Merge branch 'main' into traces_improve

rahul2393 · web-flow · commit abd2c5972753 · 2025-10-24T00:01:07.000+05:30
diff --git a/.github/workflows/hermetic_library_generation.yaml b/.github/workflows/hermetic_library_generation.yaml
@@ -37,7 +37,7 @@ jobs:
       with:
         fetch-depth: 0
         token: ${{ secrets.CLOUD_JAVA_BOT_TOKEN }}
-    - uses: googleapis/sdk-platform-java/.github/scripts@v2.62.3
+    - uses: googleapis/sdk-platform-java/.github/scripts@v2.63.0
       if: env.SHOULD_RUN == 'true'
       with:
         base_ref: ${{ github.base_ref }}
diff --git a/.github/workflows/unmanaged_dependency_check.yaml b/.github/workflows/unmanaged_dependency_check.yaml
@@ -17,6 +17,6 @@ jobs:
           # repository
           .kokoro/build.sh
       - name: Unmanaged dependency check
-        uses: googleapis/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check@google-cloud-shared-dependencies/v3.52.3
+        uses: googleapis/sdk-platform-java/java-shared-dependencies/unmanaged-dependency-check@google-cloud-shared-dependencies/v3.53.0
         with:
           bom-path: google-cloud-spanner-bom/pom.xml
diff --git a/.kokoro/presubmit/graalvm-native-a.cfg b/.kokoro/presubmit/graalvm-native-a.cfg
@@ -3,7 +3,7 @@
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
   key: "TRAMPOLINE_IMAGE"
-  value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_a:3.52.3" # {x-version-update:google-cloud-shared-dependencies:current}
+  value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_a:3.53.0" # {x-version-update:google-cloud-shared-dependencies:current}
 }
 
 env_vars: {
diff --git a/.kokoro/presubmit/graalvm-native-b.cfg b/.kokoro/presubmit/graalvm-native-b.cfg
@@ -3,7 +3,7 @@
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
   key: "TRAMPOLINE_IMAGE"
-  value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_b:3.52.3" # {x-version-update:google-cloud-shared-dependencies:current}
+  value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_b:3.53.0" # {x-version-update:google-cloud-shared-dependencies:current}
 }
 
 env_vars: {
diff --git a/.kokoro/presubmit/graalvm-native-c.cfg b/.kokoro/presubmit/graalvm-native-c.cfg
@@ -3,7 +3,7 @@
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
   key: "TRAMPOLINE_IMAGE"
-  value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_c:3.52.3" # {x-version-update:google-cloud-shared-dependencies:current}
+  value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_c:3.53.0" # {x-version-update:google-cloud-shared-dependencies:current}
 }
 
 env_vars: {
diff --git a/generation_config.yaml b/generation_config.yaml
@@ -1,5 +1,5 @@
-gapic_generator_version: 2.62.3
-googleapis_commitish: 102d9f92ac6ed649a61efd9b208e4d1de278e9bb
+gapic_generator_version: 2.63.0
+googleapis_commitish: b61fb21bbac838de7f55cf2c60d371a47fc2799e
 libraries_bom_version: 26.70.0
 libraries:
   - api_shortname: spanner
diff --git a/google-cloud-spanner-bom/pom.xml b/google-cloud-spanner-bom/pom.xml
@@ -8,7 +8,7 @@
   <parent>
     <groupId>com.google.cloud</groupId>
     <artifactId>sdk-platform-java-config</artifactId>
-    <version>3.52.3</version>
+    <version>3.53.0</version>
   </parent>
 
   <name>Google Cloud Spanner BOM</name>
diff --git a/google-cloud-spanner-executor/pom.xml b/google-cloud-spanner-executor/pom.xml
@@ -65,6 +65,13 @@
       <groupId>com.google.cloud</groupId>
       <artifactId>google-cloud-trace</artifactId>
       <version>2.76.0</version>
+      <!-- Version will be managed by guava -->
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>io.grpc</groupId>
@@ -138,6 +145,13 @@
       <groupId>com.google.api.grpc</groupId>
       <artifactId>proto-google-cloud-trace-v1</artifactId>
       <version>2.76.0</version>
+      <!-- Version will be managed by guava -->
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.api.grpc</groupId>
diff --git a/google-cloud-spanner-executor/src/main/java/com/google/cloud/executor/spanner/CloudClientExecutor.java b/google-cloud-spanner-executor/src/main/java/com/google/cloud/executor/spanner/CloudClientExecutor.java
@@ -26,7 +26,7 @@
 import com.google.api.gax.rpc.TransportChannelProvider;
 import com.google.api.gax.rpc.UnavailableException;
 import com.google.auth.Credentials;
-import com.google.auth.oauth2.GoogleCredentials;
+import com.google.auth.oauth2.ServiceAccountCredentials;
 import com.google.cloud.ByteArray;
 import com.google.cloud.Date;
 import com.google.cloud.NoCredentials;
@@ -806,7 +806,7 @@ private synchronized Spanner getClient(long timeoutSeconds, boolean useMultiplex
       credentials = NoCredentials.getInstance();
     } else {
       credentials =
-          GoogleCredentials.fromStream(
+          ServiceAccountCredentials.fromStream(
               new ByteArrayInputStream(
                   FileUtils.readFileToByteArray(new File(WorkerProxy.serviceKeyFile))),
               HTTP_TRANSPORT_FACTORY);
@@ -888,7 +888,7 @@ private synchronized TraceServiceClient getTraceServiceClient() throws IOExcepti
       credentials = NoCredentials.getInstance();
     } else {
       credentials =
-          GoogleCredentials.fromStream(
+          ServiceAccountCredentials.fromStream(
               new ByteArrayInputStream(
                   FileUtils.readFileToByteArray(new File(WorkerProxy.serviceKeyFile))),
               HTTP_TRANSPORT_FACTORY);
diff --git a/google-cloud-spanner-executor/src/main/java/com/google/cloud/executor/spanner/WorkerProxy.java b/google-cloud-spanner-executor/src/main/java/com/google/cloud/executor/spanner/WorkerProxy.java
@@ -19,7 +19,7 @@
 import com.google.api.client.http.javanet.NetHttpTransport;
 import com.google.auth.Credentials;
 import com.google.auth.http.HttpTransportFactory;
-import com.google.auth.oauth2.GoogleCredentials;
+import com.google.auth.oauth2.ServiceAccountCredentials;
 import com.google.cloud.opentelemetry.trace.TraceConfiguration;
 import com.google.cloud.opentelemetry.trace.TraceExporter;
 import com.google.cloud.spanner.ErrorCode;
@@ -87,7 +87,7 @@ public static OpenTelemetrySdk setupOpenTelemetrySdk() throws Exception {
     // Read credentials from the serviceKeyFile.
     HttpTransportFactory HTTP_TRANSPORT_FACTORY = NetHttpTransport::new;
     Credentials credentials =
-        GoogleCredentials.fromStream(
+        ServiceAccountCredentials.fromStream(
             new ByteArrayInputStream(FileUtils.readFileToByteArray(new File(serviceKeyFile))),
             HTTP_TRANSPORT_FACTORY);
 
diff --git a/google-cloud-spanner/clirr-ignored-differences.xml b/google-cloud-spanner/clirr-ignored-differences.xml
@@ -1053,4 +1053,8 @@
     <className>com/google/cloud/spanner/connection/Connection</className>
     <method>java.time.Duration getTransactionTimeout()</method>
   </difference>
+  <difference>
+    <differenceType>8001</differenceType>
+    <className>com/google/cloud/spanner/LatencyTest</className>
+  </difference>
 </differences>
diff --git a/google-cloud-spanner/pom.xml b/google-cloud-spanner/pom.xml
@@ -273,17 +273,38 @@
       <groupId>com.google.cloud</groupId>
       <artifactId>google-cloud-monitoring</artifactId>
       <version>3.77.0</version>
+      <!-- Version will be managed by guava -->
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>proto-google-cloud-monitoring-v3</artifactId>
       <version>3.77.0</version>
+      <!-- Version will be managed by guava -->
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.api.grpc</groupId>
       <artifactId>grpc-google-cloud-monitoring-v3</artifactId>
       <version>3.77.0</version>
       <scope>test</scope>
+      <!-- Version will be managed by guava -->
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>failureaccess</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.auth</groupId>
diff --git a/google-cloud-spanner/src/main/java/com/google/cloud/spanner/LatencyTest.java b/google-cloud-spanner/src/main/java/com/google/cloud/spanner/LatencyTest.java
diff --git a/google-cloud-spanner/src/main/java/com/google/cloud/spanner/connection/ConnectionProperties.java b/google-cloud-spanner/src/main/java/com/google/cloud/spanner/connection/ConnectionProperties.java
@@ -261,7 +261,11 @@ public class ConnectionProperties {
           CREDENTIALS_PROPERTY_NAME,
           "The location of the credentials file to use for this connection. If neither this"
               + " property or encoded credentials are set, the connection will use the default"
-              + " Google Cloud credentials for the runtime environment.",
+              + " Google Cloud credentials for the runtime environment. WARNING: Using this"
+              + " property without proper validation can expose the application to security risks."
+              + " It is intended for use with credentials from a trusted source only, as it could"
+              + " otherwise allow end-users to supply arbitrary credentials. For more information,"
+              + " seehttps://cloud.google.com/docs/authentication/client-libraries#external-credentials",
           DEFAULT_CREDENTIALS,
           StringValueConverter.INSTANCE,
           Context.STARTUP);
@@ -270,7 +274,11 @@ public class ConnectionProperties {
           ENCODED_CREDENTIALS_PROPERTY_NAME,
           "Base64-encoded credentials to use for this connection. If neither this property or a"
               + " credentials location are set, the connection will use the default Google Cloud"
-              + " credentials for the runtime environment.",
+              + " credentials for the runtime environment. WARNING: Enabling this property without"
+              + " proper validation can expose the application to security risks. It is intended"
+              + " for use with credentials from a trusted source only, as it could otherwise allow"
+              + " end-users to supply arbitrary credentials. For more information, see"
+              + "https://cloud.google.com/docs/authentication/client-libraries#external-credentials",
           null,
           StringValueConverter.INSTANCE,
           Context.STARTUP);
diff --git a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/GceTestEnvConfig.java b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/GceTestEnvConfig.java
@@ -21,7 +21,7 @@
 import static com.google.common.base.Preconditions.checkState;
 
 import com.google.api.gax.grpc.InstantiatingGrpcChannelProvider;
-import com.google.auth.oauth2.GoogleCredentials;
+import com.google.auth.oauth2.ServiceAccountCredentials;
 import com.google.cloud.spanner.spi.v1.SpannerInterceptorProvider;
 import io.grpc.CallOptions;
 import io.grpc.Channel;
@@ -80,7 +80,8 @@ public GceTestEnvConfig() {
     }
     if (!credentialsFile.isEmpty()) {
       try {
-        builder.setCredentials(GoogleCredentials.fromStream(new FileInputStream(credentialsFile)));
+        builder.setCredentials(
+            ServiceAccountCredentials.fromStream(new FileInputStream(credentialsFile)));
       } catch (IOException e) {
         throw new RuntimeException(e);
       }
diff --git a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/connection/CredentialsServiceTest.java b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/connection/CredentialsServiceTest.java
@@ -25,8 +25,9 @@
 import com.google.auth.oauth2.ServiceAccountCredentials;
 import com.google.cloud.spanner.ErrorCode;
 import com.google.cloud.spanner.SpannerException;
-import java.io.FileInputStream;
+import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
@@ -35,9 +36,9 @@
 @RunWith(JUnit4.class)
 public class CredentialsServiceTest {
   private static final String FILE_TEST_PATH =
-      CredentialsServiceTest.class.getResource("test-key.json").getFile();
-  private static final String APP_DEFAULT_FILE_TEST_PATH =
-      CredentialsServiceTest.class.getResource("test-key-app-default.json").getFile();
+      CredentialsServiceTest.class.getResource("test-key.json").getPath();
+  private static final String SA_APP_DEFAULT_FILE_TEST_PATH =
+      CredentialsServiceTest.class.getResource("test-key-app-default.json").getPath();
 
   private static final String TEST_PROJECT_ID = "test-project";
   private static final String APP_DEFAULT_PROJECT_ID = "app-default-test-project";
@@ -49,7 +50,11 @@ public class CredentialsServiceTest {
         GoogleCredentials internalGetApplicationDefault() throws IOException {
           // Read application default credentials directly from a specific file instead of actually
           // fetching the default from the environment.
-          return GoogleCredentials.fromStream(new FileInputStream(APP_DEFAULT_FILE_TEST_PATH));
+          return ServiceAccountCredentials.fromStream(
+              // Calling `getResource().getPath()` on Windows returns a string that might start with
+              // something like `/C:/...`. Paths.get() interprets the leading / as part of the path
+              // and would be invalid. Use `new File().toPath()` to read from these files.
+              Files.newInputStream(new File(SA_APP_DEFAULT_FILE_TEST_PATH).toPath()));
         }
       };
 
diff --git a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java
@@ -48,7 +48,6 @@
 import com.google.common.base.Strings;
 import com.google.longrunning.OperationsClient;
 import com.google.longrunning.OperationsSettings;
-import java.io.FileInputStream;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -352,9 +351,7 @@ public void deniedListBackupOperations() throws IOException {
                 .setTransportChannelProvider(InstantiatingGrpcChannelProvider.newBuilder().build())
                 .setEndpoint("spanner.googleapis.com:443")
                 .setCredentialsProvider(
-                    FixedCredentialsProvider.create(
-                        GoogleCredentials.fromStream(
-                            new FileInputStream(System.getenv("GOOGLE_APPLICATION_CREDENTIALS")))))
+                    FixedCredentialsProvider.create(GoogleCredentials.getApplicationDefault()))
                 .build())) {
       client.listOperations(backupId.getName() + "/operations", "");
       fail("Expected PermissionDeniedException");
diff --git a/pom.xml b/pom.xml
@@ -14,7 +14,7 @@
   <parent>
     <groupId>com.google.cloud</groupId>
     <artifactId>sdk-platform-java-config</artifactId>
-    <version>3.52.3</version>
+    <version>3.53.0</version>
   </parent>
 
   <developers>

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@`
`3`	`3`	`# Configure the docker image for kokoro-trampoline.`
`4`	`4`	`env_vars: {`
`5`	`5`	`key: "TRAMPOLINE_IMAGE"`
`6`		`- value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_a:3.52.3" # {x-version-update:google-cloud-shared-dependencies:current}`
	`6`	`+ value: "gcr.io/cloud-devrel-public-resources/graalvm_sdk_platform_a:3.53.0" # {x-version-update:google-cloud-shared-dependencies:current}`
`7`	`7`	`}`
`8`	`8`
`9`	`9`	`env_vars: {`