chore(deps): update upper bound dependencies file

[diegomarquezp]

This PR contains the following updates:

Package	Update	Change
com.google.cloud:grpc-gcp (source)	patch	1.9.0 -> 1.9.1
com.google.errorprone:error_prone_annotations (source)	minor	2.45.0 -> 2.46.0
com.google.http-client:google-http-client	patch	2.0.2 -> 2.0.3
com.google.protobuf:protobuf-java (source)	patch	4.33.1 -> 4.33.4
commons-codec:commons-codec (source)	minor	1.19.0 -> 1.20.0
io.opentelemetry:opentelemetry-bom	minor	1.57.0 -> 1.58.0
org.apache.httpcomponents.client5:httpclient5	minor	5.5.1 -> 5.6
org.apache.httpcomponents.core5:httpcore5	minor	5.3.6 -> 5.4

---

Release Notes

GoogleCloudPlatform/grpc-gcp-java (com.google.cloud:grpc-gcp)

v1.9.1

Compare Source

What's Changed

• fix: race for metrics values. Plus fix log metrics when reported via otel callbacks by @​nimf in https://github.com/GoogleCloudPlatform/grpc-gcp-java/pull/228

Full Changelog: GoogleCloudPlatform/grpc-gcp-java@v1.9.0...v1.9.1

google/error-prone (com.google.errorprone:error_prone_annotations)

v2.46.0: Error Prone 2.46.0

Compare Source

Changes:

• The javac flag -XDaddTypeAnnotationsToSymbol=true is now required for Error Prone invocations on JDK 21, to enable the javac fix for JDK-8225377: type annotations are not visible to javac plugins across compilation boundaries. See https://github.com/google/error-prone/issues/5426 for details.
• Remove deprecated value attribute from @IncompatibleModifiers and @RequiredModifiers (https://github.com/google/error-prone/issues/2122)
• Error Prone API changes to encapsulate references to internal javac APIs for end position handling (EndPosTable, DiagnosticPosition) (google/error-prone@5440bb4, google/error-prone@06c2905, google/error-prone@f3915ec)

New checks:

• DuplicateAssertion: detect duplicated assertion lines where the argument to assertThat is pure
• IfChainToSwitch: suggest converting chains of if-statements into arrow switches
• ScannerUseDelimiter: discourage Scanner.useDelimiter("\\A")
• AddNullMarkedToClass: refactoring to add @NullMarked annotation to top level classes

googleapis/google-http-java-client (com.google.http-client:google-http-client)

v2.0.3

Compare Source

Bug Fixes

• apache5: Set connection request timeout on setTimeout (#​2129) (d11d794)

apache/commons-codec (commons-codec:commons-codec)

v1.20.0

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.20.0.

The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)

v1.58.0

Compare Source

API

Incubator

• Delete GlobalConfigProvider in favor of access via ExtendedOpenTelemetry
  (#​7914)
• Add DeclarativeConfigProperties#get method
  (#​7923)
• Update ConfigProvider#getInstrumentationConfig response to be non-null
  (#​7954)
• Add declarative config utility methods for common operations
  (#​7927)

SDK

Traces

• Implement SDK metrics for trace
  (#​7895,
  #​7930)
• Emit warning when TraceIdRatioBasedSampler is used as child sampler
  (#​7937)

Logs

• Implement SDK metrics for logs
  (#​7931)

Exporters

• Prom exporter update
  (#​7934)

Extensions

• Declarative config: update to opentelemetry-configuration 1.0.0-rc.3
  (#​7861)
• Declarative config: update jaeger remote sampler to require endpoint, initial_sampler
  (#​7943)
• Declarative config: add support for view unit
  (#​7942)
• Declarative config: add support for new logger config minimum_severity and trace_based properties
  (#​7940)
• Declarative config: add support for composable parent threshold sampler
  (#​7941)
• Declarative config: improve pattern for validating and loading SDK extension plugins
  (#​7947)

Project tooling

• Use develocity build cache in PRs and local builds
  (#​7906)
• Configure japicmp classpath to avoid false positives
  (#​7945)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[gemini-code-assist]

Summary of Changes

Hello @diegomarquezp, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request systematically updates several core Java dependencies to their latest stable versions. The primary objective is to integrate the most recent bug fixes, performance optimizations, and new features from these libraries, thereby enhancing the project's overall stability, security, and compatibility with the evolving Java ecosystem. Key updates include significant advancements in gRPC for improved communication, new static analysis capabilities from Error Prone for better code quality, and expanded observability features from OpenTelemetry.

Highlights

• gRPC BOM Update: Updated io.grpc:grpc-bom to 1.78.0, which includes critical bug fixes for channel shutdown race conditions and OkHttp MAX_CONCURRENT_STREAMS issues. This version also introduces new xDS features such as System Root Certs, GCP Authentication Filter, xDS-based authority rewriting, and enhanced SNI/SAN validation.
• Error Prone Enhancements: Upgraded com.google.errorprone:error_prone_annotations to 2.46.0. This release introduces several new static analysis checks, including DuplicateAssertion and IfChainToSwitch, and now requires a specific javac flag (-XDaddTypeAnnotationsToSymbol=true) when running on JDK 21.
• OpenTelemetry Observability Improvements: Updated io.opentelemetry:opentelemetry-bom to 1.58.0, bringing new SDK metrics for traces and logs, along with various enhancements to declarative configuration and the Prometheus exporter.
• Apache HttpComponents Updates: Minor version upgrades were applied to org.apache.httpcomponents.client5:httpclient5 (to 5.6) and org.apache.httpcomponents.core5:httpcore5 (to 5.4), incorporating general improvements and maintenance.
• Patch and Minor Dependency Updates: Applied patch updates to com.google.cloud:grpc-gcp (to 1.9.1) and com.google.http-client:google-http-client (to 2.0.3) for specific bug fixes. com.google.protobuf:protobuf-java was updated to 4.33.4, and commons-codec:commons-codec received a minor update to 1.20.0, now requiring Java 8 or later.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates several dependencies to their upper bounds in dependencies.txt. While most updates are for existing artifacts, the new versions for com.google.protobuf:protobuf-java, org.apache.httpcomponents.client5:httpclient5, and org.apache.httpcomponents.core5:httpcore5 do not appear to be available in public Maven repositories. This will cause failures in any process that tries to resolve these dependencies. I have left comments on the specific lines with these issues.

[gemini-code-assist]

The version 4.33.4 for com.google.protobuf:protobuf-java does not appear to be available in Maven Central. The latest published version seems to be 4.26.1. This will cause dependency resolution to fail.

[gemini-code-assist]

The version 5.6 for org.apache.httpcomponents.client5:httpclient5 does not appear to be available in Maven Central. The latest published version seems to be 5.3.1. This will cause dependency resolution to fail.

[gemini-code-assist]

The version 5.4 for org.apache.httpcomponents.core5:httpcore5 does not appear to be available in Maven Central. The latest published version seems to be 5.2.4. This will cause dependency resolution to fail.

[sonarqubecloud]

Quality Gate passed for 'gapic-generator-java-root'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'java_showcase_integration_tests'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud