Update dependencies (#6889)

- Athenz 1.12.42 -> 1.12.44
- GraphQL Java 25.0 -> 26.0
- gRPC-Java 1.81.0 -> 1.83.0
- gRPC-Kotlin 1.4.1 -> 1.4.3
- Jackson 2.22.0 -> 2.22.1
- Javassist 3.31.0-GA -> 3.32.0-GA
- java-jwt 4.5.2 -> 4.6.0
- JBoss Logging Annotations 2.2.1.Final -> 2.2.2.Final
- Jetty 9.4 9.4.55.v20240627 -> 9.4.58.v20250814
- Jetty 12 12.0.32 -> 12.0.37
- JUnit 5 5.14.2 -> 5.14.4
- Kafka 3.9.1 -> 3.9.2
- Kotlin 2.4.0 -> 2.4.10
- Kubernetes Client 7.7.0 -> 7.8.0
- MCP 1.1.3 -> 2.0.0
- Netty 4.2.15.Final -> 4.2.16.Final
- Prometheus 1.7.0 -> 1.8.0
- Protobuf 3.25.8 -> 3.25.9
- RESTEasy 5.0.9.Final -> 5.0.10.Final
- Sangria 4.2.18 -> 4.2.19
- Spring 6 6.2.15 -> 6.2.19
- Spring Boot 3 3.5.10 -> 3.5.16
- Spring Boot 4 4.0.6 -> 4.1.0
- Tomcat 9 9.0.96 -> 9.0.120
- Tomcat 10 10.1.49 -> 10.1.57
- Build
   - Apache HttpClient 5 5.6.1 -> 5.6.2
   - BouncyCastle 1.84 -> 1.85
   - controlplane 1.0.52 -> 1.0.55
   - Dagger 2.59.2 -> 2.60.1
   - DGS 11.1.0 -> 12.0.1
   - Error Prone 2.49.0 -> 2.50.0
   - errorprone-gradle-plugin 4.3.0 -> 4.4.0
   - fastutil 8.5.18 -> 8.5.19
   - Gradle 9.5.1 -> 9.6.1
   - graphql-kotlin 8.8.1 -> 9.2.1
   - Hibernate Validator 8.0.3.Final -> 8.0.5.Final
   - Istio 1.29.1 -> 1.29.6
   - JKube 1.19.0 -> 1.20.0
   - JsonUnit 2.38.0 -> 2.40.1
   - Logback 1.5 1.5.34 -> 1.5.38
   - mcp-spring-ai 2.0.0-M4 -> 2.0.0
   - micrometer-docs-generator 1.0.2 -> 1.0.4
   - MUnit 1.3.2 -> 1.3.4
   - NullAway 0.13.6 -> 0.13.8
   - ProGuard 7.8.1 -> 7.9.1
   - protobuf-gradle-plugin 0.9.5 -> 0.9.6
   - Protobuf4 4.35.0 -> 4.35.1
   - scalafmt-gradle-plugin 1.21.5 -> 1.21.6
   - shadow-gradle-plugin 8.3.9 -> 8.3.11

Breaking changes:

- The `:ai:mcp` module now builds against MCP Java SDK 2.x.
`ArmeriaStatelessServerTransport` and
`ArmeriaStreamableServerTransportProvider` keep their own API, but users
must move their MCP SDK
dependency from 1.1.x to 2.0.0, which renames `ElicitRequest` to
`ElicitFormRequest` among other
  changes.

Other changes:

- `ImmutableAttributesBuilder.getAndSet()` declares `@Nullable` and
returns `null` instead of the
internal `NULL_VALUE` sentinel, which threw `ClassCastException` on a
typed call.
- `RampingUpLoadBalancer` asserts the entry returned by `Map.remove()`
instead of dereferencing it,
which NullAway 0.13.8 rejects; its test now checks the future of the
emptied window.
- `GraphqlWSSubProtocol` returns a non-null `GraphQLError#getMessage()`,
as graphql-java 26 requires.
- Dropped the stale `dgs` and `graphql-kotlin` hold comments; both
consumers are already `java17`.
- `:it:dgs` declares the Jackson modules DGS 12 expects Spring Boot to
auto-configure.
- The `upgrade-deps` skill now validates a hold comment against its
consumers' Java level.

Author: ikhoon

.claude/skills/upgrade-deps/SKILL.md

@@ -22,6 +22,11 @@ Java version required by the modules that use it.
 
 When in doubt, check `settings.gradle` for the `java`, `java11`, or `java17` flag on each subproject.
 
+**The table above lists published modules only.** Integration-test (`:it:*`) and example (`:examples:*`)
+modules carry their own flags in `settings.gradle` and are frequently `java17` already. A dependency
+consumed *only* by those modules is not held back by the Java 8 baseline at all — always resolve the
+actual consumer before assuming a Java constraint applies.
+
 ## Step 1: Run dependencyUpdates
 
 ```
@@ -55,8 +60,38 @@ reflections = "0.9.11"
 zookeeper = "3.9.3"
 ```
 
-If such a comment exists and the reason still applies, **skip the upgrade** and do not
-remove the comment.
+### Step 3.1: Validate the comment before trusting it
+
+A hold comment is a claim about this repository, and claims go stale. **Never treat a comment as
+proof — re-derive its reason every upgrade.** For each held entry:
+
+1. Find the aliases for the version key in the `[libraries.*]` / `[plugins]` sections.
+2. Grep the build scripts for each alias accessor (`libs.foo.bar` for alias `foo-bar`):
+   `git grep -n 'libs\.foo\.bar' -- '*.gradle' '*.gradle.kts'`
+3. Map each hit's build file to its project, and read that project's flags in `settings.gradle`.
+4. Compare the *consumer's* Java level against the new version's requirement — **not** the library's
+   requirement in isolation. "Library X requires Java 17" is not a blocker when every consumer is
+   already `java17`.
+
+If the reason no longer holds, **remove the comment and upgrade**. If it still holds, keep both.
+
+Two comments were found stale this way (`dgs` and `graphql-kotlin`, both consumed only by `java17`
+modules), so treat this step as mandatory rather than a spot check.
+
+### Step 3.2: Never write a hold reason you have not verified
+
+When you add a comment, the reason must be something you confirmed, with the evidence to hand:
+
+- **Java constraint** — confirmed against the consumer module's flag, per Step 3.1.
+- **Runtime/API breakage** — confirmed by actually building and running the affected module's tests,
+  and the comment names the concrete blocker (e.g. `# Don't upgrade graphql-kotlin to 10.x that
+  migrated to Jackson 3`), not a vague "major upgrade deferred".
+- **Version-sync constraint** — confirmed from the other project's POM *and* from this repo's history
+  (`git log -p -- dependencies.toml`). Do not invent a sync rule: check whether the two versions have
+  ever actually moved independently before claiming they must move together.
+
+A plausible-sounding reason that nobody verified is worse than no comment, because the next upgrade
+will trust it.
 
 If no comment exists, proceed with the Java version compatibility check:
 1. Find which modules use this dependency in `dependencies.toml`

ai/mcp/src/test/java/io/modelcontextprotocol/ArmeriaStreamableIntegrationTests.java

@@ -53,6 +53,7 @@
 import io.modelcontextprotocol.spec.McpSchema;
 import io.modelcontextprotocol.spec.McpSchema.CallToolResult;
 import io.modelcontextprotocol.spec.McpSchema.ClientCapabilities;
+import io.modelcontextprotocol.spec.McpSchema.ElicitFormRequest;
 import io.modelcontextprotocol.spec.McpSchema.ElicitRequest;
 import io.modelcontextprotocol.spec.McpSchema.ElicitResult;
 import io.modelcontextprotocol.spec.McpSchema.InitializeResult;
@@ -99,7 +100,7 @@ protected void prepareClients(int port, String mcpEndpoint) {
     void testCreateElicitationSuccess(String clientType) {
         final var clientBuilder = clientBuilders.get(clientType);
 
-        final Function<ElicitRequest, ElicitResult> elicitationHandler = request -> {
+        final Function<ElicitFormRequest, ElicitResult> elicitationHandler = request -> {
             assertThat(request.message()).isNotEmpty();
             assertThat(request.requestedSchema()).isNotNull();
             return new McpSchema.ElicitResult(McpSchema.ElicitResult.Action.ACCEPT,

core/src/main/java/com/linecorp/armeria/common/ImmutableAttributesBuilder.java

@@ -44,6 +44,7 @@ public <T> AttributesBuilder set(AttributeKey<T> key, @Nullable T value) {
         return this;
     }
 
+    @Nullable
     @Override
     public <T> T getAndSet(AttributeKey<T> key, @Nullable T value) {
         requireNonNull(key, "key");
@@ -60,7 +61,7 @@ public <T> T getAndSet(AttributeKey<T> key, @Nullable T value) {
             oldValue = attributes.put(key, value);
         }
         //noinspection unchecked
-        return (T) oldValue;
+        return oldValue == NULL_VALUE ? null : (T) oldValue;
     }
 
     @Override

core/src/main/java/com/linecorp/armeria/common/loadbalancer/RampingUpLoadBalancer.java

@@ -261,7 +261,9 @@ private void updateWeightAndStep0(long window) {
         final Set<CandidateAndStep<T>> candidateAndSteps = entry.candidateAndSteps();
         updateWeightAndStep0(candidateAndSteps);
         if (candidateAndSteps.isEmpty()) {
-            rampingUpWindowsMap.remove(window).scheduledFuture.cancel(true);
+            final CandidatesRampingUpEntry<T> removed = rampingUpWindowsMap.remove(window);
+            assert removed != null;
+            removed.scheduledFuture.cancel(true);
         }
         buildLoadBalancer();
     }

core/src/test/java/com/linecorp/armeria/client/ImmutableAttributesTest.java

@@ -101,6 +101,8 @@ void parent() {
         // Hide the value in the parent
         assertThat(attributes.attr(shaded)).isNull();
         assertThat(attributes.ownAttr(shaded)).isNull();
+        // getAndSet() must return null for a hidden key, not the internal sentinel.
+        assertThat(attributes.toBuilder().getAndSet(shaded, "revive")).isNull();
 
         assertThat(attributes.attr(overridden)).isEqualTo("update");
         assertThat(attributes.ownAttr(overridden)).isEqualTo("update");

core/src/test/java/com/linecorp/armeria/common/loadbalancer/RampingUpLoadBalancerTest.java

@@ -345,6 +345,8 @@ void rampingUpEndpointsAreRemoved() {
                                               Endpoint.of("foo.com"), Endpoint.of("foo1.com")
                                       );
         assertThat(scheduledFutures).hasSize(2);
+        // The first future was already cancelled in setInitialEndpoints().
+        scheduledFutures.poll();
         verify(scheduledFutures.poll()).cancel(true);
     }
 

dependencies.toml

@@ -3,14 +3,14 @@ akka = "2.8.8"
 # Keep in sync with Akka HTTP artifacts pulled by akka-grpc-runtime to avoid mixed-versioning errors.
 akka-http-cors = "1.0.0"
 akka-grpc-runtime = "1.0.3"
-apache-httpclient5 = "5.6.1"
+apache-httpclient5 = "5.6.2"
 apache-httpclient4 = "4.5.14"
 asm = "9.10.1"
 assertj = "3.27.7"
-athenz = "1.12.42"
+athenz = "1.12.44"
 awaitility = "4.3.0"
 blockhound = "1.0.17.RELEASE"
-bouncycastle = "1.84"
+bouncycastle = "1.85"
 brave5 = "5.18.1"
 brave6 = "6.3.1"
 brotli4j = "1.23.0"
@@ -22,40 +22,40 @@ cglib = "3.3.0"
 checkerframework = "2.5.6"
 checkstyle = "10.3.2"
 context-propagation = "1.2.1"
-controlplane = "1.0.52"
+controlplane = "1.0.55"
 curator = "5.9.0"
-dagger = "2.59.2"
-# Don't upgrade DGS to 12.x that requires Java 17.
-dgs = "11.1.0"
+dagger = "2.60.1"
+dgs = "12.0.1"
 dropwizard2 = "2.1.12"
 dropwizard-metrics = "4.2.39"
-errorprone = "2.49.0"
-errorprone-gradle-plugin = "4.3.0"
+errorprone = "2.50.0"
+errorprone-gradle-plugin = "4.4.0"
 eureka = "2.0.6"
-fastutil = "8.5.18"
+fastutil = "8.5.19"
 finagle = "24.2.0"
 findbugs = "3.0.2"
 futures-completable = "0.3.6"
 futures-extra = "4.3.3"
 # Keep gax-grpc at 2.72.2; newer versions pull protobuf 4.x via proto-google-common-protos,
 # which conflicts with the protobuf 3.x line used elsewhere (see grpc testCompileClasspath).
 gax-grpc = "2.72.2"
-graphql-java = "25.0"
-graphql-kotlin = "8.8.1"
-grpc-java = "1.81.0"
+graphql-java = "26.0"
+# Don't upgrade graphql-kotlin to 10.x that migrated to Jackson 3 (the `tools.jackson` package).
+graphql-kotlin = "9.2.1"
+grpc-java = "1.83.0"
 # 1.5.0 requires >= 17
-grpc-kotlin = "1.4.1"
+grpc-kotlin = "1.4.3"
 guava = "33.6.0-jre"
 hamcrest = "3.0"
 hbase = "1.2.6"
 hibernate-validator6 = "6.2.5.Final"
-hibernate-validator8 = "8.0.3.Final"
+hibernate-validator8 = "8.0.5.Final"
 # used by :it:xds-istio
-istio = "1.29.1"
+istio = "1.29.6"
 j2objc = "3.1"
 json-path = "3.0.0"
-jackson = "2.22.0"
-javassist = "3.31.0-GA"
+jackson = "2.22.1"
+javassist = "3.32.0-GA"
 jakarta-inject = "2.0.1"
 jakarta-validation = "3.1.1"
 jakarta-websocket = "2.2.0"
@@ -71,49 +71,49 @@ jetty10 = "10.0.26"
 jetty10-jstl = "10.0.26"
 jetty11 = "11.0.26"
 jetty11-jstl = "11.0.0"
-jetty12 = "12.0.32"
+jetty12 = "12.0.37"
 jetty93 = "9.3.30.v20211001"
-jetty94 = "9.4.55.v20240627"
+jetty94 = "9.4.58.v20250814"
 jetty-alpn-api = "1.1.3.v20160715"
-jkube = "1.19.0"
+jkube = "1.20.0"
 jmh-core = "1.37"
 jmh-gradle-plugin = "0.7.3"
 joor = "0.9.15"
 # Don't upgrade json-unit to 3.0.0 that requires Java 17
-json-unit = "2.38.0"
+json-unit = "2.40.1"
 jsoup = "1.22.2"
 jspecify = "1.0.0"
 junit4 = "4.13.2"
 # junit6 requires java 17
-junit5 = "5.14.2"
+junit5 = "5.14.4"
 # Don't upgrade junit-pioneer to 2.x.x that requires Java 11
 junit-pioneer = "1.9.1"
-jwt = "4.5.2"
+jwt = "4.6.0"
 # kafka >=4.0.0 requires java 11
-kafka = "3.9.1"
-kotlin = "2.4.0"
+kafka = "3.9.2"
+kotlin = "2.4.10"
 kotlin-coroutine = "1.11.0"
 krotodc = "1.2.2"
 ktlint-gradle-plugin = "14.2.0"
-kubernetes-client = "7.7.0"
+kubernetes-client = "7.8.0"
 logback12 = "1.2.13"
 logback13 = "1.3.14"
 logback14 = "1.4.14"
-logback15 = "1.5.34"
-mcp = "1.1.3"
+logback15 = "1.5.38"
+mcp = "2.0.0"
 # Only used for testing in :ai:mcp module.
-mcp-spring-ai = "2.0.0-M4"
+mcp-spring-ai = "2.0.0"
 micrometer = "1.17.0"
 micrometer-tracing = "1.7.0"
-micrometer-docs-generator = "1.0.2"
+micrometer-docs-generator = "1.0.4"
 # Don't uprade mockito to 5.x.x that requires Java 11
 mockito = "4.11.0"
 monix = "3.4.1"
-munit = "1.3.2"
+munit = "1.3.4"
 netty = "4.2.16.Final"
 nexus-publish = "2.0.0"
 node-gradle-plugin = "7.1.0"
-nullaway = "0.13.6"
+nullaway = "0.13.8"
 nullaway-gradle-plugin = "3.1.0"
 okhttp2 = "2.7.5" # For testing
 okhttp3 = { strictly = "3.14.9" } # Not just for testing. Used in the Retrofit mudule.
@@ -124,16 +124,16 @@ osdetector = "1.7.3"
 # Used for kubernetes-chaos-tests
 picocli = "4.7.7"
 protoc-gen-validate = "1.3.3"
-proguard = "7.8.1"
-prometheus = "1.7.0"
+proguard = "7.9.1"
+prometheus = "1.8.0"
 prometheus-legacy = "0.16.0"
 # Ensure that we use the same Protobuf version as what gRPC depends on.
 # See: https://github.com/grpc/grpc-java/blob/master/gradle/libs.versions.toml
 #      (Switch to the right tag and look for "protobuf".)
 #      e.g. https://github.com/grpc/grpc-java/blob/v1.48.0/gradle/libs.versions.toml
-protobuf = "3.25.8"
-protobuf4 = "4.35.0"
-protobuf-gradle-plugin = "0.9.5"
+protobuf = "3.25.9"
+protobuf4 = "4.35.1"
+protobuf-gradle-plugin = "0.9.6"
 protobuf-jackson = "2.8.1"
 re2j = "1.8"
 reactive-grpc = "1.2.4"
@@ -143,37 +143,37 @@ reactor-kotlin = "1.3.1"
 # Upgrade once https://github.com/ronmamo/reflections/issues/279 is fixed.
 reflections = "0.9.11"
 resilience4j = "2.4.0"
-resteasy = "5.0.9.Final"
+resteasy = "5.0.10.Final"
 # "provided" dependency required by RESTEasy "resteasy-core-spi"
 # jboss 3.5.0 requires at least jdk 11
 resteasy-jboss-logging = "3.4.3.Final"
-resteasy-jboss-logging-annotations = "2.2.1.Final"
+resteasy-jboss-logging-annotations = "2.2.2.Final"
 retrofit2 = "2.12.0"
 rxjava2 = "2.2.21"
 rxjava3 = "3.1.12"
-sangria = "4.2.18"
+sangria = "4.2.19"
 sangria-slowlog = "3.0.0"
 scala-collection-compat = "2.14.0"
 scala-java8-compat = "1.0.2"
 scala212 = "2.12.21"
 scala213 = "2.13.18"
 # Scala 3.8.x requires JDK 17+
 scala3 = "3.7.4"
-scalafmt-gradle-plugin = "1.21.5"
+scalafmt-gradle-plugin = "1.21.6"
 scalapb = "0.11.20"
 scalapb-json = "0.12.2"
-shadow-gradle-plugin = "8.3.9"
+shadow-gradle-plugin = "8.3.11"
 # Don"t upgrade to 8.x that requires Java 11.
 shibboleth-utilities = "7.5.2"
 snappy = "1.1.10.8"
 slf4j = "1.7.36"
 slf4j2 = "2.0.18"
 spring5 = "5.3.39"
-spring6 = "6.2.15"
+spring6 = "6.2.19"
 spring7 = "7.0.8"
 spring-boot2 = "2.7.18"
-spring-boot3 = "3.5.10"
-spring-boot4 = "4.0.6"
+spring-boot3 = "3.5.16"
+spring-boot4 = "4.1.0"
 testcontainers = "2.0.5"
 thrift09 = { strictly = "0.9.3-1" }
 thrift012 = { strictly = "0.12.0" }
@@ -189,8 +189,8 @@ thrift021 = { strictly = "0.21.0" }
 thrift022 = { strictly = "0.22.0" }
 thrift023 = { strictly = "0.23.0" }
 tomcat8 = "8.5.100"
-tomcat9 = "9.0.96"
-tomcat10 = "10.1.49"
+tomcat9 = "9.0.120"
+tomcat10 = "10.1.57"
 xml-apis = "1.4.01"
 # Ensure that we use the same ZooKeeper version as what Curator depends on.
 # See: https://github.com/apache/curator/blob/master/pom.xml
@@ -631,6 +631,9 @@ javadocs = "https://fasterxml.github.io/jackson-modules-java8/javadoc/datetime/2
 module = "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml"
 [libraries.jackson-kotlin]
 module = "com.fasterxml.jackson.module:jackson-module-kotlin"
+# Jackson parameter names is used only for testing in it:dgs module.
+[libraries.jackson-parameter-names]
+module = "com.fasterxml.jackson.module:jackson-module-parameter-names"
 [libraries.jackson-scala_v212]
 module = "com.fasterxml.jackson.module:jackson-module-scala_2.12"
 [libraries.jackson-scala_v213]
@@ -705,7 +708,7 @@ version.ref = "jetty11"
 
 [libraries.jetty12-server]
 module = "org.eclipse.jetty:jetty-server"
-javadocs = "https://javadoc.io/doc/org.eclipse.jetty/jetty-server/12.0.5/"
+javadocs = "https://javadoc.io/doc/org.eclipse.jetty/jetty-server/12.0.37/"
 version.ref = "jetty12"
 [libraries.jetty12-ee10-apache-jsp]
 module = "org.eclipse.jetty.ee10:jetty-ee10-apache-jsp"
@@ -749,7 +752,7 @@ exclusions = ["org.ow2.asm:asm", "org.ow2.asm:asm-commons"]
 version.ref = "jetty94"
 [libraries.jetty94-server]
 module = "org.eclipse.jetty:jetty-server"
-javadocs = "https://javadoc.io/doc/org.eclipse.jetty/jetty-server/9.4.51.v20230217/"
+javadocs = "https://javadoc.io/doc/org.eclipse.jetty/jetty-server/9.4.58.v20250814/"
 version.ref = "jetty94"
 # jetty-webapp for testing interoperability with other servers.
 [libraries.jetty94-webapp]

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

graphql/src/main/java/com/linecorp/armeria/server/graphql/GraphqlWSSubProtocol.java

@@ -374,10 +374,11 @@ private static void writeError(WebSocketWriter out, String operationId, Throwabl
                 "id", operationId,
                 "payload", ImmutableList.of(
                         new GraphQLError() {
-                            @Nullable
                             @Override
                             public String getMessage() {
-                                return t.getMessage();
+                                // GraphQLError.getMessage() is non-null, but Throwable.getMessage() is not.
+                                final String message = t.getMessage();
+                                return message != null ? message : t.toString();
                             }
 
                             @Override

it/dgs/build.gradle

@@ -6,4 +6,7 @@ dependencies {
 
     implementation 'com.graphql-java:graphql-java:19.2'
     testImplementation libs.dgs
+    // DGS 12 expects the Jackson modules that Spring Boot auto-configures; this test runs without it.
+    testImplementation libs.jackson.kotlin
+    testImplementation libs.jackson.parameter.names
 }