fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
io.grpc:grpc-netty	1.68.0 -> 1.68.1
io.grpc:grpc-protobuf	1.68.0 -> 1.68.1
io.grpc:grpc-stub	1.68.0 -> 1.68.1
io.grpc:grpc-core	1.68.0 -> 1.68.1
com.sksamuel.cohort:cohort-logback	2.5.1 -> 2.6.0
com.sksamuel.cohort:cohort-ktor	2.5.1 -> 2.6.0
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	2.18.0 -> 2.18.1
com.fasterxml.jackson.core:jackson-databind (source)	2.18.0 -> 2.18.1
com.fasterxml.jackson.module:jackson-module-kotlin	2.18.0 -> 2.18.1
com.fasterxml.jackson.core:jackson-core	2.18.0 -> 2.18.1

---

Release Notes

grpc/grpc-java (io.grpc:grpc-netty)

v1.68.1

gRPC Java 1.68.1 Release Notes

v1.68.0 was a mistake. This is the first release of version 1.68.x

Bug Fixes

• xds: Fix NullPointerException introduced in "Fix load reporting when pick first is used for locality-routing" (#​11553). This was in 1.67.1 but not 1.68.0

Behavior Changes

• core: JSON parsing rejects duplicate keys in objects (#​11575) (4be69e3). This is the existing behavior in C core. Duplicate keys in objects are dangerous as which value takes effect is undefined. Previously, the last value was used
• okhttp: Detect transport executors with no remaining threads (#​11503) (3a6be9c). The transport uses two threads, but one is on-demand. If the executor provided to builder.transportExecutor() runs out of threads (e.g., it is a fixed-size thread pool), all transports can be wedged, unable to run on-demand tasks, until keepalive kills one of them. Two threads are now used when handshaking a new transport, and the transport will time out after 1 second with “Timed out waiting for second handshake thread” if two threads are unavailable
• gcp-csm-o11y: Get mesh_id value from CSM_MESH_ID environment variable, instead of getting it from bootstrap file (84d30af)

Improvements

• New grpc-context-override-opentelemetry artifact (#​11523) (782a44a) (#​11599) (e59ae5f). This is a io.grpc.Context storage override to store its state in io.opentelemetry.context.Context. Libraries should not add a dependency on this artifact, as applications can only have one storage override in their classpath
• New grpc-s2a artifact. It is a transport that offloads the handshake similar to ALTS, but for TLS. It provides io.grpc.s2a.S2AChannelCredentials
• api: Enhance name resolver `ResolutionResult` to hold addresses or error so the single listener API onResult2 is used to convey both success and error cases for name resolution (#​11330) (1ded8af)
• core: Handle NameResolver/LoadBalancer exceptions when panicking (b692b9d). This expands the class of bugs that will fail RPCs with the panic error, versus some undefined behavior
• core: Use the default service config in case of initial name resolver address resolution error (#​11577) (fa26a8b)
• core: StreamTracer.inboundMessageRead() now reports uncompressed message size when the message does not need compression (#​11598) (2aae68e). Previously it always reported -1 (unknown)
• netty: Avoid TCP_USER_TIMEOUT warning when explicitly specifying a non-epoll channel type to use (#​11564) (62f4098)
• okhttp: Don't warn about missing Conscrypt (6f35422). This is especially helpful when using TLS but not running on Android
• android: For UdsChannelBuilder, use fake IP instead of localhost (a908b5e). This avoids an unnecessary DNS lookup
• xds: Add xDS node ID in select control plane errors to enable cross-referencing with control plane logs when debugging (f3cf7c3)
• xds: Enhanced how ADS stream terminations are handled, specifically addressing cases where a response has or hasn't been received (#​2e9c3e19f)
• binder: Update status code documentation for Android 11's package visibility rules. (#​11551) (99be6e9)
• binder: Update binderDied() error description to spell out the possibilities for those unfamiliar with Android internals. (#​11628) (46c1b38)
• example-gauth: Use application default creds instead of file argument (#​11595) (94a0a0d)

Dependencies

• Updated protobuf-java to 3.25.5. This helps avoid CVE-2024-7254 (2ff837a)

Thanks to:
@​Juneezee
@​lgalfaso
@​bestbeforetoday
@​hlx502
@​JoeCqupt

sksamuel/cohort (com.sksamuel.cohort:cohort-logback)

v2.6.0

• Updated to use ktor 3.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Code Coverage

Total Project Coverage	85.54%	✅

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Please upload report for BASE (main@57ee45f). Learn more about missing BASE report.
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #619   +/-   ##
=======================================
  Coverage        ?   82.30%           
=======================================
  Files           ?       81           
  Lines           ?     2385           
  Branches        ?      137           
=======================================
  Hits            ?     1963           
  Misses          ?      325           
  Partials        ?       97           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.