chore(gradle): bump io.grpc:grpc-bom from 1.58.0 to 1.68.1

[dependabot]

Bumps io.grpc:grpc-bom from 1.58.0 to 1.68.1.

Release notes

Sourced from io.grpc:grpc-bom's releases.

v1.68.1

gRPC Java 1.68.1 Release Notes

v1.68.0 was a mistake. This is the first release of version 1.68.x

Bug Fixes

• xds: Fix NullPointerException introduced in "Fix load reporting when pick first is used for locality-routing" (#11553). This was in 1.67.1 but not 1.68.0

Behavior Changes

• core: JSON parsing rejects duplicate keys in objects (#11575) (4be69e3f8). This is the existing behavior in C core. Duplicate keys in objects are dangerous as which value takes effect is undefined. Previously, the last value was used
• okhttp: Detect transport executors with no remaining threads (#11503) (3a6be9ca1). The transport uses two threads, but one is on-demand. If the executor provided to builder.transportExecutor() runs out of threads (e.g., it is a fixed-size thread pool), all transports can be wedged, unable to run on-demand tasks, until keepalive kills one of them. Two threads are now used when handshaking a new transport, and the transport will time out after 1 second with “Timed out waiting for second handshake thread” if two threads are unavailable
• gcp-csm-o11y: Get mesh_id value from CSM_MESH_ID environment variable, instead of getting it from bootstrap file (84d30afad)

Improvements

• New grpc-context-override-opentelemetry artifact (#11523) (782a44ad6) (#11599) (e59ae5fad). This is a io.grpc.Context storage override to store its state in io.opentelemetry.context.Context. Libraries should not add a dependency on this artifact, as applications can only have one storage override in their classpath
• New grpc-s2a artifact. It is a transport that offloads the handshake similar to ALTS, but for TLS. It provides io.grpc.s2a.S2AChannelCredentials
• api: Enhance name resolver `ResolutionResult` to hold addresses or error so the single listener API onResult2 is used to convey both success and error cases for name resolution (#11330) (1ded8aff8)
• core: Handle NameResolver/LoadBalancer exceptions when panicking (b692b9d26). This expands the class of bugs that will fail RPCs with the panic error, versus some undefined behavior
• core: Use the default service config in case of initial name resolver address resolution error (#11577) (fa26a8bc5)
• core: StreamTracer.inboundMessageRead() now reports uncompressed message size when the message does not need compression (#11598) (2aae68e11). Previously it always reported -1 (unknown)
• netty: Avoid TCP_USER_TIMEOUT warning when explicitly specifying a non-epoll channel type to use (#11564) (62f409810)
• okhttp: Don't warn about missing Conscrypt (6f3542297). This is especially helpful when using TLS but not running on Android
• android: For UdsChannelBuilder, use fake IP instead of localhost (a908b5e40). This avoids an unnecessary DNS lookup
• xds: Add xDS node ID in select control plane errors to enable cross-referencing with control plane logs when debugging (f3cf7c3c7)
• xds: Enhanced how ADS stream terminations are handled, specifically addressing cases where a response has or hasn't been received (#2e9c3e19f)
• binder: Update status code documentation for Android 11's package visibility rules. (#11551) (99be6e985)
• binder: Update binderDied() error description to spell out the possibilities for those unfamiliar with Android internals. (#11628) (46c1b387f)
• example-gauth: Use application default creds instead of file argument (#11595) (94a0a0d1c)
• opentelemetry: Experimental OpenTelemetry tracing is available. Set the GRPC_EXPERIMENTAL_ENABLE_OTEL_TRACING environment variable to true to enable tracing support in GrpcOpenTelemetry (#11409, #11477)(043ba55, 421e237)

Dependencies

• Updated protobuf-java to 3.25.5. This helps avoid CVE-2024-7254 (2ff837ab6)

Thanks to:
@​Juneezee
@​lgalfaso
@​bestbeforetoday
@​hlx502
@​JoeCqupt

v1.68.0 MISTAKE

This was supposed to be v1.67.0, but there was a mistake during the release process. This has everything in v1.67.1, except for:

• xds: Fix NullPointerException introduced in "Fix load reporting when pick first is used for locality-routing" (grpc/grpc-java#11553)

v1.67.1

gRPC Java 1.67.1 Release Notes

... (truncated)

Commits

• 16f93c8 Bump version to 1.68.1
• 2b53352 Update README etc to reference 1.68.1
• 135f433 Revert "stub: Ignore unary response on server if status is not OK" (#11636) (...
• 2d0c158 Bump to 1.68.1-SNAPSHOT (#11637)
• 46c1b38 Update binderDied() error description to spell out the possibilities for thos...
• b65cbf5 inprocess: Support tracing message sizes guarded by flag (#11629)
• 62f4098 netty: Avoid TCP_USER_TIMEOUT warning when not using epoll (#11564)
• 00c8bc7 Minor grammar fix in Javadoc (#11609)
• 4be69e3 core: SpiffeUtil API for extracting Spiffe URI and loading TrustBundles (#11575)
• 1e0928f api: fix javadoc of CallCredentials.applyRequestMetadata
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

The following labels could not be found: NoDocumentationNeeded, NoReleaseNotesNeeded, version-bump.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.