Merge branch 'systemrootcerts-ignore-trusted-root-updates' into system-root-changes-needed

# Conflicts:
#	xds/src/main/java/io/grpc/xds/internal/security/SslContextProviderSupplier.java
#	xds/src/test/java/io/grpc/xds/CdsLoadBalancer2Test.java
#	xds/src/test/java/io/grpc/xds/internal/security/SslContextProviderSupplierTest.java
#	xds/src/test/java/io/grpc/xds/internal/security/certprovider/CertProviderClientSslContextProviderTest.java

Author: kannanjgithub

.github/workflows/testing.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        jre: [8, 11, 17]
+        jre: [8, 11, 17, 21]
       fail-fast: false # Should swap to true if we grow a large matrix
 
     steps:
@@ -102,6 +102,9 @@ jobs:
     - name: Run bazel build
       run: bazelisk build //... --enable_bzlmod=${{ matrix.bzlmod }}
 
+    - name: Run bazel test
+      run: bazelisk test //... --enable_bzlmod=${{ matrix.bzlmod }}
+
     - name: Run example bazel build
       run: bazelisk build //... --enable_bzlmod=${{ matrix.bzlmod }}
       working-directory: ./examples

BUILD.bazel

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+load("@rules_java//java:defs.bzl", "java_library", "java_plugin", "java_proto_library")
 load("@rules_jvm_external//:defs.bzl", "artifact")
 load(":java_grpc_library.bzl", "java_grpc_library")
 

MAINTAINERS.md

@@ -11,8 +11,6 @@ for general contribution guidelines.
 - [ejona86](https://github.com/ejona86), Google LLC
 - [jdcormie](https://github.com/jdcormie), Google LLC
 - [kannanjgithub](https://github.com/kannanjgithub), Google LLC
-- [larry-safran](https://github.com/larry-safran), Google LLC
-- [markb74](https://github.com/markb74), Google LLC
 - [ran-su](https://github.com/ran-su), Google LLC
 - [sergiitk](https://github.com/sergiitk), Google LLC
 - [temawi](https://github.com/temawi), Google LLC
@@ -26,7 +24,9 @@ for general contribution guidelines.
 - [ericgribkoff](https://github.com/ericgribkoff)
 - [jiangtaoli2016](https://github.com/jiangtaoli2016)
 - [jtattermusch](https://github.com/jtattermusch)
+- [larry-safran](https://github.com/larry-safran)
 - [louiscryan](https://github.com/louiscryan)
+- [markb74](https://github.com/markb74)
 - [nicolasnoble](https://github.com/nicolasnoble)
 - [nmittler](https://github.com/nmittler)
 - [sanjaypujare](https://github.com/sanjaypujare)

MODULE.bazel

@@ -2,80 +2,61 @@ module(
     name = "grpc-java",
     compatibility_level = 0,
     repo_name = "io_grpc_grpc_java",
-    version = "1.74.0-SNAPSHOT",  # CURRENT_GRPC_VERSION
+    version = "1.76.0-SNAPSHOT",  # CURRENT_GRPC_VERSION
 )
 
 # GRPC_DEPS_START
 IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.android:annotations:4.1.1.4",
-    "com.google.api.grpc:proto-google-common-protos:2.51.0",
+    "com.google.api.grpc:proto-google-common-protos:2.59.2",
     "com.google.auth:google-auth-library-credentials:1.24.1",
     "com.google.auth:google-auth-library-oauth2-http:1.24.1",
     "com.google.auto.value:auto-value-annotations:1.11.0",
     "com.google.auto.value:auto-value:1.11.0",
     "com.google.code.findbugs:jsr305:3.0.2",
     "com.google.code.gson:gson:2.11.0",
-    "com.google.errorprone:error_prone_annotations:2.30.0",
+    "com.google.errorprone:error_prone_annotations:2.36.0",
     "com.google.guava:failureaccess:1.0.1",
-    "com.google.guava:guava:33.3.1-android",
+    "com.google.guava:guava:33.4.8-android",
     "com.google.re2j:re2j:1.8",
-    "com.google.s2a.proto.v2:s2a-proto:0.1.1",
+    "com.google.s2a.proto.v2:s2a-proto:0.1.2",
     "com.google.truth:truth:1.4.2",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
-    "io.netty:netty-buffer:4.1.110.Final",
-    "io.netty:netty-codec-http2:4.1.110.Final",
-    "io.netty:netty-codec-http:4.1.110.Final",
-    "io.netty:netty-codec-socks:4.1.110.Final",
-    "io.netty:netty-codec:4.1.110.Final",
-    "io.netty:netty-common:4.1.110.Final",
-    "io.netty:netty-handler-proxy:4.1.110.Final",
-    "io.netty:netty-handler:4.1.110.Final",
-    "io.netty:netty-resolver:4.1.110.Final",
+    "io.netty:netty-buffer:4.1.124.Final",
+    "io.netty:netty-codec-http2:4.1.124.Final",
+    "io.netty:netty-codec-http:4.1.124.Final",
+    "io.netty:netty-codec-socks:4.1.124.Final",
+    "io.netty:netty-codec:4.1.124.Final",
+    "io.netty:netty-common:4.1.124.Final",
+    "io.netty:netty-handler-proxy:4.1.124.Final",
+    "io.netty:netty-handler:4.1.124.Final",
+    "io.netty:netty-resolver:4.1.124.Final",
     "io.netty:netty-tcnative-boringssl-static:2.0.70.Final",
     "io.netty:netty-tcnative-classes:2.0.70.Final",
-    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.110.Final",
-    "io.netty:netty-transport-native-unix-common:4.1.110.Final",
-    "io.netty:netty-transport:4.1.110.Final",
+    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.124.Final",
+    "io.netty:netty-transport-native-unix-common:4.1.124.Final",
+    "io.netty:netty-transport:4.1.124.Final",
     "io.opencensus:opencensus-api:0.31.0",
     "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
     "io.perfmark:perfmark-api:0.27.0",
     "junit:junit:4.13.2",
-    "org.checkerframework:checker-qual:3.12.0",
+    "org.checkerframework:checker-qual:3.49.5",
     "org.codehaus.mojo:animal-sniffer-annotations:1.24",
 ]
 # GRPC_DEPS_END
 
+bazel_dep(name = "bazel_jar_jar", version = "0.1.7")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "googleapis", repo_name = "com_google_googleapis", version = "0.0.0-20240326-1c8d509c5")
-
-# CEL Spec may be removed when cncf/xds MODULE is no longer using protobuf 27.x
-bazel_dep(name = "cel-spec", repo_name = "dev_cel", version = "0.15.0")
-bazel_dep(name = "grpc", repo_name = "com_github_grpc_grpc", version = "1.56.3.bcr.1")
 bazel_dep(name = "grpc-proto", repo_name = "io_grpc_grpc_proto", version = "0.0.0-20240627-ec30f58")
-bazel_dep(name = "protobuf", repo_name = "com_google_protobuf", version = "23.1")
+# Protobuf 25.5+ is incompatible with Bazel 7 with bzlmod
+bazel_dep(name = "protobuf", repo_name = "com_google_protobuf", version = "24.4")
 bazel_dep(name = "rules_cc", version = "0.0.9")
 bazel_dep(name = "rules_java", version = "5.3.5")
-bazel_dep(name = "rules_go", repo_name = "io_bazel_rules_go", version = "0.46.0")
 bazel_dep(name = "rules_jvm_external", version = "6.0")
 bazel_dep(name = "rules_proto", version = "5.3.0-21.7")
 
-non_module_deps = use_extension("//:repositories.bzl", "grpc_java_repositories_extension")
-
-use_repo(
-    non_module_deps,
-    "com_github_cncf_xds",
-    "envoy_api",
-)
-
-grpc_repo_deps_ext = use_extension("@com_github_grpc_grpc//bazel:grpc_deps.bzl", "grpc_repo_deps_ext")
-
-use_repo(
-    grpc_repo_deps_ext,
-    "com_envoyproxy_protoc_gen_validate",
-    "opencensus_proto",
-)
-
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 
 maven.install(
@@ -202,7 +183,3 @@ maven.override(
     coordinates = "io.grpc:grpc-util",
     target = "@io_grpc_grpc_java//util",
 )
-
-switched_rules = use_extension("@com_google_googleapis//:extensions.bzl", "switched_rules")
-
-switched_rules.use_languages(java = True)

README.md

@@ -44,8 +44,8 @@ For a guided tour, take a look at the [quick start
 guide](https://grpc.io/docs/languages/java/quickstart) or the more explanatory [gRPC
 basics](https://grpc.io/docs/languages/java/basics).
 
-The [examples](https://github.com/grpc/grpc-java/tree/v1.73.0/examples) and the
-[Android example](https://github.com/grpc/grpc-java/tree/v1.73.0/examples/android)
+The [examples](https://github.com/grpc/grpc-java/tree/v1.75.0/examples) and the
+[Android example](https://github.com/grpc/grpc-java/tree/v1.75.0/examples/android)
 are standalone projects that showcase the usage of gRPC.
 
 Download
@@ -56,53 +56,45 @@ Download [the JARs][]. Or for Maven with non-Android, add to your `pom.xml`:
 <dependency>
   <groupId>io.grpc</groupId>
   <artifactId>grpc-netty-shaded</artifactId>
-  <version>1.73.0</version>
+  <version>1.75.0</version>
   <scope>runtime</scope>
 </dependency>
 <dependency>
   <groupId>io.grpc</groupId>
   <artifactId>grpc-protobuf</artifactId>
-  <version>1.73.0</version>
+  <version>1.75.0</version>
 </dependency>
 <dependency>
   <groupId>io.grpc</groupId>
   <artifactId>grpc-stub</artifactId>
-  <version>1.73.0</version>
-</dependency>
-<dependency> <!-- necessary for Java 9+ -->
-  <groupId>org.apache.tomcat</groupId>
-  <artifactId>annotations-api</artifactId>
-  <version>6.0.53</version>
-  <scope>provided</scope>
+  <version>1.75.0</version>
 </dependency>
 ```
 
 Or for Gradle with non-Android, add to your dependencies:
 ```gradle
-runtimeOnly 'io.grpc:grpc-netty-shaded:1.73.0'
-implementation 'io.grpc:grpc-protobuf:1.73.0'
-implementation 'io.grpc:grpc-stub:1.73.0'
-compileOnly 'org.apache.tomcat:annotations-api:6.0.53' // necessary for Java 9+
+runtimeOnly 'io.grpc:grpc-netty-shaded:1.75.0'
+implementation 'io.grpc:grpc-protobuf:1.75.0'
+implementation 'io.grpc:grpc-stub:1.75.0'
 ```
 
 For Android client, use `grpc-okhttp` instead of `grpc-netty-shaded` and
 `grpc-protobuf-lite` instead of `grpc-protobuf`:
 ```gradle
-implementation 'io.grpc:grpc-okhttp:1.73.0'
-implementation 'io.grpc:grpc-protobuf-lite:1.73.0'
-implementation 'io.grpc:grpc-stub:1.73.0'
-compileOnly 'org.apache.tomcat:annotations-api:6.0.53' // necessary for Java 9+
+implementation 'io.grpc:grpc-okhttp:1.75.0'
+implementation 'io.grpc:grpc-protobuf-lite:1.75.0'
+implementation 'io.grpc:grpc-stub:1.75.0'
 ```
 
 For [Bazel](https://bazel.build), you can either
 [use Maven](https://github.com/bazelbuild/rules_jvm_external)
 (with the GAVs from above), or use `@io_grpc_grpc_java//api` et al (see below).
 
 [the JARs]:
-https://search.maven.org/search?q=g:io.grpc%20AND%20v:1.73.0
+https://search.maven.org/search?q=g:io.grpc%20AND%20v:1.75.0
 
 Development snapshots are available in [Sonatypes's snapshot
-repository](https://oss.sonatype.org/content/repositories/snapshots/).
+repository](https://central.sonatype.com/repository/maven-snapshots/).
 
 Generated Code
 --------------
@@ -131,7 +123,7 @@ For protobuf-based codegen integrated with the Maven build system, you can use
       <configuration>
         <protocArtifact>com.google.protobuf:protoc:3.25.5:exe:${os.detected.classifier}</protocArtifact>
         <pluginId>grpc-java</pluginId>
-        <pluginArtifact>io.grpc:protoc-gen-grpc-java:1.73.0:exe:${os.detected.classifier}</pluginArtifact>
+        <pluginArtifact>io.grpc:protoc-gen-grpc-java:1.75.0:exe:${os.detected.classifier}</pluginArtifact>
       </configuration>
       <executions>
         <execution>
@@ -161,7 +153,7 @@ protobuf {
   }
   plugins {
     grpc {
-      artifact = 'io.grpc:protoc-gen-grpc-java:1.73.0'
+      artifact = 'io.grpc:protoc-gen-grpc-java:1.75.0'
     }
   }
   generateProtoTasks {
@@ -194,7 +186,7 @@ protobuf {
   }
   plugins {
     grpc {
-      artifact = 'io.grpc:protoc-gen-grpc-java:1.73.0'
+      artifact = 'io.grpc:protoc-gen-grpc-java:1.75.0'
     }
   }
   generateProtoTasks {

RELEASING.md

@@ -160,7 +160,7 @@ Tagging the Release
    repository can then be `released`, which will begin the process of pushing
    the new artifacts to Maven Central (the staging repository will be destroyed
    in the process). You can see the complete process for releasing to Maven
-   Central on the [OSSRH site](https://central.sonatype.org/pages/releasing-the-deployment.html).
+   Central on the [OSSRH site](https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#deploying).
 
 10. We have containers for each release to detect compatibility regressions with
     old releases. Generate one for the new release by following the [GCR image

SECURITY.md

@@ -400,7 +400,8 @@ grpc-netty version | netty-handler version | netty-tcnative-boringssl-static ver
 1.59.x             | 4.1.97.Final          | 2.0.61.Final
 1.60.x-1.66.x      | 4.1.100.Final         | 2.0.61.Final
 1.67.x-1.70.x      | 4.1.110.Final         | 2.0.65.Final
-1.71.x-            | 4.1.110.Final         | 2.0.70.Final
+1.71.x-1.74.x      | 4.1.110.Final         | 2.0.70.Final
+1.75.x-            | 4.1.124.Final         | 2.0.72.Final
 
 _(grpc-netty-shaded avoids issues with keeping these versions in sync.)_
 

WORKSPACE

@@ -22,20 +22,19 @@ load("//:repositories.bzl", "grpc_java_repositories")
 
 grpc_java_repositories()
 
+load("@bazel_jar_jar//:jar_jar.bzl", "jar_jar_repositories")
+
+jar_jar_repositories()
+
 load("@com_google_protobuf//:protobuf_deps.bzl", "PROTOBUF_MAVEN_ARTIFACTS")
 load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 
 protobuf_deps()
 
-load("@envoy_api//bazel:repositories.bzl", "api_dependencies")
-
-api_dependencies()
-
 load("@com_google_googleapis//:repository_rules.bzl", "switched_rules_by_language")
 
 switched_rules_by_language(
     name = "com_google_googleapis_imports",
-    java = True,
 )
 
 maven_install(

alts/BUILD.bazel

@@ -1,3 +1,4 @@
+load("@rules_java//java:defs.bzl", "java_library", "java_proto_library")
 load("@rules_jvm_external//:defs.bzl", "artifact")
 load("@rules_proto//proto:defs.bzl", "proto_library")
 load("//:java_grpc_library.bzl", "java_grpc_library")

alts/build.gradle

@@ -22,7 +22,6 @@ dependencies {
             libraries.guava.jre, // JRE required by protobuf-java-util from grpclb
             libraries.google.auth.oauth2Http
     def nettyDependency = implementation project(':grpc-netty')
-    compileOnly libraries.javax.annotation
 
     shadow configurations.implementation.getDependencies().minus(nettyDependency)
     shadow project(path: ':grpc-netty-shaded', configuration: 'shadow')