Bump com.google.cloud:libraries-bom from 26.74.0 to 26.75.0 by dependabot[bot] · Pull Request #7150 · micrometer-metrics/micrometer (original) (raw)

v26.75.0

GCP Libraries BOM 26.75.0

Upgrade Overview

The libraries-bom and its managed libraries have been upgraded to use Protobuf v4.33.2. All Protobuf gen code included in the managed libraries has been regenerated using protoc v33.2.

✅ Backward Compatibility

The new protobuf-java v4.33.2 runtime is fully backward-compatible with protoc gen code 3.x. You should not experience any incompatibilities from using older gen code with the new runtime. Should you experience compatibility issues, please consult the Known Incompatibilities & Mitigations. If the issue persists, please file a report via the support console or our GitHub repository

⚠️ Advisory: Vulnerability Warnings

After upgrading, you may see a new warning in your logs: Vulnerable protobuf generated type in use. This warning does not mean the Java SDK is vulnerable. It indicates that your application, or one of its other dependencies, is still using gen code < 3.21.7. For a detailed explanation and mitigation steps, please refer to the Java section in the official Protobuf v4.33.0 release notes.

Known Incompatibilities & Mitigations

While rare, the following incompatibilities may occur due to the version update:

1. Runtime Version Mismatch

• Issue: The minimum required protobuf-java runtime version is now v4.33.2. Starting with the 4.x runtime, validations ensure the runtime version is higher than or equal to the gen code version. Using a lower version of protobuf-java will produce errors below.
• Symptoms:
  • java.lang.NoClassDefFoundError: com/google/protobuf/RuntimeVersion$RuntimeDomain (when using 3.x versions).
  • com.google.protobuf.RuntimeVersion$ProtobufRuntimeVersionException (when using older 4.x versions).
• Mitigation: Upgrade the version of protobuf-java to be greater than or equal to v4.33.2.

2. Class Hierarchy Changes (GeneratedMessageV3)

• Issue: GeneratedMessageV3 is no longer a parent class of gen code.
• Symptoms: Runtime errors will occur if attempting to cast Proto 4.x gen code to GeneratedMessageV3. For example, DeleteInstanceRequest now extends GeneratedMessage instead of GeneratedMessageV3. You will run into java.lang.ClassCastException when trying to run (GeneratedMessageV3)DeleteInstanceRequest.
• Mitigation: Migrate usages of GeneratedMessageV3 to its parent interface, Message.

3. Descriptor Syntax APIs

• Issue: Certain internal methods in Descriptors are no longer available.
• Symptoms: java.lang.NoSuchMethodError when calling Syntax, getSyntax(), hasOptionalKeyword() or isSynthetic().
• Mitigation: There are no direct alternative methods; it is suggested to stop using them.

4. Legacy Generated Code (v2.x)

• Issue: The 4.33.x runtime is incompatible with v2.x gen code.
• Mitigation: Migrate gen code to at least v3.0.0. Please note that 3.x support will end in March 2027; it is strongly recommended to upgrade gen code to 4.x.

New Addition

• com.google.cloud:google-cloud-auditmanager:0.1.0

The group ID of the following artifacts is com.google.cloud.

Notable Changes

... (truncated)