build(deps): bump io.grpc:grpc-protobuf from 1.68.0 to 1.68.1 in /sdk/java/grpc

[dependabot]

Bumps io.grpc:grpc-protobuf from 1.68.0 to 1.68.1.

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

v1.68.1

gRPC Java 1.68.1 Release Notes

v1.68.0 was a mistake. This is the first release of version 1.68.x

Bug Fixes

• xds: Fix NullPointerException introduced in "Fix load reporting when pick first is used for locality-routing" (#11553). This was in 1.67.1 but not 1.68.0

Behavior Changes

• core: JSON parsing rejects duplicate keys in objects (#11575) (4be69e3f8). This is the existing behavior in C core. Duplicate keys in objects are dangerous as which value takes effect is undefined. Previously, the last value was used
• okhttp: Detect transport executors with no remaining threads (#11503) (3a6be9ca1). The transport uses two threads, but one is on-demand. If the executor provided to builder.transportExecutor() runs out of threads (e.g., it is a fixed-size thread pool), all transports can be wedged, unable to run on-demand tasks, until keepalive kills one of them. Two threads are now used when handshaking a new transport, and the transport will time out after 1 second with “Timed out waiting for second handshake thread” if two threads are unavailable
• gcp-csm-o11y: Get mesh_id value from CSM_MESH_ID environment variable, instead of getting it from bootstrap file (84d30afad)

Improvements

• New grpc-context-override-opentelemetry artifact (#11523) (782a44ad6) (#11599) (e59ae5fad). This is a io.grpc.Context storage override to store its state in io.opentelemetry.context.Context. Libraries should not add a dependency on this artifact, as applications can only have one storage override in their classpath
• New grpc-s2a artifact. It is a transport that offloads the handshake similar to ALTS, but for TLS. It provides io.grpc.s2a.S2AChannelCredentials
• api: Enhance name resolver `ResolutionResult` to hold addresses or error so the single listener API onResult2 is used to convey both success and error cases for name resolution (#11330) (1ded8aff8)
• core: Handle NameResolver/LoadBalancer exceptions when panicking (b692b9d26). This expands the class of bugs that will fail RPCs with the panic error, versus some undefined behavior
• core: Use the default service config in case of initial name resolver address resolution error (#11577) (fa26a8bc5)
• core: StreamTracer.inboundMessageRead() now reports uncompressed message size when the message does not need compression (#11598) (2aae68e11). Previously it always reported -1 (unknown)
• netty: Avoid TCP_USER_TIMEOUT warning when explicitly specifying a non-epoll channel type to use (#11564) (62f409810)
• okhttp: Don't warn about missing Conscrypt (6f3542297). This is especially helpful when using TLS but not running on Android
• android: For UdsChannelBuilder, use fake IP instead of localhost (a908b5e40). This avoids an unnecessary DNS lookup
• xds: Add xDS node ID in select control plane errors to enable cross-referencing with control plane logs when debugging (f3cf7c3c7)
• xds: Enhanced how ADS stream terminations are handled, specifically addressing cases where a response has or hasn't been received (#2e9c3e19f)
• binder: Update status code documentation for Android 11's package visibility rules. (#11551) (99be6e985)
• binder: Update binderDied() error description to spell out the possibilities for those unfamiliar with Android internals. (#11628) (46c1b387f)
• example-gauth: Use application default creds instead of file argument (#11595) (94a0a0d1c)
• opentelemetry: Experimental OpenTelemetry tracing is available. Set the GRPC_EXPERIMENTAL_ENABLE_OTEL_TRACING environment variable to true to enable tracing support in GrpcOpenTelemetry (#11409, #11477)(043ba55, 421e237)

Dependencies

• Updated protobuf-java to 3.25.5. This helps avoid CVE-2024-7254 (2ff837ab6)

Thanks to:
@​Juneezee
@​lgalfaso
@​bestbeforetoday
@​hlx502
@​JoeCqupt

Commits

• 16f93c8 Bump version to 1.68.1
• 2b53352 Update README etc to reference 1.68.1
• 135f433 Revert "stub: Ignore unary response on server if status is not OK" (#11636) (...
• 2d0c158 Bump to 1.68.1-SNAPSHOT (#11637)
• 46c1b38 Update binderDied() error description to spell out the possibilities for thos...
• b65cbf5 inprocess: Support tracing message sizes guarded by flag (#11629)
• 62f4098 netty: Avoid TCP_USER_TIMEOUT warning when not using epoll (#11564)
• 00c8bc7 Minor grammar fix in Javadoc (#11609)
• 4be69e3 core: SpiffeUtil API for extracting Spiffe URI and loading TrustBundles (#11575)
• 1e0928f api: fix javadoc of CallCredentials.applyRequestMetadata
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.