Merge remote-tracking branch 'upstream/master' into ext-proc

# Conflicts:
#	xds/src/test/java/io/grpc/xds/XdsNameResolverTest.java

Author: kannanjgithub

.bazelrc

@@ -1 +1,3 @@
 build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
+
+common:skip_android --deleted_packages=android,binder

.github/workflows/testing.yml

@@ -80,8 +80,12 @@ jobs:
     strategy:
       matrix:
         bzlmod: [true, false]
+        bazel_version: [8.7.0, 9.1.0]
+        exclude:
+          - bazel_version: 9.1.0
+            bzlmod: false
     env:
-      USE_BAZEL_VERSION: 7.7.1
+      USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
 
     steps:
     - uses: actions/checkout@v4
@@ -100,11 +104,11 @@ jobs:
         key: ${{ runner.os }}-bazel-${{ env.USE_BAZEL_VERSION }}-${{ hashFiles('WORKSPACE', 'repositories.bzl') }}
 
     - name: Run bazel build
-      run: bazelisk build //... --enable_bzlmod=${{ matrix.bzlmod }}
+      run: bazelisk build //... --config=skip_android --enable_bzlmod=${{ matrix.bzlmod }} --enable_workspace=${{ !matrix.bzlmod }}
 
     - name: Run bazel test
-      run: bazelisk test //... --enable_bzlmod=${{ matrix.bzlmod }}
+      run: bazelisk test //... --config=skip_android --enable_bzlmod=${{ matrix.bzlmod }} --enable_workspace=${{ !matrix.bzlmod }}
 
     - name: Run example bazel build
-      run: bazelisk build //... --enable_bzlmod=${{ matrix.bzlmod }}
+      run: bazelisk build //... --enable_bzlmod=${{ matrix.bzlmod }} --enable_workspace=${{ !matrix.bzlmod }}
       working-directory: ./examples

COMPILING.md

@@ -150,3 +150,26 @@ $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses
 
 # Add 'export ANDROID_HOME=$HOME/Android/Sdk' to your .bashrc or equivalent
 ```
+
+Building with Bazel
+===================
+
+grpc-java can also be built using [Bazel](https://bazel.build/). We support
+the two most recent major versions of Bazel.
+[Install bazelisk](https://github.com/bazelbuild/bazelisk#installation)
+to ensure you're always building using the latest supported version, then try:
+
+```
+$ bazelisk build //...
+```
+
+Some parts of grpc-java depend on Android. Bazel can build these parts too but,
+for size, licensing and maintenance reasons, it requires a locally installed
+Android SDK. If you don't have the SDK and/or don't care about Android, use the
+`skip_android` configuration to skip building the Android parts:
+
+```sh
+$ bazelisk build //... --config=skip_android
+```
+
+You cannot run the tests from Bazel at this time.

MODULE.bazel

@@ -1,7 +1,6 @@
 module(
     name = "grpc-java",
     version = "1.82.0-SNAPSHOT",  # CURRENT_GRPC_VERSION
-    compatibility_level = 0,
     repo_name = "io_grpc_grpc_java",
 )
 
@@ -21,22 +20,25 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.re2j:re2j:1.8",
     "com.google.s2a.proto.v2:s2a-proto:0.1.3",
     "com.google.truth:truth:1.4.5",
+    "dev.cel:runtime:0.12.0",
+    "dev.cel:protobuf:0.12.0",
+    "dev.cel:common:0.12.0",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
-    "io.netty:netty-buffer:4.1.132.Final",
-    "io.netty:netty-codec-http2:4.1.132.Final",
-    "io.netty:netty-codec-http:4.1.132.Final",
-    "io.netty:netty-codec-socks:4.1.132.Final",
-    "io.netty:netty-codec:4.1.132.Final",
-    "io.netty:netty-common:4.1.132.Final",
-    "io.netty:netty-handler-proxy:4.1.132.Final",
-    "io.netty:netty-handler:4.1.132.Final",
-    "io.netty:netty-resolver:4.1.132.Final",
+    "io.netty:netty-buffer:4.1.133.Final",
+    "io.netty:netty-codec-http2:4.1.133.Final",
+    "io.netty:netty-codec-http:4.1.133.Final",
+    "io.netty:netty-codec-socks:4.1.133.Final",
+    "io.netty:netty-codec:4.1.133.Final",
+    "io.netty:netty-common:4.1.133.Final",
+    "io.netty:netty-handler-proxy:4.1.133.Final",
+    "io.netty:netty-handler:4.1.133.Final",
+    "io.netty:netty-resolver:4.1.133.Final",
     "io.netty:netty-tcnative-boringssl-static:2.0.75.Final",
     "io.netty:netty-tcnative-classes:2.0.75.Final",
-    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.132.Final",
-    "io.netty:netty-transport-native-unix-common:4.1.132.Final",
-    "io.netty:netty-transport:4.1.132.Final",
+    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.133.Final",
+    "io.netty:netty-transport-native-unix-common:4.1.133.Final",
+    "io.netty:netty-transport:4.1.133.Final",
     "io.opencensus:opencensus-api:0.31.0",
     "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
     "io.perfmark:perfmark-api:0.27.0",
@@ -50,13 +52,21 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
 bazel_dep(name = "abseil-cpp", version = "20250512.1")
 bazel_dep(name = "bazel_jar_jar", version = "0.1.11.bcr.1")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
-bazel_dep(name = "googleapis", version = "0.0.0-20240326-1c8d509c5", repo_name = "com_google_googleapis")
+bazel_dep(name = "googleapis", version = "0.0.0-20260514-1dbb1a14", repo_name = "com_google_googleapis")
 bazel_dep(name = "grpc-proto", version = "0.0.0-20240627-ec30f58.bcr.1", repo_name = "io_grpc_grpc_proto")
 bazel_dep(name = "protobuf", version = "33.4", repo_name = "com_google_protobuf")
+bazel_dep(name = "rules_android", version = "0.7.2")
 bazel_dep(name = "rules_cc", version = "0.0.9")
 bazel_dep(name = "rules_java", version = "9.1.0")
 bazel_dep(name = "rules_jvm_external", version = "6.0")
 
+android_sdk_repository_extension = use_extension(
+    "@rules_android//rules/android_sdk_repository:rule.bzl",
+    "android_sdk_repository_extension",
+)
+use_repo(android_sdk_repository_extension, "androidsdk")
+register_toolchains("@androidsdk//:sdk-toolchain", "@androidsdk//:all")
+
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.install(
     artifacts = IO_GRPC_GRPC_JAVA_ARTIFACTS,
@@ -67,6 +77,30 @@ maven.install(
 )
 use_repo(maven, "maven")
 
+# Define a separate, dev-only extension import for Android deps.
+# This prevents downstream non-Android users from having to resolve
+# Google Maven (which is required for androidx.*) or rules_android transitively.
+grpc_android_maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven", dev_dependency = True)
+grpc_android_maven.install(
+    name = "grpc_android_maven",
+    artifacts = [
+        "androidx.annotation:annotation:1.6.0",
+        "androidx.annotation:annotation-jvm:1.6.0",
+        "androidx.core:core:1.13.1",
+        "androidx.lifecycle:lifecycle-common:2.6.2",
+    ],
+    repositories = [
+        "https://repo.maven.apache.org/maven2/",
+        "https://maven.google.com",
+    ],
+    strict_visibility = True,
+    # For Bazel 8+ compatibility.
+    use_starlark_android_rules = True,
+    # Set this explicitly since the default guess is incorrect under Bzlmod.
+    aar_import_bzl_label = "@rules_android//rules:rules.bzl",
+)
+use_repo(grpc_android_maven, "grpc_android_maven")
+
 maven.override(
     coordinates = "com.google.protobuf:protobuf-java",
     target = "@com_google_protobuf//:protobuf_java",

android/BUILD.bazel

@@ -0,0 +1,23 @@
+load("@rules_android//rules:rules.bzl", "android_library")
+load("@rules_jvm_external//:defs.bzl", "artifact")
+
+licenses(["notice"])
+
+android_library(
+    name = "android",
+    srcs = glob([
+        "src/main/java/**/*.java",
+    ]),
+    manifest = "src/main/AndroidManifest.xml",
+    custom_package = "io.grpc.android",
+    # TODO(jdcormie): Figure out how to expose this publicly without making
+    # existing non-android users configure rules_android and maven.google.com.
+    visibility = ["//:__subpackages__"],
+    deps = [
+        "//api",
+        "//core:internal",
+        artifact("com.google.code.findbugs:jsr305"),
+        artifact("com.google.errorprone:error_prone_annotations"),
+        artifact("com.google.guava:guava"),
+    ],
+)

api/src/main/java/io/grpc/Channel.java

@@ -16,7 +16,6 @@
 
 package io.grpc;
 
-import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * A virtual connection to a conceptual endpoint, to perform RPCs. A channel is free to have zero or
@@ -29,8 +28,9 @@
  * implementations using {@link ClientInterceptor}. It is expected that most application
  * code will not use this class directly but rather work with stubs that have been bound to a
  * Channel that was decorated during application initialization.
+ *
+ * <p>This class is thread-safe.
  */
-@ThreadSafe
 public abstract class Channel {
   /**
    * Create a {@link ClientCall} to the remote operation specified by the given

api/src/main/java/io/grpc/ChannelLogger.java

@@ -16,15 +16,15 @@
 
 package io.grpc;
 
-import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * A Channel-specific logger provided by GRPC library to {@link LoadBalancer} implementations.
  * Information logged here goes to <strong>Channelz</strong>, and to the Java logger of this class
  * as well.
+ *
+ * <p>This class is thread-safe.
  */
 @ExperimentalApi("https://github.com/grpc/grpc-java/issues/5029")
-@ThreadSafe
 public abstract class ChannelLogger {
   /**
    * Log levels.  See the table below for the mapping from the ChannelLogger levels to Channelz

api/src/main/java/io/grpc/ClientInterceptor.java

@@ -16,7 +16,6 @@
 
 package io.grpc;
 
-import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * Interface for intercepting outgoing calls before they are dispatched by a {@link Channel}.
@@ -37,8 +36,10 @@
  * without completing the previous ones first. Refer to the
  * {@link io.grpc.ClientCall.Listener ClientCall.Listener} docs for more details regarding thread
  * safety of the returned listener.
+ * 
+ * <p>This is thread-safe and should be considered
+ * for the errorprone ThreadSafe annotation in the future.
  */
-@ThreadSafe
 public interface ClientInterceptor {
   /**
    * Intercept {@link ClientCall} creation by the {@code next} {@link Channel}.

api/src/main/java/io/grpc/ClientStreamTracer.java

@@ -19,13 +19,13 @@
 import static com.google.common.base.Preconditions.checkNotNull;
 
 import com.google.common.base.MoreObjects;
-import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * {@link StreamTracer} for the client-side.
+ *
+ * <p>This class is thread-safe.
  */
 @ExperimentalApi("https://github.com/grpc/grpc-java/issues/2861")
-@ThreadSafe
 public abstract class ClientStreamTracer extends StreamTracer {
   /**
    * Indicates how long the call was delayed, in nanoseconds, due to waiting for name resolution

api/src/main/java/io/grpc/HandlerRegistry.java

@@ -19,12 +19,12 @@
 import java.util.Collections;
 import java.util.List;
 import javax.annotation.Nullable;
-import javax.annotation.concurrent.ThreadSafe;
 
 /**
  * Registry of services and their methods used by servers to dispatching incoming calls.
+ *
+ * <p>This class is thread-safe.
  */
-@ThreadSafe
 public abstract class HandlerRegistry {
 
   /**