quality Gate failed for 'gapic-generator-java-root'

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)
B Reliability Rating on New Code (required ≥ A)
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

sonarqubecloud · 2025-10-30T20:47:16Z

Quality Gate failed for 'java_showcase_integration_tests'

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

🤖 I have created a release *beep* *boop* --- <details><summary>2.64.0</summary> ## [2.64.0](v2.63.0...v2.64.0) (2025-10-31) ### Features * [common-protos] Add `Carousel` widget ([1e4a7e5](1e4a7e5)) * **librariangen:** add generate package ([#3952](#3952)) ([2f6c75d](2f6c75d)) * **librariangen:** generate grpc stubs and resource helpers ([#3967](#3967)) ([452d703](452d703)) ### Dependencies * Bump grpc-java to v1.76.0 ([#3942](#3942)) ([ffb557c](ffb557c)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

With the [recent upgrade of grpc](#3942), the transitive dependency on `opentelemetry-api` was bumped to 1.52.0 as per grpc/grpc-java@f30964a. In order to prevent upper bound dependency warnings (as in googleapis/java-storage#3381), we update opentelemetry.version to 1.52.0

deps: Bump grpc-java to v1.76.0

51effdd

lqiu96 requested a review from mpeddada1 October 15, 2025 18:53

product-auto-label bot added the size: xs Pull request size is extra small. label Oct 15, 2025

mpeddada1 previously approved these changes Oct 15, 2025

View reviewed changes

mpeddada1 reviewed Oct 15, 2025

View reviewed changes

gemini-code-assist bot reviewed Oct 15, 2025

View reviewed changes

lqiu96 and others added 4 commits October 16, 2025 14:46

Merge branch 'main' into upgrade-grpc-java

d8fb3ce

chore: Upper bound file deps change has chore type (#3949)

d879011

Update to the `chore:` type so it doesn't show up in the release notes

chore: Update dependencies.properties and cloudbuild docker files

0aead11

lqiu96 dismissed mpeddada1’s stale review via 0aead11 October 16, 2025 15:35

product-auto-label bot added size: s Pull request size is small. and removed size: xs Pull request size is extra small. labels Oct 16, 2025

Merge branch 'main' into upgrade-grpc-java

d1ead1f

product-auto-label bot added size: xs Pull request size is extra small. and removed size: s Pull request size is small. labels Oct 16, 2025

mpeddada1 previously approved these changes Oct 16, 2025

View reviewed changes

chore: generate libraries at Thu Oct 16 15:45:27 UTC 2025

01d3b8b

cloud-java-bot dismissed mpeddada1’s stale review via 01d3b8b October 16, 2025 15:47

product-auto-label bot added size: l Pull request size is large. and removed size: xs Pull request size is extra small. labels Oct 16, 2025

chore: Resolve bazel issue

cb6ffdc

lqiu96 added the do not merge Indicates a pull request not ready for merge, due to either quality or timing. label Oct 16, 2025

BenWhitehead mentioned this pull request Oct 21, 2025

CVE-2025-55163 through grpc-netty-shaded-1.71.0.jar googleapis/java-storage#3338

Open

lqiu96 added 5 commits October 29, 2025 23:58

chore: Add missing slash

2eee060

chore: Try multiple args in native-image.properties file

5ca594e

chore: Add the unpadded versions to be registered for unsafe access

b76820d

chore: Add the unpadded versions to be registered for unsafe access

50b1690

chore: Add the unpadded versions to be registered for unsafe access

e96f5e1

lqiu96 added 2 commits October 30, 2025 11:18

chore: Use the correct unpadded package

ba207e7

chore: Fix lint issues

bca799b

chore: Update the hermetic build ITs to use generator v2.63.0

8bb82fa

lqiu96 commented Oct 30, 2025

View reviewed changes

lqiu96 requested review from blakeli0 and diegomarquezp October 30, 2025 20:04

mpeddada1 previously approved these changes Oct 30, 2025

View reviewed changes

diegomarquezp reviewed Oct 30, 2025

View reviewed changes

chore: Update WORKSPACE file with comments about new jar_jar changes

4756e8b

lqiu96 dismissed mpeddada1’s stale review via 4756e8b October 30, 2025 20:25

chore: Fix comments in WORKSPACE file

e989297

blakeli0 approved these changes Oct 30, 2025

View reviewed changes

lqiu96 enabled auto-merge (squash) October 30, 2025 20:49

lqiu96 merged commit ffb557c into main Oct 30, 2025
59 of 61 checks passed

lqiu96 deleted the upgrade-grpc-java branch October 30, 2025 20:51

release-please bot mentioned this pull request Oct 24, 2025

chore(main): release 2.64.0 #3954

Merged

Donnerbart mentioned this pull request Nov 3, 2025

Release artifact is missing on Maven Central #3978

Closed

diegomarquezp mentioned this pull request Nov 5, 2025

deps: bump opentelemetry.version to 1.52.0 #3979

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps: Bump grpc-java to v1.76.0 #3942

deps: Bump grpc-java to v1.76.0 #3942

Uh oh!

lqiu96 commented Oct 15, 2025 •

edited

Loading

gemini-code-assist bot commented Oct 15, 2025

mpeddada1 commented Oct 15, 2025

lqiu96 commented Oct 15, 2025

mpeddada1 left a comment

gemini-code-assist bot left a comment

lqiu96 commented Oct 16, 2025

lqiu96 commented Oct 16, 2025

lqiu96 commented Oct 27, 2025

lqiu96 commented Oct 30, 2025

lqiu96 commented Oct 30, 2025

lqiu96 commented Oct 30, 2025

lqiu96 Oct 30, 2025 •

edited

Loading

diegomarquezp left a comment

diegomarquezp Oct 30, 2025

lqiu96 Oct 30, 2025

diegomarquezp Oct 30, 2025

lqiu96 Oct 30, 2025

blakeli0 Oct 30, 2025

lqiu96 Oct 30, 2025

sonarqubecloud bot commented Oct 30, 2025

sonarqubecloud bot commented Oct 30, 2025

Uh oh!

Labels

7 participants

deps: Bump grpc-java to v1.76.0 #3942

deps: Bump grpc-java to v1.76.0 #3942

Uh oh!

Conversation

lqiu96 commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

gemini-code-assist bot commented Oct 15, 2025

Summary of Changes

Highlights

Footnotes

mpeddada1 commented Oct 15, 2025

lqiu96 commented Oct 15, 2025

mpeddada1 left a comment

Choose a reason for hiding this comment

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

lqiu96 commented Oct 16, 2025

lqiu96 commented Oct 16, 2025

lqiu96 commented Oct 27, 2025

lqiu96 commented Oct 30, 2025

lqiu96 commented Oct 30, 2025

lqiu96 commented Oct 30, 2025

lqiu96 Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

diegomarquezp left a comment

Choose a reason for hiding this comment

diegomarquezp Oct 30, 2025

Choose a reason for hiding this comment

lqiu96 Oct 30, 2025

Choose a reason for hiding this comment

diegomarquezp Oct 30, 2025

Choose a reason for hiding this comment

lqiu96 Oct 30, 2025

Choose a reason for hiding this comment

blakeli0 Oct 30, 2025

Choose a reason for hiding this comment

lqiu96 Oct 30, 2025

Choose a reason for hiding this comment

sonarqubecloud bot commented Oct 30, 2025

Quality Gate failed for 'gapic-generator-java-root'

sonarqubecloud bot commented Oct 30, 2025

Quality Gate failed for 'java_showcase_integration_tests'

Uh oh!

Labels

7 participants

lqiu96 commented Oct 15, 2025 •

edited

Loading

lqiu96 Oct 30, 2025 •

edited

Loading