Updating branch to be in sync with upstream master

.github/ISSUE_TEMPLATE/question.md

@@ -8,8 +8,6 @@ labels: kind/question, priority/P3, untriaged
 PLEASE DO NOT POST A QUESTION HERE.
 This form is for bug reports and feature requests ONLY!
 
-For general questions and troubleshooting, please ask/look for answers at StackOverflow, with "grpc" tag: https://stackoverflow.com/questions/tagged/grpc
-
 For questions that specifically need to be answered by gRPC team members, please ask/look for answers at grpc.io mailing list: https://groups.google.com/forum/#!forum/grpc-io
 
 This issue will be closed down once seen by the repo managers.

.github/workflows/pr-auto-fix.yaml

@@ -22,7 +22,7 @@ jobs:
         with:
           format: YYYYWWd
       - name: Cache bazel
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         env:
           cache-name: bazel-cache
         with:
@@ -38,7 +38,7 @@ jobs:
       # Cancel current runs if they're still running
       # (saves processing on fast pushes)
       - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
+        uses: styfle/cancel-workflow-action@3155a141048f8f89c06b4cdae32e7853e97536bc # 0.13.0
         with:
           access_token: ${{ github.token }}
       # Allow opt-out for some users
@@ -89,7 +89,7 @@ jobs:
         run: ANDROID_NDK_HOME= ${{ github.workspace }}/tools/distrib/sanitize.sh
       # Report back with a PR if things are broken
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           delete-branch: true
           branch-suffix: short-commit-hash

.gitmodules

@@ -50,3 +50,6 @@
 [submodule "third_party/opentelemetry-cpp"]
 	path = third_party/opentelemetry-cpp
 	url = https://github.com/open-telemetry/opentelemetry-cpp
+[submodule "third_party/cel-spec"]
+	path = third_party/cel-spec
+	url = https://github.com/google/cel-spec

BUILD

@@ -41,6 +41,8 @@ package(
 exports_files([
     "LICENSE",
     "etc/roots.pem",
+    "copy.bara.sky",
+    "copybara.METADATA",
 ])
 
 exports_files(
@@ -3992,6 +3994,7 @@ grpc_cc_library(
         "//src/core:client_channel/retry_filter_legacy_call_data.cc",
         "//src/core:client_channel/subchannel.cc",
         "//src/core:client_channel/subchannel_stream_client.cc",
+        "//src/core:client_channel/subchannel_stream_limiter.cc",
     ],
     hdrs = [
         "//src/core:client_channel/buffered_call.h",
@@ -4007,6 +4010,7 @@ grpc_cc_library(
         "//src/core:client_channel/subchannel.h",
         "//src/core:client_channel/subchannel_interface_internal.h",
         "//src/core:client_channel/subchannel_stream_client.h",
+        "//src/core:client_channel/subchannel_stream_limiter.h",
     ],
     external_deps = [
         "absl/base:core_headers",
@@ -4076,6 +4080,7 @@ grpc_cc_library(
         "//src/core:error_utils",
         "//src/core:exec_ctx_wakeup_scheduler",
         "//src/core:experiments",
+        "//src/core:filter_chain",
         "//src/core:gpr_manual_constructor",
         "//src/core:grpc_backend_metric_data",
         "//src/core:grpc_channel_idle_filter",
@@ -5082,6 +5087,7 @@ grpc_cc_library(
         "//src/core:channel_args",
         "//src/core:channelz_property_list",
         "//src/core:chttp2_flow_control",
+        "//src/core:client_channel_internal_header",
         "//src/core:closure",
         "//src/core:connectivity_state",
         "//src/core:context_list_entry",
@@ -5106,6 +5112,7 @@ grpc_cc_library(
         "//src/core:json",
         "//src/core:match",
         "//src/core:memory_quota",
+        "//src/core:metadata",
         "//src/core:metadata_batch",
         "//src/core:metadata_info",
         "//src/core:notification",

CONTRIBUTING.md

@@ -124,15 +124,14 @@ How to get your contributions merged smoothly and quickly.
 
 ## Obtaining Commit Access
 
-We grant Commit Access to contributors based on the following criteria: *
-Sustained contribution to the gRPC project. * Deep understanding of the areas
-contributed to, and good consideration of various reliability, usability and
-performance tradeoffs. * Contributions demonstrate that obtaining Commit Access
-will significantly reduce friction for the contributors or others.
-
-In addition to submitting PRs, a Contributor with Commit Access can: * Review
-PRs and merge once other checks and criteria pass. * Triage bugs and PRs and
-assign appropriate labels and reviewers.
+We grant Commit Access to contributors based on the following criteria: 
+- Sustained contribution to the gRPC project.
+- Deep understanding of the areas contributed to, and good consideration of various reliability, usability and performance tradeoffs.
+- Contributions demonstrate that obtaining Commit Access will significantly reduce friction for the contributors or others.
+
+In addition to submitting PRs, a Contributor with Commit Access can: 
+- Review PRs and merge once other checks and criteria pass.
+- Triage bugs and PRs and assign appropriate labels and reviewers.
 
 ### Obtaining Commit Access without Code Contributions
 

LICENSE

@@ -203,6 +203,16 @@
 
 -----------------------------------------------------------
 
+Following applies to:
+./src/objective-c/!ProtoCompiler-gRPCCppPlugin.podspec
+./src/objective-c/!ProtoCompiler-gRPCPlugin.podspec
+./src/objective-c/!ProtoCompiler.podspec
+./src/objective-c/BoringSSL-GRPC.podspec
+./templates/src/objective-c/!ProtoCompiler-gRPCCppPlugin.podspec.inja
+./templates/src/objective-c/!ProtoCompiler-gRPCPlugin.podspec.inja
+./templates/src/objective-c/!ProtoCompiler.podspec.inja
+./templates/src/objective-c/BoringSSL-GRPC.podspec.template
+
 BSD 3-Clause License
 
 Copyright 2016, Google Inc.
@@ -235,6 +245,9 @@ THE POSSIBILITY OF SUCH DAMAGE.
 
 -----------------------------------------------------------
 
+Following applies to:
+./etc/roots.pem
+
 Mozilla Public License Version 2.0
 ==================================
 

MODULE.bazel

@@ -22,13 +22,19 @@ module(
 # Regular dependencies
 # ====================
 
+# -- Abseil library.
+# Pinning version to be consistent with third_party/abseil-cpp
 bazel_dep(name = "abseil-cpp", version = "20250512.1", repo_name = "com_google_absl")
+single_version_override(
+    module_name = "abseil-cpp",
+    version = "20250512.1",
+)
+
 bazel_dep(name = "apple_support", version = "1.17.1", repo_name = "build_bazel_apple_support")
 bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "boringssl", version = "0.20241024.0")  # mistmatched 20241211
 bazel_dep(name = "c-ares", version = "1.19.1", repo_name = "com_github_cares_cares")
 bazel_dep(name = "envoy_api", version = "0.0.0-20251216-6ef568c")
-bazel_dep(name = "googleapis", version = "0.0.0-20251003-2193a2bf", repo_name = "com_google_googleapis")
 bazel_dep(name = "googleapis-cc", version = "1.0.0")
 bazel_dep(name = "googleapis-grpc-cc", version = "1.0.0")
 bazel_dep(name = "googleapis-python", version = "1.0.0")
@@ -37,13 +43,21 @@ bazel_dep(name = "opencensus-cpp", version = "0.0.0-20230502-50eb5de.bcr.2", rep
 bazel_dep(name = "openssl", version = "3.3.1.bcr.1")
 bazel_dep(name = "opentelemetry-cpp", version = "1.19.0", repo_name = "io_opentelemetry_cpp")
 bazel_dep(name = "platforms", version = "0.0.11")
+
+# --- Protobuf related packages.
+# Pinning to 31.1 to avoid xDs breakage until we can upgrade to Protobuf >= 33.0
 bazel_dep(name = "protobuf", version = "31.1", repo_name = "com_google_protobuf")
+single_version_override(
+    module_name = "protobuf",
+    version = "31.1",
+)
+
 bazel_dep(name = "protoc-gen-validate", version = "1.2.1.bcr.1", repo_name = "com_envoyproxy_protoc_gen_validate")  # Not needed directly
 bazel_dep(name = "re2", version = "2024-07-02.bcr.1", repo_name = "com_googlesource_code_re2")  # mistmached 2022-04-01
 bazel_dep(name = "rules_apple", version = "3.16.0", repo_name = "build_bazel_rules_apple")
 bazel_dep(name = "rules_cc", version = "0.1.1")
 bazel_dep(name = "rules_proto", version = "7.0.2")
-bazel_dep(name = "xds", version = "0.0.0-20240423-555b57e", repo_name = "com_github_cncf_xds")  # mismatched 20231116
+bazel_dep(name = "xds", version = "0.0.0-20251210-ee656c7", repo_name = "com_github_cncf_xds")
 bazel_dep(name = "zlib", version = "1.3.1.bcr.5")
 
 # Development dependencies
@@ -105,3 +119,32 @@ include("//bazel:com_google_fuzztest.MODULE.bazel")
 
 # Provides repo @grpc_custom_exec_properties.
 include("//bazel:grpc_custom_exec_properties.MODULE.bazel")
+
+# -- google_cloud_cpp 2.35.0 related repos, which requires a modified version of googleapis, hence the version pinning.
+bazel_dep(name = "googleapis", version = "0.0.0-20251003-2193a2bf", repo_name = "com_google_googleapis")
+single_version_override(
+    module_name = "googleapis",
+    patch_strip = 1,
+    patches = [
+        "//bazel:googleapis/patches/fix_google_cloud_cpp.patch",
+    ],
+    version = "0.0.0-20251003-2193a2bf",
+)
+
+bazel_dep(name = "google_cloud_cpp", version = "2.35.0", dev_dependency = True)
+archive_override(
+    module_name = "google_cloud_cpp",
+    integrity = "sha256-geooz55bsDLTVrAYdAnzCxA1+OpbUwZ16iSMimwAcKo=",
+    strip_prefix = "google-cloud-cpp-2.35.0",
+    urls = [
+        "https://storage.googleapis.com/grpc-bazel-mirror/github.com/googleapis/google-cloud-cpp/archive/refs/tags/v2.35.0.tar.gz",
+        "https://github.com/googleapis/google-cloud-cpp/archive/refs/tags/v2.35.0.tar.gz",
+    ],
+)
+
+# --- Python headers
+# TODO(weizheyuan): Maybe replace this with python header exposed by rules_python.
+# See also https://github.com/grpc/grpc/issues/24665
+python_configure = use_repo_rule("//third_party/py:python_configure.bzl", "python_configure")
+
+python_configure(name = "local_config_python")

Rakefile

@@ -143,7 +143,7 @@ task 'gem:native', [:plat] do |t, args|
   verbose = ENV['V'] || '0'
 
   grpc_config = ENV['GRPC_CONFIG'] || 'opt'
-  target_ruby_minor_versions = ['3.4', '3.3', '3.2', '3.1']
+  target_ruby_minor_versions = ['4.0', '3.4', '3.3', '3.2', '3.1']
   selected_plat = "#{args[:plat]}"
 
   # use env variable to set artifact build paralellism
@@ -190,7 +190,7 @@ task 'gem:native', [:plat] do |t, args|
     run_rake_compiler(plat, <<~EOT)
       #{prepare_ccache_cmd} && \
       gem update --system --no-document && \
-      bundle update && \
+      bundle update --all && \
       bundle exec rake clean && \
       bundle exec rake native:#{plat} pkg/#{spec.full_name}-#{plat}.gem pkg/#{spec.full_name}.gem \
         RUBY_CC_VERSION=#{RakeCompilerDock.ruby_cc_version(*target_ruby_minor_versions)} \
@@ -232,7 +232,7 @@ task 'gem:native', [:plat] do |t, args|
     run_rake_compiler(plat, <<~EOT)
       #{prepare_ccache_cmd} && \
       gem update --system --no-document && \
-      bundle update && \
+      bundle update --all && \
       bundle exec rake clean && \
       export GRPC_RUBY_DEBUG_SYMBOLS_OUTPUT_DIR=#{debug_symbols_dir} && \
       bundle exec rake native:#{plat} pkg/#{spec.full_name}-#{plat}.gem pkg/#{spec.full_name}.gem \
@@ -247,7 +247,8 @@ task 'gem:native', [:plat] do |t, args|
   unix_platforms.each do |plat|
     unless unix_platforms_without_debug_symbols.include?(plat)
       `bash src/ruby/nativedebug/build_package.sh #{plat}`
-      `cp src/ruby/nativedebug/pkg/*.gem pkg/`
+      # Native debug gems uploaded to GCS, skip pkg/ to avoid RubyGems upload
+      # `cp src/ruby/nativedebug/pkg/*.gem pkg/`
     end
   end
 end

bazel/BUILD

@@ -92,6 +92,11 @@ package_group(
     packages = [],
 )
 
+package_group(
+    name = "client_channel_internal_header",
+    packages = [],
+)
+
 package_group(
     name = "core_credentials",
     packages = [],

bazel/cc_grpc_library.bzl

@@ -14,6 +14,7 @@
 """Generates and compiles C++ grpc stubs from proto_library rules."""
 
 load("@com_google_protobuf//bazel:cc_proto_library.bzl", "cc_proto_library")
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
 load("@rules_proto//proto:defs.bzl", "proto_library")
 load("//bazel:generate_cc.bzl", "generate_cc")
 load("//bazel:protobuf.bzl", "well_known_proto_libs")
@@ -112,7 +113,7 @@ def cc_grpc_library(
             **kwargs
         )
 
-        native.cc_library(
+        cc_library(
             name = name,
             srcs = [":" + codegen_grpc_target],
             hdrs = [":" + codegen_grpc_target],

bazel/cython_library.bzl

@@ -13,6 +13,7 @@
 # limitations under the License.
 """Custom rules for gRPC Python"""
 
+load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
 load("@rules_python//python:defs.bzl", "py_library")
 
 # Adapted with modifications from
@@ -71,7 +72,7 @@ def pyx_library(name, deps = [], py_deps = [], srcs = [], **kwargs):
     for src in pyx_srcs:
         stem = src.split(".")[0]
         shared_object_name = stem + ".so"
-        native.cc_binary(
+        cc_binary(
             name = shared_object_name,
             srcs = [stem + ".cpp"],
             deps = deps + ["@local_config_python//:python_headers"],