Upgrade dependencies

Also add a mention in RELEASING.md that we should check github actions
for updates.

Author: ejona86

.github/workflows/branch-testing.yml

@@ -20,14 +20,14 @@ jobs:
       fail-fast: false # Should swap to true if we grow a large matrix
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@v6
+    - uses: actions/setup-java@v5
       with:
         java-version: ${{ matrix.jre }}
         distribution: 'temurin'
 
     - name: Gradle cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.gradle/caches

.github/workflows/gradle-wrapper-validation.yml

@@ -9,5 +9,5 @@ jobs:
     name: "Gradle wrapper validation"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: gradle/actions/wrapper-validation@v4
+      - uses: actions/checkout@v6
+      - uses: gradle/actions/wrapper-validation@v6

.github/workflows/lock.yml

@@ -13,7 +13,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@v6
         with:
           github-token: ${{ github.token }}
           issue-inactive-days: 90

.github/workflows/testing.yml

@@ -21,14 +21,14 @@ jobs:
       fail-fast: false # Should swap to true if we grow a large matrix
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@v6
+    - uses: actions/setup-java@v5
       with:
         java-version: ${{ matrix.jre }}
         distribution: 'temurin'
 
     - name: Gradle cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.gradle/caches
@@ -37,7 +37,7 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-gradle-
     - name: Maven cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.m2/repository
@@ -46,7 +46,7 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-maven-
     - name: Protobuf cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: /tmp/protobuf-cache
         key: ${{ runner.os }}-maven-${{ hashFiles('buildscripts/make_dependencies.sh') }}
@@ -55,7 +55,7 @@ jobs:
       run: buildscripts/kokoro/unix.sh
     - name: Post Failure Upload Test Reports to Artifacts
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: Test Reports (JRE ${{ matrix.jre }})
         path: |
@@ -71,7 +71,7 @@ jobs:
         COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
       run: ./gradlew :grpc-all:coveralls -PskipAndroid=true -x compileJava
     - name: Codecov
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@v6
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
 
@@ -88,15 +88,15 @@ jobs:
       USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: Check versions match in MODULE.bazel and repositories.bzl
       run: |
         diff -u <(sed -n '/GRPC_DEPS_START/,/GRPC_DEPS_END/ {/GRPC_DEPS_/! p}' MODULE.bazel) \
                 <(sed -n '/GRPC_DEPS_START/,/GRPC_DEPS_END/ {/GRPC_DEPS_/! p}' repositories.bzl)
 
     - name: Bazel cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/.cache/bazel/*/cache

MODULE.bazel

@@ -13,16 +13,16 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.auto.value:auto-value-annotations:1.11.0",
     "com.google.auto.value:auto-value:1.11.0",
     "com.google.code.findbugs:jsr305:3.0.2",
-    "com.google.code.gson:gson:2.13.2",
-    "com.google.errorprone:error_prone_annotations:2.48.0",
+    "com.google.code.gson:gson:2.14.0",
+    "com.google.errorprone:error_prone_annotations:2.50.0",
     "com.google.guava:failureaccess:1.0.1",
-    "com.google.guava:guava:33.5.0-android",
+    "com.google.guava:guava:33.6.0-android",
     "com.google.re2j:re2j:1.8",
     "com.google.s2a.proto.v2:s2a-proto:0.1.3",
     "com.google.truth:truth:1.4.5",
-    "dev.cel:runtime:0.12.0",
-    "dev.cel:protobuf:0.12.0",
-    "dev.cel:common:0.12.0",
+    "dev.cel:runtime:0.13.0",
+    "dev.cel:protobuf:0.13.0",
+    "dev.cel:common:0.13.0",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
     "io.netty:netty-buffer:4.2.15.Final",

RELEASING.md

@@ -250,3 +250,7 @@ gRPC for things that will need a migration effort.
 When happy with the dependency upgrades, update the versions in `MODULE.bazel`,
 `repositories.bzl`, and the various `pom.xml` and `build.gradle` files in
 `examples/`.
+
+Upgrade the `uses:` for actions in `.github/workflows` to newer versions. Make
+sure to see what changed in each new major version, but it is most often just
+requiring a newer Node.js version.

examples/build.gradle

@@ -22,7 +22,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.83.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.8'
+def protobufVersion = '3.25.9'
 def protocVersion = protobufVersion
 
 dependencies {

examples/example-gauth/pom.xml

@@ -31,7 +31,7 @@
       <dependency><!-- upgrade version from google-auth-library-oauth2-http -->
         <groupId>com.google.code.gson</groupId>
         <artifactId>gson</artifactId>
-        <version>2.13.2</version>
+        <version>2.14.0</version>
       </dependency>
     </dependencies>
   </dependencyManagement>

examples/example-gcp-csm-observability/build.gradle

@@ -24,8 +24,8 @@ java {
 // updating the version in our release process.
 def grpcVersion = '1.83.0-SNAPSHOT' // CURRENT_GRPC_VERSION
 def protocVersion = '3.25.8'
-def openTelemetryVersion = '1.56.0'
-def openTelemetryPrometheusVersion = '1.56.0-alpha'
+def openTelemetryVersion = '1.63.0'
+def openTelemetryPrometheusVersion = '1.63.0-alpha'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"

examples/example-hostname/build.gradle

@@ -3,7 +3,7 @@ plugins {
     id 'java'
 
     id "com.google.protobuf" version "0.9.5"
-    id 'com.google.cloud.tools.jib' version '3.4.4' // For releasing to Docker Hub
+    id 'com.google.cloud.tools.jib' version '3.5.3' // For releasing to Docker Hub
 }
 
 repositories {