From fb3e92e378ecb3495cc9ecb64887753e888f0170 Mon Sep 17 00:00:00 2001
From: Ludovic Champenois <ludo@google.com>
Date: Sat, 24 Oct 2026 00:42:46 -0700
Subject: [PATCH 1/2] Use grpc-okhttp instead of grpc-netty-shaded in the
 runtime jars

The Cloud Tasks client bundled in runtime_impl_jetty12/121 only needs a gRPC
transport found through the ManagedChannelProvider SPI; nothing in gax,
gax-grpc, grpc-auth or the Cloud Tasks stubs references netty directly.
Replace grpc-netty-shaded (about 4 MB compressed in each jar) with
grpc-okhttp.

grpc-okhttp depends on okio 3.x, which is written in Kotlin and pulls in
kotlin-stdlib (another 1.5 MB). Exclude it and use okio 1.17.6 (pure Java,
92 KB) instead: every okio method and field referenced by grpc-okhttp 1.85.0
exists in okio 1.17.6, which also has the fix for CVE-2023-3635.

runtime-impl-jetty121.jar: 33.7 MB with netty -> 29.3 MB.
---
 pom.xml                               |  7 +++++++
 runtime/runtime_impl_jetty12/pom.xml  | 27 ++++++++++++++++++++-------
 runtime/runtime_impl_jetty121/pom.xml | 27 ++++++++++++++++++++-------
 3 files changed, 47 insertions(+), 14 deletions(-)

diff --git a/pom.xml b/pom.xml
index 09168b5a..0ce5281d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -771,6 +771,13 @@
         <artifactId>javax.annotation-api</artifactId>
         <version>1.3.2</version>
       </dependency>
+      <dependency>
+        <!-- Pure Java okio for grpc-okhttp in the runtime jars, instead of okio 3.x which needs the
+             Kotlin stdlib. All okio APIs used by grpc-okhttp are present in 1.17.6. -->
+        <groupId>com.squareup.okio</groupId>
+        <artifactId>okio</artifactId>
+        <version>1.17.6</version>
+      </dependency>
       <dependency>
         <groupId>com.google.auth</groupId>
         <artifactId>google-auth-library-oauth2-http</artifactId>
diff --git a/runtime/runtime_impl_jetty12/pom.xml b/runtime/runtime_impl_jetty12/pom.xml
index e4482f81..35dd12c2 100644
--- a/runtime/runtime_impl_jetty12/pom.xml
+++ b/runtime/runtime_impl_jetty12/pom.xml
@@ -58,6 +58,24 @@
             <artifactId>appengine-apis</artifactId>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <!-- Lighter gRPC transport than grpc-netty-shaded for the bundled Cloud Tasks client. -->
+            <groupId>io.grpc</groupId>
+            <artifactId>grpc-okhttp</artifactId>
+            <optional>true</optional>
+            <exclusions>
+                <exclusion>
+                    <!-- okio 3.x is written in Kotlin and pulls in kotlin-stdlib. -->
+                    <groupId>com.squareup.okio</groupId>
+                    <artifactId>okio</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>com.squareup.okio</groupId>
+            <artifactId>okio</artifactId>
+            <optional>true</optional>
+        </dependency>
         <dependency>
             <groupId>com.google.appengine</groupId>
             <artifactId>runtime-util</artifactId>
@@ -335,12 +353,6 @@
                             </relocation>
                           </relocations>
                           <filters>
-                              <filter>
-                                  <artifact>io.grpc:grpc-netty-shaded</artifact>
-                                  <excludes>
-                                      <exclude>META-INF/native/**</exclude>
-                                  </excludes>
-                              </filter>
                              <filter>
                                   <artifact>*:*</artifact>
                                   <excludes>
@@ -515,7 +527,8 @@
                                     <include>io.grpc:grpc-auth</include>
                                     <include>io.grpc:grpc-context</include>
                                     <include>io.grpc:grpc-core</include>
-                                    <include>io.grpc:grpc-netty-shaded</include>
+                                    <include>io.grpc:grpc-okhttp</include>
+                                    <include>com.squareup.okio:okio</include>
                                     <include>io.grpc:grpc-protobuf</include>
                                     <include>io.grpc:grpc-protobuf-lite</include>
                                     <include>io.grpc:grpc-stub</include>
diff --git a/runtime/runtime_impl_jetty121/pom.xml b/runtime/runtime_impl_jetty121/pom.xml
index c1fa8034..d06153ae 100644
--- a/runtime/runtime_impl_jetty121/pom.xml
+++ b/runtime/runtime_impl_jetty121/pom.xml
@@ -58,6 +58,24 @@
             <artifactId>appengine-apis</artifactId>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <!-- Lighter gRPC transport than grpc-netty-shaded for the bundled Cloud Tasks client. -->
+            <groupId>io.grpc</groupId>
+            <artifactId>grpc-okhttp</artifactId>
+            <optional>true</optional>
+            <exclusions>
+                <exclusion>
+                    <!-- okio 3.x is written in Kotlin and pulls in kotlin-stdlib. -->
+                    <groupId>com.squareup.okio</groupId>
+                    <artifactId>okio</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>com.squareup.okio</groupId>
+            <artifactId>okio</artifactId>
+            <optional>true</optional>
+        </dependency>
         <dependency>
             <groupId>com.google.appengine</groupId>
             <artifactId>runtime-util</artifactId>
@@ -358,12 +376,6 @@
                             </relocation>
                           </relocations>
                           <filters>
-                              <filter>
-                                  <artifact>io.grpc:grpc-netty-shaded</artifact>
-                                  <excludes>
-                                      <exclude>META-INF/native/**</exclude>
-                                  </excludes>
-                              </filter>
                              <filter>
                                   <artifact>*:*</artifact>
                                   <excludes>
@@ -543,7 +555,8 @@
                                     <include>io.grpc:grpc-auth</include>
                                     <include>io.grpc:grpc-context</include>
                                     <include>io.grpc:grpc-core</include>
-                                    <include>io.grpc:grpc-netty-shaded</include>
+                                    <include>io.grpc:grpc-okhttp</include>
+                                    <include>com.squareup.okio:okio</include>
                                     <include>io.grpc:grpc-protobuf</include>
                                     <include>io.grpc:grpc-protobuf-lite</include>
                                     <include>io.grpc:grpc-stub</include>

From e8f915874799f3af8e6819ee8ef3592127c66505 Mon Sep 17 00:00:00 2001
From: Ludovic Champenois <ludo@google.com>
Date: Sat, 24 Oct 2026 00:51:27 -0700
Subject: [PATCH 2/2] Keep okio on 1.x: ignore okio 2+ updates and enforce
 okio.version

The runtime jars bundle grpc-okhttp with the pure Java okio 1.17.6. okio 2+
is written in Kotlin and needs kotlin-stdlib, which the runtime jars don't
bundle (the shade artifactSet is an allowlist), so an okio upgrade would
break the Cloud Tasks client at runtime.

- Move the okio version to an okio.version property in the root pom.
- Add a maven-enforcer requireProperty rule to the runtime_impl poms that
  fails the build, with an explanation, unless okio.version is 1.x.
- Tell Dependabot to ignore okio >= 2.0.0. Majors are already ignored
  globally; this makes the okio case explicit. Mirror it in the (disabled)
  renovate.json.
---
 .github/dependabot.yml                |  5 +++++
 pom.xml                               |  4 +++-
 renovate.json                         |  6 ++++++
 runtime/runtime_impl_jetty12/pom.xml  | 21 +++++++++++++++++++++
 runtime/runtime_impl_jetty121/pom.xml | 21 +++++++++++++++++++++
 5 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index edc83c64..bc6fcdad 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -51,6 +51,11 @@ updates:
       - dependency-name: "org.eclipse.jetty.*:*"
       - dependency-name: "org.springframework.boot:spring-boot-starter-parent"
       - dependency-name: "org.springframework.boot:spring-boot-starter-web"
+      # The runtime jars use the pure Java okio 1.x with grpc-okhttp; okio 2+ is written in Kotlin
+      # and needs kotlin-stdlib. okio.version is also checked by the runtime_impl poms.
+      - dependency-name: "com.squareup.okio:okio"
+        versions:
+          - ">= 2.0.0"
 
   - package-ecosystem: "github-actions"
     directory: "/"
diff --git a/pom.xml b/pom.xml
index 0ce5281d..16196b3a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -69,6 +69,8 @@
     <auto-service.version>1.1.1</auto-service.version>
     <auto-value.version>1.11.1</auto-value.version>
     <grpc.version>1.85.0</grpc.version>
+    <!-- Must stay 1.x, enforced in the runtime_impl poms: okio 2+ is written in Kotlin. -->
+    <okio.version>1.17.6</okio.version>
     <jetty12.version>12.0.40</jetty12.version>
     <jetty121.version>12.1.14</jetty121.version>
     <slf4j.version>2.0.20</slf4j.version>
@@ -776,7 +778,7 @@
              Kotlin stdlib. All okio APIs used by grpc-okhttp are present in 1.17.6. -->
         <groupId>com.squareup.okio</groupId>
         <artifactId>okio</artifactId>
-        <version>1.17.6</version>
+        <version>${okio.version}</version>
       </dependency>
       <dependency>
         <groupId>com.google.auth</groupId>
diff --git a/renovate.json b/renovate.json
index 89cdfbe4..a89f6221 100644
--- a/renovate.json
+++ b/renovate.json
@@ -28,6 +28,12 @@
       ],
       "enabled": false
     },
+    {
+      "matchPackageNames": [
+        "com.squareup.okio:okio"
+      ],
+      "allowedVersions": "<2.0.0"
+    },
     {
       "major": {
         "enabled": false
diff --git a/runtime/runtime_impl_jetty12/pom.xml b/runtime/runtime_impl_jetty12/pom.xml
index 35dd12c2..de6f99b5 100644
--- a/runtime/runtime_impl_jetty12/pom.xml
+++ b/runtime/runtime_impl_jetty12/pom.xml
@@ -335,6 +335,27 @@
 
     <build>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>require-okio-1</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireProperty>
+                                    <property>okio.version</property>
+                                    <regex>1\.\d+(\.\d+)*</regex>
+                                    <regexMessage>okio.version must stay 1.x: the runtime jar bundles grpc-okhttp with the pure Java okio 1.x, while okio 2+ is written in Kotlin and needs kotlin-stdlib, which this jar does not bundle.</regexMessage>
+                                </requireProperty>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
diff --git a/runtime/runtime_impl_jetty121/pom.xml b/runtime/runtime_impl_jetty121/pom.xml
index d06153ae..5162fffd 100644
--- a/runtime/runtime_impl_jetty121/pom.xml
+++ b/runtime/runtime_impl_jetty121/pom.xml
@@ -358,6 +358,27 @@
 
     <build>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>require-okio-1</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireProperty>
+                                    <property>okio.version</property>
+                                    <regex>1\.\d+(\.\d+)*</regex>
+                                    <regexMessage>okio.version must stay 1.x: the runtime jar bundles grpc-okhttp with the pure Java okio 1.x, while okio 2+ is written in Kotlin and needs kotlin-stdlib, which this jar does not bundle.</regexMessage>
+                                </requireProperty>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>