fix(deps): Bump grpcVersion from 1.36.1 to 1.39.0 (#148)

Bumps `grpcVersion` from 1.36.1 to 1.39.0.
Updates `grpc-protobuf` from 1.36.1 to 1.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc/grpc-java/releases">grpc-protobuf's releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<h1>API Changes</h1>
<ul>
<li>Static methods in Builders that always throw are now annotated <a href="https://github.com/DoNotCall"><code>@​DoNotCall</code></a>. This annotation can be noticed by ErrorProne and inform you of a mistake at compile time instead of runtime. This applies to static methods like InProcessServerBuilder.forPort(int) which are inherited from base classes like ServerBuilder/ManagedChannelBuilder yet are a bug if used.</li>
<li>api, core: Support zero copy into protobuf. New APIs have been added to support the custom implementation of a zero-copy Protobuf deserialization marshaller. The <code>HasByteBuffer</code> API exposes ByteBuffers underlying the InputStream being passed to the <code>Marshaller</code> and the <code>Detachable</code> API allows custom Marshaller to take over the ownership of buffers for performing delayed deserialization.</li>
<li>NettyChannelBuilder supports SocketAddress with ChannelCredentials.</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>netty: Remove Maven pom.properties from netty-shaded jar. The properties don’t add much value and mainly confuse tools in a shaded jar.</li>
<li>netty-shaded: Modify the shading operation to transform native-image resources so they correctly reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/7540">#7540</a>)</li>
<li>xds: Shut down the scheduledExecutorService in the CertificateProvider when it is shutdown.</li>
<li>xds: Close the SslContexrProviderSupplier when a CDS LoadBalancer is shut down to prevent leakage.</li>
<li>xds, grpclb: Use a standalone Context for control plane RPCs. The existing behavior of implicitly using the Context in ThreadLocal can cause control plane RPCs to be cancelled prematurely, in cases the data plane RPC is made within a gRPC service to another service. To avoid being impacted by data plane RPC lifecycle, the fix creates standalone Context for control plane RPCs.</li>
<li>xds: cluster_resolver LB policy should wait until all clusters are resolved before propagating endpoints to child LB policy. Previously, the cluster_resolver LB policy propagated partially resolved results (endpoints for a subset of clusters) to its child LB policy, which can cause RPCs to be sent to less favored clusters before endpoints of more favored clusters are discovered.</li>
<li>xds: use load assignment endpoint address in Cluster as the DNS hostname for LOGICAL_DNS. The LOGICAL_DNS concept was misunderstood previously. Instead of using the channel authority, the hostname should be given by Cluster resource in CDS responses.</li>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. The fix mitigated the temporal invariant violation.</li>
</ul>
<h1>New Features</h1>
<ul>
<li>compiler:  Add support for ppc64le on RHEL8.</li>
</ul>
<h1>Dependencies</h1>
<ul>
<li>Protobuf upgraded to 3.17.2</li>
<li>We now use custom Gradle logic to determine if Maven’s requireUpperBoundDeps would fail for our published artifacts instead of Gradle’s failOnVersionConflict. This means we now make use of fewer dependency exclusions (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8238">#8238</a>). failOnVersionConflict has similar behavior to dependencyConvergence but we previously lacked a more precise tool to detect cases where Maven would downgrade dependencies. We strongly encourage all Maven users to use Maven Enforcer’s requireUpperBoundDeps and continue to discourage using dependencyConvergence</li>
</ul>
<p>Acknowledgements</p>
<p><a href="https://github.com/lepistone"><code>@​lepistone</code></a> Leonardo Pistone
<a href="https://github.com/shirodkara"><code>@​shirodkara</code></a> Amit Shirodkar
<a href="https://github.com/cfredri4"><code>@​cfredri4</code></a></p>
<h2>v1.38.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. It caused a channel panic (<code>INTERNAL: Panic! This is a bug!</code>) due to the exception <code>IllegalStateException: already in fallback</code>. The fix mitigated the temporal invariant violation.</li>
<li>xds: shut down the scheduledExecutorService in the CertificateProvider when it is shutdown</li>
</ul>
<h2>v1.38.0</h2>
<h2>gRPC Java 1.38.0 Release Notes</h2>
<h1>API Changes</h1>
<ul>
<li>services: move classes with protobuf dependency into io.grpc.protobuf.services. Users currently using BinaryLogging, HealthChecking, Channelz should migrate to use the corresponding classes in io.grpc.protobuf.services. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8056">#8056</a>)</li>
<li>ChannelCredentials and ServerCredentials and are now stable. Notably, this also includes TlsChannelCredentials and TlsServerCredentials that allow mTLS configuration without a direct dependency on Netty. The description of the new API can be found in <a href="https://github.com/grpc/proposal/blob/master/L74-java-channel-creds.md#proposal">gRFC L74</a>. These APIs are intended to “replace” the implicit security defaults of channels/servers as well as the <code>usePlaintext()</code> and <code>useTransportSecurity()</code> methods on the channel and server builders. The previous APIs are stable so will not be removed. Over time, documentation and examples will be migrated to the new API</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds: Fixed a bug that xDS users may experience null pointer exception in rare cases (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8087">#8087</a>)</li>
<li>netty: Fixed a bug that client RPCs may fail with a wrong exception with message &quot;Maximum active streams violated for this endpoint&quot; when receiving GOAWAY while MAX_CONCURRENT_STREAMS is reached. After the fix the client RPC should fail with UNAVAILABLE status in such a scenario. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8020">#8020</a>)</li>
<li>xds: Fixed a bug that xDS LB policies may process and propagate load balancing state update from its child LB policy after itself being shut down. This can be cascaded and result in hard-to-reason behaviors if any one layer of the LB policies does not clean up its internal state after shutdown.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc/grpc-java/commit/6b643380d881e3d52a448eca90a6a5d1d76792fc"><code>6b64338</code></a> Bump version to 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/67dce9a7bffd9678c36a66a1056b603ba2452171"><code>67dce9a</code></a> Update README etc to reference 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/e77561a63061b93f771d652bdb1894a094a52887"><code>e77561a</code></a> netty-shaded: Use compile instead of runtime dep in pom for core</li>
<li><a href="https://github.com/grpc/grpc-java/commit/dc74a31be121fc98e156a166b7a020d599ef41ed"><code>dc74a31</code></a> Modify netty-shaded resources to reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8258">#8258</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/84eb285742aaf93f15feeec493d60236f97410ac"><code>84eb285</code></a> xds: add override rbacfilter type url RbacPerProto (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8262">#8262</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/25122f9e8394ab90d28d1733f85080137f59deb5"><code>25122f9</code></a> api: clean up duplicated method in InternalServerInterceptors (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8261">#8261</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/c8ba60152958cb0f37d0e9a32ae406ce8d5f1ff0"><code>c8ba601</code></a> xds: add rbac http filter (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8251">#8251</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/2cbc7fc3a5b98122cdd67bc881aefa3eef8e1b65"><code>2cbc7fc</code></a> grpclb: skip fallback if the LB is already in fallback mode (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8253">#8253</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/5642e0124391602affb2422d84d3e6958fa7c2b9"><code>5642e01</code></a> Replace failOnVersionConflict() with custom requireUpperBoundDeps</li>
<li><a href="https://github.com/grpc/grpc-java/commit/aa18b2c2285659dd72befad80dc317f5c5b60c9f"><code>aa18b2c</code></a> grpclb: update load_balancer.proto</li>
<li>Additional commits viewable in <a href="https://github.com/grpc/grpc-java/compare/v1.36.1...v1.39.0">compare view</a></li>
</ul>
</details>
<br />

Updates `grpc-stub` from 1.36.1 to 1.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc/grpc-java/releases">grpc-stub's releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<h1>API Changes</h1>
<ul>
<li>Static methods in Builders that always throw are now annotated <a href="https://github.com/DoNotCall"><code>@​DoNotCall</code></a>. This annotation can be noticed by ErrorProne and inform you of a mistake at compile time instead of runtime. This applies to static methods like InProcessServerBuilder.forPort(int) which are inherited from base classes like ServerBuilder/ManagedChannelBuilder yet are a bug if used.</li>
<li>api, core: Support zero copy into protobuf. New APIs have been added to support the custom implementation of a zero-copy Protobuf deserialization marshaller. The <code>HasByteBuffer</code> API exposes ByteBuffers underlying the InputStream being passed to the <code>Marshaller</code> and the <code>Detachable</code> API allows custom Marshaller to take over the ownership of buffers for performing delayed deserialization.</li>
<li>NettyChannelBuilder supports SocketAddress with ChannelCredentials.</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>netty: Remove Maven pom.properties from netty-shaded jar. The properties don’t add much value and mainly confuse tools in a shaded jar.</li>
<li>netty-shaded: Modify the shading operation to transform native-image resources so they correctly reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/7540">#7540</a>)</li>
<li>xds: Shut down the scheduledExecutorService in the CertificateProvider when it is shutdown.</li>
<li>xds: Close the SslContexrProviderSupplier when a CDS LoadBalancer is shut down to prevent leakage.</li>
<li>xds, grpclb: Use a standalone Context for control plane RPCs. The existing behavior of implicitly using the Context in ThreadLocal can cause control plane RPCs to be cancelled prematurely, in cases the data plane RPC is made within a gRPC service to another service. To avoid being impacted by data plane RPC lifecycle, the fix creates standalone Context for control plane RPCs.</li>
<li>xds: cluster_resolver LB policy should wait until all clusters are resolved before propagating endpoints to child LB policy. Previously, the cluster_resolver LB policy propagated partially resolved results (endpoints for a subset of clusters) to its child LB policy, which can cause RPCs to be sent to less favored clusters before endpoints of more favored clusters are discovered.</li>
<li>xds: use load assignment endpoint address in Cluster as the DNS hostname for LOGICAL_DNS. The LOGICAL_DNS concept was misunderstood previously. Instead of using the channel authority, the hostname should be given by Cluster resource in CDS responses.</li>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. The fix mitigated the temporal invariant violation.</li>
</ul>
<h1>New Features</h1>
<ul>
<li>compiler:  Add support for ppc64le on RHEL8.</li>
</ul>
<h1>Dependencies</h1>
<ul>
<li>Protobuf upgraded to 3.17.2</li>
<li>We now use custom Gradle logic to determine if Maven’s requireUpperBoundDeps would fail for our published artifacts instead of Gradle’s failOnVersionConflict. This means we now make use of fewer dependency exclusions (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8238">#8238</a>). failOnVersionConflict has similar behavior to dependencyConvergence but we previously lacked a more precise tool to detect cases where Maven would downgrade dependencies. We strongly encourage all Maven users to use Maven Enforcer’s requireUpperBoundDeps and continue to discourage using dependencyConvergence</li>
</ul>
<p>Acknowledgements</p>
<p><a href="https://github.com/lepistone"><code>@​lepistone</code></a> Leonardo Pistone
<a href="https://github.com/shirodkara"><code>@​shirodkara</code></a> Amit Shirodkar
<a href="https://github.com/cfredri4"><code>@​cfredri4</code></a></p>
<h2>v1.38.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. It caused a channel panic (<code>INTERNAL: Panic! This is a bug!</code>) due to the exception <code>IllegalStateException: already in fallback</code>. The fix mitigated the temporal invariant violation.</li>
<li>xds: shut down the scheduledExecutorService in the CertificateProvider when it is shutdown</li>
</ul>
<h2>v1.38.0</h2>
<h2>gRPC Java 1.38.0 Release Notes</h2>
<h1>API Changes</h1>
<ul>
<li>services: move classes with protobuf dependency into io.grpc.protobuf.services. Users currently using BinaryLogging, HealthChecking, Channelz should migrate to use the corresponding classes in io.grpc.protobuf.services. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8056">#8056</a>)</li>
<li>ChannelCredentials and ServerCredentials and are now stable. Notably, this also includes TlsChannelCredentials and TlsServerCredentials that allow mTLS configuration without a direct dependency on Netty. The description of the new API can be found in <a href="https://github.com/grpc/proposal/blob/master/L74-java-channel-creds.md#proposal">gRFC L74</a>. These APIs are intended to “replace” the implicit security defaults of channels/servers as well as the <code>usePlaintext()</code> and <code>useTransportSecurity()</code> methods on the channel and server builders. The previous APIs are stable so will not be removed. Over time, documentation and examples will be migrated to the new API</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds: Fixed a bug that xDS users may experience null pointer exception in rare cases (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8087">#8087</a>)</li>
<li>netty: Fixed a bug that client RPCs may fail with a wrong exception with message &quot;Maximum active streams violated for this endpoint&quot; when receiving GOAWAY while MAX_CONCURRENT_STREAMS is reached. After the fix the client RPC should fail with UNAVAILABLE status in such a scenario. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8020">#8020</a>)</li>
<li>xds: Fixed a bug that xDS LB policies may process and propagate load balancing state update from its child LB policy after itself being shut down. This can be cascaded and result in hard-to-reason behaviors if any one layer of the LB policies does not clean up its internal state after shutdown.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc/grpc-java/commit/6b643380d881e3d52a448eca90a6a5d1d76792fc"><code>6b64338</code></a> Bump version to 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/67dce9a7bffd9678c36a66a1056b603ba2452171"><code>67dce9a</code></a> Update README etc to reference 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/e77561a63061b93f771d652bdb1894a094a52887"><code>e77561a</code></a> netty-shaded: Use compile instead of runtime dep in pom for core</li>
<li><a href="https://github.com/grpc/grpc-java/commit/dc74a31be121fc98e156a166b7a020d599ef41ed"><code>dc74a31</code></a> Modify netty-shaded resources to reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8258">#8258</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/84eb285742aaf93f15feeec493d60236f97410ac"><code>84eb285</code></a> xds: add override rbacfilter type url RbacPerProto (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8262">#8262</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/25122f9e8394ab90d28d1733f85080137f59deb5"><code>25122f9</code></a> api: clean up duplicated method in InternalServerInterceptors (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8261">#8261</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/c8ba60152958cb0f37d0e9a32ae406ce8d5f1ff0"><code>c8ba601</code></a> xds: add rbac http filter (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8251">#8251</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/2cbc7fc3a5b98122cdd67bc881aefa3eef8e1b65"><code>2cbc7fc</code></a> grpclb: skip fallback if the LB is already in fallback mode (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8253">#8253</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/5642e0124391602affb2422d84d3e6958fa7c2b9"><code>5642e01</code></a> Replace failOnVersionConflict() with custom requireUpperBoundDeps</li>
<li><a href="https://github.com/grpc/grpc-java/commit/aa18b2c2285659dd72befad80dc317f5c5b60c9f"><code>aa18b2c</code></a> grpclb: update load_balancer.proto</li>
<li>Additional commits viewable in <a href="https://github.com/grpc/grpc-java/compare/v1.36.1...v1.39.0">compare view</a></li>
</ul>
</details>
<br />

Updates `grpc-testing` from 1.36.1 to 1.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc/grpc-java/releases">grpc-testing's releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<h1>API Changes</h1>
<ul>
<li>Static methods in Builders that always throw are now annotated <a href="https://github.com/DoNotCall"><code>@​DoNotCall</code></a>. This annotation can be noticed by ErrorProne and inform you of a mistake at compile time instead of runtime. This applies to static methods like InProcessServerBuilder.forPort(int) which are inherited from base classes like ServerBuilder/ManagedChannelBuilder yet are a bug if used.</li>
<li>api, core: Support zero copy into protobuf. New APIs have been added to support the custom implementation of a zero-copy Protobuf deserialization marshaller. The <code>HasByteBuffer</code> API exposes ByteBuffers underlying the InputStream being passed to the <code>Marshaller</code> and the <code>Detachable</code> API allows custom Marshaller to take over the ownership of buffers for performing delayed deserialization.</li>
<li>NettyChannelBuilder supports SocketAddress with ChannelCredentials.</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>netty: Remove Maven pom.properties from netty-shaded jar. The properties don’t add much value and mainly confuse tools in a shaded jar.</li>
<li>netty-shaded: Modify the shading operation to transform native-image resources so they correctly reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/7540">#7540</a>)</li>
<li>xds: Shut down the scheduledExecutorService in the CertificateProvider when it is shutdown.</li>
<li>xds: Close the SslContexrProviderSupplier when a CDS LoadBalancer is shut down to prevent leakage.</li>
<li>xds, grpclb: Use a standalone Context for control plane RPCs. The existing behavior of implicitly using the Context in ThreadLocal can cause control plane RPCs to be cancelled prematurely, in cases the data plane RPC is made within a gRPC service to another service. To avoid being impacted by data plane RPC lifecycle, the fix creates standalone Context for control plane RPCs.</li>
<li>xds: cluster_resolver LB policy should wait until all clusters are resolved before propagating endpoints to child LB policy. Previously, the cluster_resolver LB policy propagated partially resolved results (endpoints for a subset of clusters) to its child LB policy, which can cause RPCs to be sent to less favored clusters before endpoints of more favored clusters are discovered.</li>
<li>xds: use load assignment endpoint address in Cluster as the DNS hostname for LOGICAL_DNS. The LOGICAL_DNS concept was misunderstood previously. Instead of using the channel authority, the hostname should be given by Cluster resource in CDS responses.</li>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. The fix mitigated the temporal invariant violation.</li>
</ul>
<h1>New Features</h1>
<ul>
<li>compiler:  Add support for ppc64le on RHEL8.</li>
</ul>
<h1>Dependencies</h1>
<ul>
<li>Protobuf upgraded to 3.17.2</li>
<li>We now use custom Gradle logic to determine if Maven’s requireUpperBoundDeps would fail for our published artifacts instead of Gradle’s failOnVersionConflict. This means we now make use of fewer dependency exclusions (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8238">#8238</a>). failOnVersionConflict has similar behavior to dependencyConvergence but we previously lacked a more precise tool to detect cases where Maven would downgrade dependencies. We strongly encourage all Maven users to use Maven Enforcer’s requireUpperBoundDeps and continue to discourage using dependencyConvergence</li>
</ul>
<p>Acknowledgements</p>
<p><a href="https://github.com/lepistone"><code>@​lepistone</code></a> Leonardo Pistone
<a href="https://github.com/shirodkara"><code>@​shirodkara</code></a> Amit Shirodkar
<a href="https://github.com/cfredri4"><code>@​cfredri4</code></a></p>
<h2>v1.38.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. It caused a channel panic (<code>INTERNAL: Panic! This is a bug!</code>) due to the exception <code>IllegalStateException: already in fallback</code>. The fix mitigated the temporal invariant violation.</li>
<li>xds: shut down the scheduledExecutorService in the CertificateProvider when it is shutdown</li>
</ul>
<h2>v1.38.0</h2>
<h2>gRPC Java 1.38.0 Release Notes</h2>
<h1>API Changes</h1>
<ul>
<li>services: move classes with protobuf dependency into io.grpc.protobuf.services. Users currently using BinaryLogging, HealthChecking, Channelz should migrate to use the corresponding classes in io.grpc.protobuf.services. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8056">#8056</a>)</li>
<li>ChannelCredentials and ServerCredentials and are now stable. Notably, this also includes TlsChannelCredentials and TlsServerCredentials that allow mTLS configuration without a direct dependency on Netty. The description of the new API can be found in <a href="https://github.com/grpc/proposal/blob/master/L74-java-channel-creds.md#proposal">gRFC L74</a>. These APIs are intended to “replace” the implicit security defaults of channels/servers as well as the <code>usePlaintext()</code> and <code>useTransportSecurity()</code> methods on the channel and server builders. The previous APIs are stable so will not be removed. Over time, documentation and examples will be migrated to the new API</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds: Fixed a bug that xDS users may experience null pointer exception in rare cases (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8087">#8087</a>)</li>
<li>netty: Fixed a bug that client RPCs may fail with a wrong exception with message &quot;Maximum active streams violated for this endpoint&quot; when receiving GOAWAY while MAX_CONCURRENT_STREAMS is reached. After the fix the client RPC should fail with UNAVAILABLE status in such a scenario. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8020">#8020</a>)</li>
<li>xds: Fixed a bug that xDS LB policies may process and propagate load balancing state update from its child LB policy after itself being shut down. This can be cascaded and result in hard-to-reason behaviors if any one layer of the LB policies does not clean up its internal state after shutdown.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc/grpc-java/commit/6b643380d881e3d52a448eca90a6a5d1d76792fc"><code>6b64338</code></a> Bump version to 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/67dce9a7bffd9678c36a66a1056b603ba2452171"><code>67dce9a</code></a> Update README etc to reference 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/e77561a63061b93f771d652bdb1894a094a52887"><code>e77561a</code></a> netty-shaded: Use compile instead of runtime dep in pom for core</li>
<li><a href="https://github.com/grpc/grpc-java/commit/dc74a31be121fc98e156a166b7a020d599ef41ed"><code>dc74a31</code></a> Modify netty-shaded resources to reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8258">#8258</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/84eb285742aaf93f15feeec493d60236f97410ac"><code>84eb285</code></a> xds: add override rbacfilter type url RbacPerProto (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8262">#8262</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/25122f9e8394ab90d28d1733f85080137f59deb5"><code>25122f9</code></a> api: clean up duplicated method in InternalServerInterceptors (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8261">#8261</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/c8ba60152958cb0f37d0e9a32ae406ce8d5f1ff0"><code>c8ba601</code></a> xds: add rbac http filter (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8251">#8251</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/2cbc7fc3a5b98122cdd67bc881aefa3eef8e1b65"><code>2cbc7fc</code></a> grpclb: skip fallback if the LB is already in fallback mode (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8253">#8253</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/5642e0124391602affb2422d84d3e6958fa7c2b9"><code>5642e01</code></a> Replace failOnVersionConflict() with custom requireUpperBoundDeps</li>
<li><a href="https://github.com/grpc/grpc-java/commit/aa18b2c2285659dd72befad80dc317f5c5b60c9f"><code>aa18b2c</code></a> grpclb: update load_balancer.proto</li>
<li>Additional commits viewable in <a href="https://github.com/grpc/grpc-java/compare/v1.36.1...v1.39.0">compare view</a></li>
</ul>
</details>
<br />

Updates `grpc-netty` from 1.36.1 to 1.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc/grpc-java/releases">grpc-netty's releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<h1>API Changes</h1>
<ul>
<li>Static methods in Builders that always throw are now annotated <a href="https://github.com/DoNotCall"><code>@​DoNotCall</code></a>. This annotation can be noticed by ErrorProne and inform you of a mistake at compile time instead of runtime. This applies to static methods like InProcessServerBuilder.forPort(int) which are inherited from base classes like ServerBuilder/ManagedChannelBuilder yet are a bug if used.</li>
<li>api, core: Support zero copy into protobuf. New APIs have been added to support the custom implementation of a zero-copy Protobuf deserialization marshaller. The <code>HasByteBuffer</code> API exposes ByteBuffers underlying the InputStream being passed to the <code>Marshaller</code> and the <code>Detachable</code> API allows custom Marshaller to take over the ownership of buffers for performing delayed deserialization.</li>
<li>NettyChannelBuilder supports SocketAddress with ChannelCredentials.</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>netty: Remove Maven pom.properties from netty-shaded jar. The properties don’t add much value and mainly confuse tools in a shaded jar.</li>
<li>netty-shaded: Modify the shading operation to transform native-image resources so they correctly reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/7540">#7540</a>)</li>
<li>xds: Shut down the scheduledExecutorService in the CertificateProvider when it is shutdown.</li>
<li>xds: Close the SslContexrProviderSupplier when a CDS LoadBalancer is shut down to prevent leakage.</li>
<li>xds, grpclb: Use a standalone Context for control plane RPCs. The existing behavior of implicitly using the Context in ThreadLocal can cause control plane RPCs to be cancelled prematurely, in cases the data plane RPC is made within a gRPC service to another service. To avoid being impacted by data plane RPC lifecycle, the fix creates standalone Context for control plane RPCs.</li>
<li>xds: cluster_resolver LB policy should wait until all clusters are resolved before propagating endpoints to child LB policy. Previously, the cluster_resolver LB policy propagated partially resolved results (endpoints for a subset of clusters) to its child LB policy, which can cause RPCs to be sent to less favored clusters before endpoints of more favored clusters are discovered.</li>
<li>xds: use load assignment endpoint address in Cluster as the DNS hostname for LOGICAL_DNS. The LOGICAL_DNS concept was misunderstood previously. Instead of using the channel authority, the hostname should be given by Cluster resource in CDS responses.</li>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. The fix mitigated the temporal invariant violation.</li>
</ul>
<h1>New Features</h1>
<ul>
<li>compiler:  Add support for ppc64le on RHEL8.</li>
</ul>
<h1>Dependencies</h1>
<ul>
<li>Protobuf upgraded to 3.17.2</li>
<li>We now use custom Gradle logic to determine if Maven’s requireUpperBoundDeps would fail for our published artifacts instead of Gradle’s failOnVersionConflict. This means we now make use of fewer dependency exclusions (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8238">#8238</a>). failOnVersionConflict has similar behavior to dependencyConvergence but we previously lacked a more precise tool to detect cases where Maven would downgrade dependencies. We strongly encourage all Maven users to use Maven Enforcer’s requireUpperBoundDeps and continue to discourage using dependencyConvergence</li>
</ul>
<p>Acknowledgements</p>
<p><a href="https://github.com/lepistone"><code>@​lepistone</code></a> Leonardo Pistone
<a href="https://github.com/shirodkara"><code>@​shirodkara</code></a> Amit Shirodkar
<a href="https://github.com/cfredri4"><code>@​cfredri4</code></a></p>
<h2>v1.38.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. It caused a channel panic (<code>INTERNAL: Panic! This is a bug!</code>) due to the exception <code>IllegalStateException: already in fallback</code>. The fix mitigated the temporal invariant violation.</li>
<li>xds: shut down the scheduledExecutorService in the CertificateProvider when it is shutdown</li>
</ul>
<h2>v1.38.0</h2>
<h2>gRPC Java 1.38.0 Release Notes</h2>
<h1>API Changes</h1>
<ul>
<li>services: move classes with protobuf dependency into io.grpc.protobuf.services. Users currently using BinaryLogging, HealthChecking, Channelz should migrate to use the corresponding classes in io.grpc.protobuf.services. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8056">#8056</a>)</li>
<li>ChannelCredentials and ServerCredentials and are now stable. Notably, this also includes TlsChannelCredentials and TlsServerCredentials that allow mTLS configuration without a direct dependency on Netty. The description of the new API can be found in <a href="https://github.com/grpc/proposal/blob/master/L74-java-channel-creds.md#proposal">gRFC L74</a>. These APIs are intended to “replace” the implicit security defaults of channels/servers as well as the <code>usePlaintext()</code> and <code>useTransportSecurity()</code> methods on the channel and server builders. The previous APIs are stable so will not be removed. Over time, documentation and examples will be migrated to the new API</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds: Fixed a bug that xDS users may experience null pointer exception in rare cases (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8087">#8087</a>)</li>
<li>netty: Fixed a bug that client RPCs may fail with a wrong exception with message &quot;Maximum active streams violated for this endpoint&quot; when receiving GOAWAY while MAX_CONCURRENT_STREAMS is reached. After the fix the client RPC should fail with UNAVAILABLE status in such a scenario. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8020">#8020</a>)</li>
<li>xds: Fixed a bug that xDS LB policies may process and propagate load balancing state update from its child LB policy after itself being shut down. This can be cascaded and result in hard-to-reason behaviors if any one layer of the LB policies does not clean up its internal state after shutdown.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc/grpc-java/commit/6b643380d881e3d52a448eca90a6a5d1d76792fc"><code>6b64338</code></a> Bump version to 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/67dce9a7bffd9678c36a66a1056b603ba2452171"><code>67dce9a</code></a> Update README etc to reference 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/e77561a63061b93f771d652bdb1894a094a52887"><code>e77561a</code></a> netty-shaded: Use compile instead of runtime dep in pom for core</li>
<li><a href="https://github.com/grpc/grpc-java/commit/dc74a31be121fc98e156a166b7a020d599ef41ed"><code>dc74a31</code></a> Modify netty-shaded resources to reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8258">#8258</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/84eb285742aaf93f15feeec493d60236f97410ac"><code>84eb285</code></a> xds: add override rbacfilter type url RbacPerProto (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8262">#8262</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/25122f9e8394ab90d28d1733f85080137f59deb5"><code>25122f9</code></a> api: clean up duplicated method in InternalServerInterceptors (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8261">#8261</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/c8ba60152958cb0f37d0e9a32ae406ce8d5f1ff0"><code>c8ba601</code></a> xds: add rbac http filter (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8251">#8251</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/2cbc7fc3a5b98122cdd67bc881aefa3eef8e1b65"><code>2cbc7fc</code></a> grpclb: skip fallback if the LB is already in fallback mode (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8253">#8253</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/5642e0124391602affb2422d84d3e6958fa7c2b9"><code>5642e01</code></a> Replace failOnVersionConflict() with custom requireUpperBoundDeps</li>
<li><a href="https://github.com/grpc/grpc-java/commit/aa18b2c2285659dd72befad80dc317f5c5b60c9f"><code>aa18b2c</code></a> grpclb: update load_balancer.proto</li>
<li>Additional commits viewable in <a href="https://github.com/grpc/grpc-java/compare/v1.36.1...v1.39.0">compare view</a></li>
</ul>
</details>
<br />

Updates `protoc-gen-grpc-java` from 1.36.1 to 1.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc/grpc-java/releases">protoc-gen-grpc-java's releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<h1>API Changes</h1>
<ul>
<li>Static methods in Builders that always throw are now annotated <a href="https://github.com/DoNotCall"><code>@​DoNotCall</code></a>. This annotation can be noticed by ErrorProne and inform you of a mistake at compile time instead of runtime. This applies to static methods like InProcessServerBuilder.forPort(int) which are inherited from base classes like ServerBuilder/ManagedChannelBuilder yet are a bug if used.</li>
<li>api, core: Support zero copy into protobuf. New APIs have been added to support the custom implementation of a zero-copy Protobuf deserialization marshaller. The <code>HasByteBuffer</code> API exposes ByteBuffers underlying the InputStream being passed to the <code>Marshaller</code> and the <code>Detachable</code> API allows custom Marshaller to take over the ownership of buffers for performing delayed deserialization.</li>
<li>NettyChannelBuilder supports SocketAddress with ChannelCredentials.</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>netty: Remove Maven pom.properties from netty-shaded jar. The properties don’t add much value and mainly confuse tools in a shaded jar.</li>
<li>netty-shaded: Modify the shading operation to transform native-image resources so they correctly reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/7540">#7540</a>)</li>
<li>xds: Shut down the scheduledExecutorService in the CertificateProvider when it is shutdown.</li>
<li>xds: Close the SslContexrProviderSupplier when a CDS LoadBalancer is shut down to prevent leakage.</li>
<li>xds, grpclb: Use a standalone Context for control plane RPCs. The existing behavior of implicitly using the Context in ThreadLocal can cause control plane RPCs to be cancelled prematurely, in cases the data plane RPC is made within a gRPC service to another service. To avoid being impacted by data plane RPC lifecycle, the fix creates standalone Context for control plane RPCs.</li>
<li>xds: cluster_resolver LB policy should wait until all clusters are resolved before propagating endpoints to child LB policy. Previously, the cluster_resolver LB policy propagated partially resolved results (endpoints for a subset of clusters) to its child LB policy, which can cause RPCs to be sent to less favored clusters before endpoints of more favored clusters are discovered.</li>
<li>xds: use load assignment endpoint address in Cluster as the DNS hostname for LOGICAL_DNS. The LOGICAL_DNS concept was misunderstood previously. Instead of using the channel authority, the hostname should be given by Cluster resource in CDS responses.</li>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. The fix mitigated the temporal invariant violation.</li>
</ul>
<h1>New Features</h1>
<ul>
<li>compiler:  Add support for ppc64le on RHEL8.</li>
</ul>
<h1>Dependencies</h1>
<ul>
<li>Protobuf upgraded to 3.17.2</li>
<li>We now use custom Gradle logic to determine if Maven’s requireUpperBoundDeps would fail for our published artifacts instead of Gradle’s failOnVersionConflict. This means we now make use of fewer dependency exclusions (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8238">#8238</a>). failOnVersionConflict has similar behavior to dependencyConvergence but we previously lacked a more precise tool to detect cases where Maven would downgrade dependencies. We strongly encourage all Maven users to use Maven Enforcer’s requireUpperBoundDeps and continue to discourage using dependencyConvergence</li>
</ul>
<p>Acknowledgements</p>
<p><a href="https://github.com/lepistone"><code>@​lepistone</code></a> Leonardo Pistone
<a href="https://github.com/shirodkara"><code>@​shirodkara</code></a> Amit Shirodkar
<a href="https://github.com/cfredri4"><code>@​cfredri4</code></a></p>
<h2>v1.38.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li>grpclb: skip fallback if the LB is already in fallback mode. An invariant check for gRPCLB LB policy’s internal state introduced by <a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8035">#8035</a> is broken in case the LB policy is in fallback mode while receiving an address update without remote balancer addresses. It caused a channel panic (<code>INTERNAL: Panic! This is a bug!</code>) due to the exception <code>IllegalStateException: already in fallback</code>. The fix mitigated the temporal invariant violation.</li>
<li>xds: shut down the scheduledExecutorService in the CertificateProvider when it is shutdown</li>
</ul>
<h2>v1.38.0</h2>
<h2>gRPC Java 1.38.0 Release Notes</h2>
<h1>API Changes</h1>
<ul>
<li>services: move classes with protobuf dependency into io.grpc.protobuf.services. Users currently using BinaryLogging, HealthChecking, Channelz should migrate to use the corresponding classes in io.grpc.protobuf.services. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8056">#8056</a>)</li>
<li>ChannelCredentials and ServerCredentials and are now stable. Notably, this also includes TlsChannelCredentials and TlsServerCredentials that allow mTLS configuration without a direct dependency on Netty. The description of the new API can be found in <a href="https://github.com/grpc/proposal/blob/master/L74-java-channel-creds.md#proposal">gRFC L74</a>. These APIs are intended to “replace” the implicit security defaults of channels/servers as well as the <code>usePlaintext()</code> and <code>useTransportSecurity()</code> methods on the channel and server builders. The previous APIs are stable so will not be removed. Over time, documentation and examples will be migrated to the new API</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds: Fixed a bug that xDS users may experience null pointer exception in rare cases (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8087">#8087</a>)</li>
<li>netty: Fixed a bug that client RPCs may fail with a wrong exception with message &quot;Maximum active streams violated for this endpoint&quot; when receiving GOAWAY while MAX_CONCURRENT_STREAMS is reached. After the fix the client RPC should fail with UNAVAILABLE status in such a scenario. (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8020">#8020</a>)</li>
<li>xds: Fixed a bug that xDS LB policies may process and propagate load balancing state update from its child LB policy after itself being shut down. This can be cascaded and result in hard-to-reason behaviors if any one layer of the LB policies does not clean up its internal state after shutdown.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc/grpc-java/commit/6b643380d881e3d52a448eca90a6a5d1d76792fc"><code>6b64338</code></a> Bump version to 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/67dce9a7bffd9678c36a66a1056b603ba2452171"><code>67dce9a</code></a> Update README etc to reference 1.39.0</li>
<li><a href="https://github.com/grpc/grpc-java/commit/e77561a63061b93f771d652bdb1894a094a52887"><code>e77561a</code></a> netty-shaded: Use compile instead of runtime dep in pom for core</li>
<li><a href="https://github.com/grpc/grpc-java/commit/dc74a31be121fc98e156a166b7a020d599ef41ed"><code>dc74a31</code></a> Modify netty-shaded resources to reference shaded class names (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8258">#8258</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/84eb285742aaf93f15feeec493d60236f97410ac"><code>84eb285</code></a> xds: add override rbacfilter type url RbacPerProto (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8262">#8262</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/25122f9e8394ab90d28d1733f85080137f59deb5"><code>25122f9</code></a> api: clean up duplicated method in InternalServerInterceptors (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8261">#8261</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/c8ba60152958cb0f37d0e9a32ae406ce8d5f1ff0"><code>c8ba601</code></a> xds: add rbac http filter (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8251">#8251</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/2cbc7fc3a5b98122cdd67bc881aefa3eef8e1b65"><code>2cbc7fc</code></a> grpclb: skip fallback if the LB is already in fallback mode (<a href="https://github-redirect.dependabot.com/grpc/grpc-java/issues/8253">#8253</a>)</li>
<li><a href="https://github.com/grpc/grpc-java/commit/5642e0124391602affb2422d84d3e6958fa7c2b9"><code>5642e01</code></a> Replace failOnVersionConflict() with custom requireUpperBoundDeps</li>
<li><a href="https://github.com/grpc/grpc-java/commit/aa18b2c2285659dd72befad80dc317f5c5b60c9f"><code>aa18b2c</code></a> grpclb: update load_balancer.proto</li>
<li>Additional commits viewable in <a href="https://github.com/grpc/grpc-java/compare/v1.36.1...v1.39.0">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the `.dependabot/config.yml` file in this repo:
- Update frequency
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)



</details>

Author: dependabot-preview[bot]

build.gradle

@@ -4,7 +4,7 @@ buildscript{
   ext {
     kotlinVersion = '1.5.20'
     kotlinCoroutinesVersion = '1.5.0'
-    grpcVersion = '1.36.1'
+    grpcVersion = '1.39.0'
     protobufVersion = '3.17.3'
     protobufGradleVersion = '0.8.15'
   }