chore(deps): update upper bound dependencies file

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
com.fasterxml.jackson:jackson-bom	2.22.1 → 2.22.2
com.google.auth:google-auth-library-bom	1.49.0 → 1.50.0
com.google.cloud:grpc-gcp (source)	1.12.0 → 1.13.0
com.google.guava:guava	33.6.0-jre → 33.7.1-jre
commons-codec:commons-codec (source)	1.22.0 → 1.22.1
dev.cel:cel	0.13.1 → 0.14.0
io.grpc:grpc-bom	1.83.0 → 1.83.1
io.opentelemetry:opentelemetry-bom	1.64.0 → 1.65.0
org.apache.httpcomponents.client5:httpclient5 (source)	5.6.2 → 5.6.4
org.jspecify:jspecify (source)	1.0.0 → 1.0.1
org.threeten:threetenbp (source)	1.7.3 → 1.7.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

googleapis/google-cloud-java (com.google.cloud:grpc-gcp)

v1.13.0

Compare Source

Features

• [aiplatform] add blocking_operation_ids to ImportFeatureValuesOperationMetadata (#​9481) (ba2c590)
• [billingbudgets] Add resource_ancestors field to support filtering by folders & organizations (#​9501) (0c3b677)
• [clouddeploy] Add support for disabling Pod overprovisioning in the progressive deployment strategy configuration for a Kubernetes Target (#​9499) (b7890c5)
• [contactcenterinsights] Add the resource definition of a STT recognizer (#​9492) (f2baa92)
• [migrationcenter] new module for migrationcenter (#​9514) (a268c80)

Bug Fixes

• deps: update dependency com.google.cloud:google-cloud-pubsub-bom to v1.123.13 (#​9478) (47778ff)
• deps: update dependency com.google.cloud:google-cloud-shared-config to v1.5.6 (#​9494) (739763f)
• deps: update dependency com.google.cloud:google-cloud-shared-dependencies to v3.11.0 (#​9505) (30bc6f0)
• deps: update dependency com.google.cloud:google-cloud-storage to v2.22.3 (#​9477) (ce1ce33)

Documentation

• update discoveryengine v1 docs link (#​9512) (f172c7e)

apache/commons-codec (commons-codec:commons-codec)

v1.22.1

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

cel-expr/cel-java (dev.cel:cel)

v0.14.0

Compare Source

This release officially introduces formal verification capabilities to CEL-Java, adds aggregate evaluation semantics to the CEL Policy Compiler, advances runtime modernization with the Program Planner, and brings key optimizer performance gains, conformance updates, and bug fixes.

---

🛡️ Formal Verification Framework

We are proud to announce the open-sourcing of the CEL Java Verifier (dev.cel:verifier and dev.cel:verifier-cli) (#​1123, #​1166). The verifier allows users to mathematically prove safety invariants, logical equivalence, satisfiability, and validity across CEL expressions and structured CEL Policies.

• Read the Announcement Blog Post: Securing the Agentic Era: Introducing Formal Verification for CEL
• Watch the Video Demo: YouTube Video Walkthrough
• Read the Documentation: CEL Java Verifier README & CLI/REPL Guide

Key Verifier Capabilities

• Logical Equivalence & Safe Refactoring: Statically prove that two ASTs or CEL Policies are semantically identical for all possible input states (#​1123, #​1125, #​1164).
• Satisfiability & Validity with Counterexample / Witness Generation:
  • isSatisfiable: Determines if an expression can ever evaluate to true and generates a concrete satisfying model (witness input) (#​1127).
  • isAlwaysTrue: Mathematically proves validity and generates human-readable counterexamples when violations are detected (#​1126, #​1136, #​1156, #​1161, #​1163).
• Custom Policy Invariants Verification: Allows policy authors to declare assume preconditions and assert clauses in CEL YAML policies and prove that safety invariants are never violated (#​1128, #​1144).
• Bounded Model Checking (BMC): Unrolls and verifies list and map comprehensions (all, exists, map, filter) up to configurable unroll limits (#​1129, #​1132, #​1174).
• Rich Type Reasoning: Supports cross-type numeric comparisons (#​1124), timestamp and duration arithmetic/axioms (#​1153), optional types and traversal (#​1131, #​1135, #​1138, #​1146), uninterpreted conversions (#​1154, #​1155), and JSON unwrapping (#​1147).
• Interactive CLI & REPL Tool: Available as a standalone executable JAR (dev.cel:verifier-cli) and interactive REPL shell for ad-hoc inspection and CI/CD validation (#​1159, #​1160, #​1168).

---

🚀 Highlights & New Features

• Aggregate Semantics in CEL Policy: Added support for aggregate policy rules to the CEL Policy Compiler according to the CEL Policy Specification (#​1052, #​1175), #​1187). Aggregate rules evaluate all matching rules (including nested subrules) and collect results into a flattened list with support for optional pruning.
• Shorthand Type Specifiers for Policy Configurations: Added support for inline shorthand type specifiers in CEL environment YAML configs (#​1185), allowing parameterized types such as map<string, int>, list<string>, and optional<T> to be declared as compact strings rather than verbose nested YAML structures.
• Protobuf Message Constant Folding: ConstantFoldingOptimizer now supports inlining evaluated Protobuf messages into structured message literal AST nodes, preserving field values and nested messages (#​1116).
• Parser Expression Node Limits: Added configurable node limits during parsing to prevent deeply nested or malicious expressions from exhausting resources (#​1148).

---

⚙️ Runtime & Optimizer Improvements

• Planner Migration & Default Documentation: Documentation and CEL-Java codelabs have been updated to make the Program Planner the default recommendation (#​1109). Standard CEL builders have shifted to proxy the legacy runtime (#​1110), and the Lite Runtime has also been migrated to the Program Planner (#​1119).

  ⚠️ Deprecation Notice: The legacy runtime will be deprecated in the next release. Callers are strongly urged to migrate to the Program Planner.

• Pre-Order Constant Folding: Switched constant folding optimizer traversal from post-order to pre-order (#​1097). By traversing top-down, the optimizer avoids evaluating and visiting subtrees that can already be folded or pruned at higher ancestor nodes, resulting in significant performance speedups on large ASTs.
• Optional Macro & Aggregate Literal Folding: Added constant folding support for optional macro calls (#​1105) and aggregate literal pruning (#​1106).
• Optimization Helpers & Validation: Introduced common helpers for fixed-point optimization passes and AST navigation (#​1170, #​1176), and added a validation pass to ensure AST ID uniqueness across optimizers (#​1178).

---

🐛 Bug Fixes & Correctness

• Program Planner Partial Evaluation: Fixed a bug in the execution plan to properly handle AccumulatedUnknowns during partial evaluation (#​1158).
• Constant Folding Fixes:
  • Fixed ConstantFoldingOptimizer to not treat true && dyn_x as a tautology (#​1133).
  • Prevented folding x in [x] for dynamic and double-typed variables to preserve correct numeric equivalence semantics (#​1162).
• Macro Iteration Variable Validation: Stricter validation for iteration variables in standard macros (all, exists, map, filter) to disallow identifiers starting with . and prevent collisions with internal __result__ accumulator variables (#​1096).
• Conformance & Type Fixes:
  • Fixed conformance issues around type conversion overflows and duration subtractions (#​1151).
  • Fixed parsed-only conformance test cases for receiver function names containing reserved keywords (#​1152).
• Optional Target Handling: Avoided unnecessary copying of complex targets in optMap and optFlatMap (#​1149).

---

👏 New Contributors

• @​stanleyhy made their first contribution adding Protobuf constant folding (#​1116) and fixing AccumulatedUnknowns handling in the planner (#​1158).

Full Changelog: cel-expr/cel-java@v0.13.1...v0.14.0

grpc/grpc-java (io.grpc:grpc-bom)

v1.83.1

Compare Source

gRPC Java 1.83.1 Release Notes

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#​12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
• core: Coalesce Contiguous Small Buffers for ReadableBuffer (#​12944)

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)

v1.65.0

Compare Source

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was
deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector
exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put
  (#​8658)
• Use NumberFormatException in baggage decoder
  (#​8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice
  (#​8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram,
  BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge,
  BoundDoubleGauge) to the incubator metrics API
  (#​8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity
  (#​8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator
  (#​8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract
  (#​8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed
  tokens (#​8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based
  on string value of AttributeKey.getKey()
  (#​8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default
  shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements
  it to stop its polling executor
  (#​8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version
  (#​8597)
• Record error.type on failed collections in PeriodicMetricReader
  (#​8650)
• Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact
  attribute matching
  (#​8518)

Logs

• Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp
  (#​8504)

Profiles

• Fix profiles data model attribute count parameter name and timestamp doc unit
  (#​8514)

Exporters

• WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published
  (#​8677)
• OTLP: Use HTTP error response bodies in HttpExporter warning logs
  (#​8428)
• OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store
  (#​8565)
• OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler
  (#​8493)
• OTLP: Standardize OkHttpHttpSender, JdkHttpSender, and UpstreamGrpcSender shutdown to
  await executor/channel termination
  (#​8495,
  #​8627,
  #​8624)
• OTLP: Log the underlying except/ion when a gRPC response frame is invalid
  (#​8626)
• OTLP: Avoid the unsafe string encoder on Android
  (#​8637)
• Prometheus: Merge colliding Prometheus label values
  (#​8364)
• Prometheus: Fix PrometheusHttpServer.toBuilder() dropping the configured default handler
  (#​8619)
• Logging: Output event name in SystemOutLogRecordExporter
  (#​8609)
• Logging: Include aggregation temporality in LoggingMetricExporter toString
  (#​8623)

Extensions

• Autoconfigure: Avoid exposing configuration values in error messages
  (#​8669)
• Declarative config: Fix Jaeger sampler polling interval configuration
  (#​8668)
• Declarative config: Remove duplicate getStringList resolver in DeclarativeConfigPropertyUtil
  (#​8572)
• Declarative config: Replace jsonschema2pojo with a hand-rolled POJO generator
  (#​8600)
• Incubator: Restore compliance between composite samplers code and the spec
  (#​8450)

Shims

• DEPRECATION Deprecate the OpenCensus shim public API
  (#​8674)
• OpenCensus: Preserve OpenCensus status description when converting to OpenTelemetry
  (#​8511)
• OpenCensus: Add links to the OpenTelemetry span instead of logging a warning and dropping them
  (#​8635)
• OpenTracing: Return null from TracerShim extract when the carrier has no span context
  (#​8505)
• OpenTracing: Return the extracted SpanContext when it is sampled but invalid
  (#​8634)

Project tooling

• Pin japicmp baseline in version.gradle.kts
  (#​8591)
• Update contributing guide in response to feedback
  (#​8655)

jspecify/jspecify (org.jspecify:jspecify)

v1.0.1: 1.0.1

JSpecify 1.0.1 makes small changes to documentation and build setup but no semantic changes.

Artifacts

• Javadoc
• Maven Central: org.jspecify:jspecify

Changes since version 1.0.0

• The JSpecify module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/MANIFEST.MF, which was causing trouble for some users, particularly on Android.
• The JSpecify module-info.class now contains its version number.
• We have made various improvements to our Javadoc. While the latest docs are always available at jspecify.dev/docs/api, this release makes our improvements visible in the source files in your IDE.

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.4

Compare Source

See the change notes for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the dependency version of org.threeten:threetenbp from 1.7.3 to 1.7.4 in sdk-platform-java/dependencies.txt. There are no review comments, and I have no feedback to provide.