Bump grpc-protobuf from 1.24.1 to 1.39.0

[dependabot-preview[bot]]

⚠️ Dependabot Preview has been deactivated ⚠️

This pull request was created by Dependabot Preview, and you've upgraded to Dependabot. This means it won't respond to dependabot commands nor will it be automatically closed if a new version is found.

If you close this pull request, Dependabot will re-create it the next time it checks for updates and everything will work as expected.

---

Bumps grpc-protobuf from 1.24.1 to 1.39.0.

Release notes

Sourced from grpc-protobuf's releases.

v1.38.1

Bug Fixes

• grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by #8035 is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. The fix mitigated the temporal invariant violation.
• xds: shut down the scheduledExecutorService in the CertificateProvider when it is shutdown

v1.38.0

gRPC Java 1.38.0 Release Notes

API Changes

• services: move classes with protobuf dependency into io.grpc.protobuf.services. Users currently using BinaryLogging, HealthChecking, Channelz should migrate to use the corresponding classes in io.grpc.protobuf.services. (#8056)
• ChannelCredentials and ServerCredentials and are now stable. Notably, this also includes TlsChannelCredentials and TlsServerCredentials that allow mTLS configuration without a direct dependency on Netty. The description of the new API can be found in gRFC L74. These APIs are intended to “replace” the implicit security defaults of channels/servers as well as the usePlaintext() and useTransportSecurity() methods on the channel and server builders. The previous APIs are stable so will not be removed. Over time, documentation and examples will be migrated to the new API

Bug Fixes

• xds: Fixed a bug that xDS users may experience null pointer exception in rare cases (#8087)
• netty: Fixed a bug that client RPCs may fail with a wrong exception with message "Maximum active streams violated for this endpoint" when receiving GOAWAY while MAX_CONCURRENT_STREAMS is reached. After the fix the client RPC should fail with UNAVAILABLE status in such a scenario. (#8020)
• xds: Fixed a bug that xDS LB policies may process and propagate load balancing state update from its child LB policy after itself being shut down. This can be cascaded and result in hard-to-reason behaviors if any one layer of the LB policies does not clean up its internal state after shutdown.

Behavior Changes

• core, grpclb, xds: let leaf LB policies explicitly refresh name resolution when subchannel connection is broken. Custom LoadBalancer implementations should refresh name resolution (with Helper.refreshNameResolution()) when seeing its created subchannel becomes IDLE or TRANSIENT_FAILURE. Currently the Channel will do it for you and log a warning. But this operation will be removed in the future releases. (#8048)
• netty: Added support for OpenJSSE

Dependencies

• Upgrade Guava to 30.1 (#8100). As part of #4671 grpc-java will drop support for Java 7, with no impact to Android API levels supported. Guava is going through the same process and in this Guava release it warns when used on Java 7. If you are using Java 7 and are impacted, please comment on #4671. The Java 7 check may be noticed by Android builds and fail without language-level desugaring. We expect most users have already enabled language-level desugaring, but if not it would be necessary to add to your build.gradle:

android {
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }
}

• auth: Allow pre- and post-0.25.0 behavior from google-auth-library-java, for Bazel users. google-auth-library-java 0.25.0 changed its behavior for JWT that caused a gRPC test to fail. The failure was benign but prevented Bazel users from using newer versions of the library

v1.37.1

Bug Fixes

• netty: fixed a bug that client RPCs may fail with a wrong exception with message "Maximum active streams violated for this endpoint" when receiving GOAWAY while MAX_CONCURRENT_STREAMS is reached. After the fix the client RPC should fail with UNAVAILABLE status in such a scenario.
• grpclb, xds: fixed a day-one issue that the control plane RPC are using the same Context as the inbound application RPC, which can cause control plane RPC aborted when the inbound application RPC completes.
• xds: fixed a bug that xDS LB policies may process and propagate load balancing state update from its child LB policy after itself being shut down. This can be cascaded and result in hard-to-reason behaviors if any one layer of the LB policies does not clean up its internal state after shutdown.

v1.37.0

Behavior Changes

• alts: make both GoogleDefaultChannelCredentials and ComputeEngineChannelCredentials choose ALTS for backends given by xDS TD. Changes for ComputeEngineChannelCredentials were missing, but they really should be the same.
• api: added a convenient ServerBuilder.addServices() API that allows adding a list of services instead of iterating through list and calling addService().
• api: deleted some NameResolver APIs that have been marked as deprecated since 1.21 release.
• api: implemented admin interface API, which automatically loads available admin services in a given binary. Currently, it only includes Channelz and CSDS with dependencies required at runtime.
• context: move pendingDeadline.cancel out of synchronized block.
• netty: allow connection handshakes (e.g., TCP, TLS) to be interrupted by channel.shutdown(). Previously shutdownNow() was required for prompt shutdown if a connection was handshaking.
• xds: change in parsing ADS responses for LDS, RDS, CDS, and EDS resources. Before this release, gRPC parsing logic for ADS response containing multiple resources was to stop resource processing on the first encountered error, followed by NACK with the details of this single error. With this change, the parsing logic processes all resources and collects all processing errors. If any error occurred, a NACK is issued with concatenated error messages of all errors encountered. The rationale and the detailed design can be found in gRFC A40 — ADS Parsing Logic Update: Continue After First Error.
• xds: change system property name for reading bootstrap config from io.grpc.xds.bootstrapValue to io.grpc.xds.bootstrapConfig.
• xds: circuit breaking, timeout and fault injection are enabled by default. Previously they were protected by environment variables.

... (truncated)

Commits

• 6b64338 Bump version to 1.39.0
• 67dce9a Update README etc to reference 1.39.0
• e77561a netty-shaded: Use compile instead of runtime dep in pom for core
• dc74a31 Modify netty-shaded resources to reference shaded class names (#8258)
• 84eb285 xds: add override rbacfilter type url RbacPerProto (#8262)
• 25122f9 api: clean up duplicated method in InternalServerInterceptors (#8261)
• c8ba601 xds: add rbac http filter (#8251)
• 2cbc7fc grpclb: skip fallback if the LB is already in fallback mode (#8253)
• 5642e01 Replace failOnVersionConflict() with custom requireUpperBoundDeps
• aa18b2c grpclb: update load_balancer.proto
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)