deps: Bump grpc-java and netty versions to latest ✨

[vorburger]

Triggered by #1689, might (?) also help (TBC) with #1687; @ejona86 FYI.

https://github.com/enola-dev/git-commit-message-agent says:

The grpc-java dependency version has been updated from 1.73.0 to 1.75.0 in MODULE.bazel, docs/dev/dependencies.txt, and maven_install.json. Accompanying this, several io.netty dependencies, such as netty-buffer, netty-codec, netty-handler, and netty-transport, have been bumped from 4.1.116.Final (or 4.1.110.Final for netty-codec-http2) to 4.1.124.Final across docs/dev/dependencies.txt and maven_install.json. The MODULE.bazel.lock and maven_install.json files have been updated with new shasums and hashes to reflect these dependency changes. Notably, MODULE.bazel.lock also shows significant removals of older cel-spec, grpc, grpc-java, and upb related repository configurations, streamlining the dependency management.

---

New versions arrive,
Dependencies now updated,
Code runs smooth and fast.

[gemini-code-assist]

Summary of Changes

Hello @vorburger, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on updating critical Java dependencies, specifically grpc-java and io.netty, to their latest stable versions. The primary goal is to leverage recent bug fixes, performance enhancements, and security improvements provided by these updated libraries, while also cleaning up and optimizing the Bazel dependency lock file for more efficient management.

Highlights

• Dependency Updates: Updated grpc-java dependency from version 1.73.0 to 1.75.0 across relevant configuration files.
• Netty Version Bump: Bumped various io.netty dependencies, including netty-buffer, netty-codec, netty-handler, and netty-transport, to version 4.1.124.Final.
• Dependency Management Streamlining: Streamlined MODULE.bazel.lock by removing outdated cel-spec, grpc, grpc-java, and upb related repository configurations, simplifying the dependency graph.
• Checksum and Hash Refresh: Refreshed shasums and hashes in MODULE.bazel.lock and maven_install.json to accurately reflect the new dependency versions.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request successfully updates grpc-java to version 1.75.0 and most netty dependencies to 4.1.124.Final. The changes are mostly in dependency configuration files and appear correct. I have one suggestion for improving consistency in MODULE.bazel. A more significant concern is the mix of netty versions; while many artifacts are updated, several netty-transport-* dependencies remain at 4.1.116.Final. This could lead to potential runtime issues and should be investigated to ensure all related artifacts use a consistent version.

[gemini-code-assist]

There appear to be mixed versions of io.netty dependencies. While many have been updated to 4.1.124.Final, some artifacts like netty-transport-classes-epoll, netty-transport-classes-kqueue, netty-transport-native-epoll, and netty-transport-native-kqueue remain at 4.1.116.Final. Using inconsistent versions for artifacts from the same library can lead to subtle runtime issues. It's highly recommended to align all io.netty dependencies to the same version, 4.1.124.Final.

[vorburger]

Oh, well spotted; Thank You for pointing this out.

But it's already like that, this isn't make it worse.

So if this passes the build I'll merge it already as-is anyway - but follow up on this later.

[gemini-code-assist]

For consistency and to avoid confusion, consider updating GRPC_JAVA_VERSION_BUILD to match GRPC_JAVA_VERSION. While the git_override on line 57 ensures the correct version (1.75.0) is used, having a stale version number here can be misleading for future maintenance.

Suggested change

	GRPC_JAVA_VERSION_BUILD = "1.73.0"
	GRPC_JAVA_VERSION_BUILD = "1.75.0"

[vorburger]

That might not be so easily possible, but a great reminder for me to pick up grpc/grpc-java#12055 and grpc/grpc-java#12135 again... So if this passes the build I'll merge it already as-is anyway - but follow up on this later.

[vorburger]

#1691 fixes this