chore(deps): bump the version-updates group with 7 updates

[dependabot]

Bumps the version-updates group with 7 updates:

Package	From	To
io.netty:netty-bom	4.2.15.Final	4.2.17.Final
io.qdrant:client	1.18.3	1.19.0
com.google.guava:guava	33.6.0-jre	33.7.1-jre
io.grpc:grpc-protobuf	1.82.1	1.84.0
org.slf4j:slf4j-api	2.0.18	2.0.19
org.apache.spark:spark-sql_2.13	4.1.2	4.2.0
com.fasterxml.jackson.core:jackson-databind	2.21.5	2.22.2

Updates io.netty:netty-bom from 4.2.15.Final to 4.2.17.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.17.Final

What's Changed

• AsciiString.cached(String) should sanitize the provided String (#13749) by @​vpelikh in netty/netty#17007
• Fix deploy workflow by @​normanmaurer in netty/netty#17071
• Fix AsciiString.cached(String) performance regression by @​dreamlike-ocean in netty/netty#17074
• SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by @​normanmaurer in netty/netty#17059
• Avoid leak presence detector in leak profile by @​yawkat in netty/netty#17073
• Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by @​reta in netty/netty#17068
• IoUring: preserve readPending when rescheduling cancelled reads by @​dreamlike-ocean in netty/netty#17087
• Reject negative maxOrder in PooledByteBufAllocator by @​coderbruis in netty/netty#17093
• Fix AdaptiveByteBuf._setLongLE calling checked setLongLE by @​franz1981 in netty/netty#17098
• Snappy: Guard decoder against invalid chunk lengths by @​yawkat in netty/netty#17099
• Fix OCSP Tests by @​chrisvest in netty/netty#17114
• Update to latest netty-tcnative release by @​normanmaurer in netty/netty#17056
• Use safe decompressor in Lz4FrameDecoder by @​yawkat in netty/netty#17118
• Configure TestLens for the PR builds by @​chrisvest in netty/netty#17129
• IoUring: add SO_INQ support for Unix domain sockets by @​dreamlike-ocean in netty/netty#17127
• fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by @​ChunMengLu in netty/netty#17117
• Propagate the CI envionment variables through to the docker builds by @​chrisvest in netty/netty#17138
• Codec-compression: Add decompressor API by @​yawkat in netty/netty#16745
• Fix silent failures and optimize error short-circuit in multi-threaded tests by @​rajan-github in netty/netty#17106
• Codec-compression: Add Bzip2Decompressor by @​yawkat in netty/netty#17145
• Fix buddy cache evicting chunks with live buffers by @​franz1981 in netty/netty#17154
• Codec-compression: Add Snappy frame decompressor by @​yawkat in netty/netty#17153
• Codec-compression: Add zlib decompressors by @​yawkat in netty/netty#17155
• Codec-compression: Add Zstd decompressor by @​yawkat in netty/netty#17152
• Codec-compression: Add LZF decompressor by @​yawkat in netty/netty#17147
• Codec-compression: Add BrotliDecompressor by @​yawkat in netty/netty#17146
• Codec-compression: Add Lz4FrameDecompressor by @​yawkat in netty/netty#17148
• HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak when a Throwable is thrown during header encoding by @​HwangRock in netty/netty#17089
• Fix direct memory OOM on low-core containers by @​franz1981 in netty/netty#17166
• IoUring: Fix the recvmmsg emulation by @​dreamlike-ocean in netty/netty#17187
• Avoid classloader leak via GlobalEventExecutor terminationFuture failure by @​seonwooj0810 in netty/netty#17140
• BrotliEncoder: Prevent duplicate close scheduling by @​yawkat in netty/netty#17175
• Fix JdkZlibDecompressor losing the tail of highly compressible streams by @​renechoi in netty/netty#17191
• Update compress-lzf to 1.2.1 by @​yawkat in netty/netty#17194
• Do not write WebSocket handshake response to the tail of the pipeline by @​el-psy-kongroo-d in netty/netty#17192
• HttpServerCodec: do not consume the method queue for 1xx interim responses by @​HwangRock in netty/netty#17182
• Weakly reference engines from the OpenSSL engine map by @​bryce-anderson in netty/netty#17199
• OpenSSL: Allow to obtain used named group via OpenSslSession by @​normanmaurer in netty/netty#17058
• Add .editorconfig to enforce consistent coding style by @​vpelikh in netty/netty#17052
• Update surefire plugin to latest version by @​normanmaurer in netty/netty#17210
• Merge changes from forks by @​chrisvest in netty/netty#17213

New Contributors

• @​vpelikh made their first contribution in netty/netty#17007
• @​ChunMengLu made their first contribution in netty/netty#17117
• @​rajan-github made their first contribution in netty/netty#17106
• @​seonwooj0810 made their first contribution in netty/netty#17140
• @​renechoi made their first contribution in netty/netty#17191

... (truncated)

Commits

• e0789d3 [maven-release-plugin] prepare release netty-4.2.17.Final
• 1b5abc6 Merge changes from forks (#17213)
• 36fbf57 Update surefire plugin to latest version (#17210)
• a96226c Add .editorconfig to enforce consistent coding style (#17052)
• 14a4e6a OpenSSL: Allow to obtain used named group via OpenSslSession (#17058)
• 26255b1 Weakly reference engines from the OpenSSL engine map (#17199)
• ae41417 HttpServerCodec: do not consume the method queue for 1xx interim responses ...
• 41f1db5 Do not write WebSocket handshake response to the tail of the pipeline (#17192)
• 035d76e Update compress-lzf to 1.2.1 (#17194)
• 7681aff Fix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)
• Additional commits viewable in compare view

Updates io.qdrant:client from 1.18.3 to 1.19.0

Release notes

Sourced from io.qdrant:client's releases.

v1.19.0

Updates

• Support for Qdrant v1.19.x - https://github.com/qdrant/qdrant/releases/tag/v1.19.0

Commits

• chore(deps): bump the version-updates group with 2 updates by @​dependabot[bot] in qdrant/java-client#134
• chore(deps): bump the version-updates group with 5 updates by @​dependabot[bot] in qdrant/java-client#135
• chore(deps): bump the version-updates group with 6 updates by @​dependabot[bot] in qdrant/java-client#137
• chore(deps): bump actions/setup-java from 5.4.0 to 5.5.0 in the version-updates group by @​dependabot[bot] in qdrant/java-client#138
• chore(deps): bump the version-updates group with 5 updates by @​dependabot[bot] in qdrant/java-client#139
• chore(deps): bump the version-updates group with 4 updates by @​dependabot[bot] in qdrant/java-client#142
• chore(deps): bump actions/setup-java from 5.5.0 to 5.6.0 in the version-updates group by @​dependabot[bot] in qdrant/java-client#140
• chore(deps): bump actions/checkout from 5.0.1 to 6.1.0 by @​dependabot[bot] in qdrant/java-client#141
• chore(deps): bump the version-updates group with 6 updates by @​dependabot[bot] in qdrant/java-client#144
• 1.19.0 by @​Anush008 in qdrant/java-client#143

Full Changelog: qdrant/java-client@v1.18.3...v1.19.0

Commits

• d30855a 1.19.0 (#143)
• 058c3e7 chore(deps): bump the version-updates group with 6 updates (#144)
• e50da94 chore(deps): bump actions/checkout from 5.0.1 to 6.1.0 (#141)
• 9ce0b0f chore(deps): bump actions/setup-java in the version-updates group (#140)
• 7dbe029 chore(deps): bump the version-updates group with 4 updates (#142)
• fdbc3ce chore(deps): bump the version-updates group with 5 updates (#139)
• c6abd55 chore(deps): bump actions/setup-java in the version-updates group (#138)
• b613a13 chore(deps): bump the version-updates group with 6 updates (#137)
• 806cfd4 chore(deps): bump the version-updates group with 5 updates (#135)
• 64cf2c2 chore(deps): bump the version-updates group with 2 updates (#134)
• See full diff in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates io.grpc:grpc-protobuf from 1.82.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.19

Updates org.apache.spark:spark-sql_2.13 from 4.1.2 to 4.2.0

Updates com.fasterxml.jackson.core:jackson-databind from 2.21.5 to 2.22.2

Commits

• 25b2a22 [maven-release-plugin] prepare release jackson-databind-2.22.2
• bab1c1a Prep for 2.22.2 release
• bc03cf8 Merge branch '2.21' into 2.22
• 83379fb Merge branch '2.20' into 2.21
• 0d400c9 Merge branch '2.19' into 2.20
• ce36a27 Merge branch '2.18' into 2.19
• 7a209e1 Post-release dep version bump
• a432707 [maven-release-plugin] prepare for next development iteration
• 176df1d [maven-release-plugin] prepare release jackson-databind-2.18.10
• 7785f5f Prep for 2.18.10 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions