[Release] Bump version to 1.49.4 (on v1.49.x branch) (#35814)

Change was created by the release automation script. See go/grpc-release

BUILD

@@ -150,7 +150,7 @@ g_stands_for = "gamma"  # @unused
 
 core_version = "27.0.0"  # @unused
 
-version = "1.49.0-dev"  # @unused
+version = "1.49.4"  # @unused
 
 GPR_PUBLIC_HDRS = [
     "include/grpc/support/alloc.h",
@@ -2237,6 +2237,7 @@ grpc_cc_library(
     deps = [
         "gpr",
         "gpr_platform",
+        "no_destruct",
     ],
 )
 
@@ -4621,12 +4622,12 @@ grpc_cc_library(
     language = "c++",
     deps = [
         "debug_location",
+        "dual_ref_counted",
         "gpr",
         "grpc_base",
         "grpc_codegen",
         "iomgr_fwd",
         "lb_policy",
-        "orphanable",
         "ref_counted_ptr",
         "server_address",
         "subchannel_interface",
@@ -4699,7 +4700,6 @@ grpc_cc_library(
         "lb_policy_factory",
         "lb_policy_registry",
         "orphanable",
-        "ref_counted",
         "ref_counted_ptr",
         "server_address",
         "sockaddr_utils",

CMakeLists.txt

@@ -25,12 +25,12 @@
 cmake_minimum_required(VERSION 3.5.1)
 
 set(PACKAGE_NAME          "grpc")
-set(PACKAGE_VERSION       "1.49.0-dev")
+set(PACKAGE_VERSION       "1.49.4")
 set(gRPC_CORE_VERSION     "27.0.0")
 set(gRPC_CORE_SOVERSION   "27")
-set(gRPC_CPP_VERSION      "1.49.0-dev")
+set(gRPC_CPP_VERSION      "1.49.4")
 set(gRPC_CPP_SOVERSION    "1.49")
-set(gRPC_CSHARP_VERSION   "2.49.0-dev")
+set(gRPC_CSHARP_VERSION   "2.49.4")
 set(gRPC_CSHARP_SOVERSION "2.49")
 set(PACKAGE_STRING        "${PACKAGE_NAME} ${PACKAGE_VERSION}")
 set(PACKAGE_TARNAME       "${PACKAGE_NAME}-${PACKAGE_VERSION}")
@@ -299,7 +299,7 @@ endif()
 if (gRPC_XDS_USER_AGENT_IS_CSHARP)
   # The value of the defines needs to contain quotes.
   # See https://github.com/grpc/grpc/blob/fbf32836a418cc84f58786700273b65cb9174e1d/src/core/ext/xds/xds_api.cc#L854
-  add_definitions("-DGRPC_XDS_USER_AGENT_NAME_SUFFIX=\"csharp\"" "-DGRPC_XDS_USER_AGENT_VERSION_SUFFIX=\"2.49.0-dev\"")
+  add_definitions("-DGRPC_XDS_USER_AGENT_NAME_SUFFIX=\"csharp\"" "-DGRPC_XDS_USER_AGENT_VERSION_SUFFIX=\"2.49.4\"")
 endif()
 
 if(UNIX AND NOT HAIKU)

Makefile

@@ -454,8 +454,8 @@ Q = @
 endif
 
 CORE_VERSION = 27.0.0
-CPP_VERSION = 1.49.0-dev
-CSHARP_VERSION = 2.49.0-dev
+CPP_VERSION = 1.49.4
+CSHARP_VERSION = 2.49.4
 
 CPPFLAGS_NO_ARCH += $(addprefix -I, $(INCLUDES)) $(addprefix -D, $(DEFINES))
 CPPFLAGS += $(CPPFLAGS_NO_ARCH) $(ARCH_FLAGS)

Rakefile

@@ -144,7 +144,7 @@ task 'gem:native', [:plat] do |t, args|
   verbose = ENV['V'] || '0'
 
   grpc_config = ENV['GRPC_CONFIG'] || 'opt'
-  ruby_cc_versions = ['3.1.0', '3.0.0', '2.7.0', '2.6.0', '2.5.0'].join(':')
+  ruby_cc_versions = ['3.1.0', '3.0.0', '2.7.0', '2.6.0'].join(':')
   selected_plat = "#{args[:plat]}"
 
   if RUBY_PLATFORM =~ /darwin/

_metadata.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/_metadata.py.template`!!!
 
-__version__ = """1.49.0.dev0"""
+__version__ = """1.49.4"""

bazel/grpc_deps.bzl

@@ -185,11 +185,11 @@ def grpc_deps():
             name = "boringssl",
             # Use github mirror instead of https://boringssl.googlesource.com/boringssl
             # to obtain a boringssl archive with consistent sha256
-            sha256 = "534fa658bd845fd974b50b10f444d392dfd0d93768c4a51b61263fd37d851c40",
-            strip_prefix = "boringssl-b9232f9e27e5668bc0414879dcdedb2a59ea75f2",
+            sha256 = "ad0b806b6c5cbd6cae121c608945d5fed468748e330632e8d53315089ad52c67",
+            strip_prefix = "boringssl-6195bf8242156c9a2fa75702eee058f91b86a88b",
             urls = [
-                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/google/boringssl/archive/b9232f9e27e5668bc0414879dcdedb2a59ea75f2.tar.gz",
-                "https://github.com/google/boringssl/archive/b9232f9e27e5668bc0414879dcdedb2a59ea75f2.tar.gz",
+                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/google/boringssl/archive/6195bf8242156c9a2fa75702eee058f91b86a88b.tar.gz",
+                "https://github.com/google/boringssl/archive/6195bf8242156c9a2fa75702eee058f91b86a88b.tar.gz",
             ],
         )
 
@@ -197,22 +197,22 @@ def grpc_deps():
         http_archive(
             name = "zlib",
             build_file = "@com_github_grpc_grpc//third_party:zlib.BUILD",
-            sha256 = "ef47b0fbe646d69a2fc5ba012cb278de8e8946a8e9649f83a807cc05559f0eff",
-            strip_prefix = "zlib-21767c654d31d2dccdde4330529775c6c5fd5389",
+            sha256 = "90f43a9c998740e8a0db24b0af0147033db2aaaa99423129abbd76640757cac9",
+            strip_prefix = "zlib-04f42ceca40f73e2978b50e93806c2a18c1281fc",
             urls = [
-                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/madler/zlib/archive/21767c654d31d2dccdde4330529775c6c5fd5389.tar.gz",
-                "https://github.com/madler/zlib/archive/21767c654d31d2dccdde4330529775c6c5fd5389.tar.gz",
+                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/madler/zlib/archive/04f42ceca40f73e2978b50e93806c2a18c1281fc.tar.gz",
+                "https://github.com/madler/zlib/archive/04f42ceca40f73e2978b50e93806c2a18c1281fc.tar.gz",
             ],
         )
 
     if "com_google_protobuf" not in native.existing_rules():
         http_archive(
             name = "com_google_protobuf",
-            sha256 = "6b6c30c00eacbc888414916c9784fd2159b5f4a7b7200d947a19dfdf70eef6ff",
-            strip_prefix = "protobuf-ab840345966d0fa8e7100d771c92a73bfbadd25c",
+            sha256 = "63c5539a8506dc6bccd352a857cea106e0a389ce047a3ff0a78fe3f8fede410d",
+            strip_prefix = "protobuf-24487dd1045c7f3d64a21f38a3f0c06cc4cf2edb",
             urls = [
-                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/protocolbuffers/protobuf/archive/ab840345966d0fa8e7100d771c92a73bfbadd25c.tar.gz",
-                "https://github.com/protocolbuffers/protobuf/archive/ab840345966d0fa8e7100d771c92a73bfbadd25c.tar.gz",
+                "https://storage.googleapis.com/grpc-bazel-mirror/github.com/protocolbuffers/protobuf/archive/24487dd1045c7f3d64a21f38a3f0c06cc4cf2edb.tar.gz",
+                "https://github.com/protocolbuffers/protobuf/archive/24487dd1045c7f3d64a21f38a3f0c06cc4cf2edb.tar.gz",
             ],
             patches = ["@com_github_grpc_grpc//third_party:protobuf.patch"],
             patch_args = ["-p1"],

build_handwritten.yaml

@@ -15,8 +15,8 @@ settings:
   core_version: 27.0.0
   csharp_major_version: 2
   g_stands_for: gamma
-  protobuf_version: 3.21.5
-  version: 1.49.0-dev
+  protobuf_version: 3.21.6
+  version: 1.49.4
 targets:
 - name: gen_hpack_tables
   build: tool

config.m4

@@ -1191,7 +1191,7 @@ if test "$PHP_GRPC" != "no"; then
     -D_HAS_EXCEPTIONS=0 -DNOMINMAX -DGRPC_ARES=0 \
     -DGRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK=1 \
     -DGRPC_XDS_USER_AGENT_NAME_SUFFIX='"\"PHP\""' \
-    -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX='"\"1.49.0dev\""')
+    -DGRPC_XDS_USER_AGENT_VERSION_SUFFIX='"\"1.49.4\""')
 
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/census)
   PHP_ADD_BUILD_DIR($ext_builddir/src/core/ext/filters/channel_idle)

doc/g_stands_for.md

@@ -48,4 +48,4 @@
 - 1.46 'g' stands for ['golazo'](https://github.com/grpc/grpc/tree/v1.46.x)
 - 1.47 'g' stands for ['gridman'](https://github.com/grpc/grpc/tree/v1.47.x)
 - 1.48 'g' stands for ['garum'](https://github.com/grpc/grpc/tree/v1.48.x)
-- 1.49 'g' stands for ['gamma'](https://github.com/grpc/grpc/tree/master)
+- 1.49 'g' stands for ['gamma'](https://github.com/grpc/grpc/tree/v1.49.x)

gRPC-C++.podspec

@@ -22,7 +22,7 @@
 Pod::Spec.new do |s|
   s.name     = 'gRPC-C++'
   # TODO (mxyan): use version that match gRPC version when pod is stabilized
-  version = '1.49.0-dev'
+  version = '1.49.4'
   s.version  = version
   s.summary  = 'gRPC C++ library'
   s.homepage = 'https://grpc.io'

gRPC-Core.podspec

@@ -21,7 +21,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC-Core'
-  version = '1.49.0-dev'
+  version = '1.49.4'
   s.version  = version
   s.summary  = 'Core cross-platform gRPC library, written in C'
   s.homepage = 'https://grpc.io'
@@ -171,7 +171,7 @@ Pod::Spec.new do |s|
     ss.header_mappings_dir = '.'
     ss.libraries = 'z'
     ss.dependency "#{s.name}/Interface", version
-    ss.dependency 'BoringSSL-GRPC', '0.0.24'
+    ss.dependency 'BoringSSL-GRPC', '0.0.25'
     ss.dependency 'abseil/base/base', abseil_version
     ss.dependency 'abseil/base/core_headers', abseil_version
     ss.dependency 'abseil/container/flat_hash_map', abseil_version

gRPC-ProtoRPC.podspec

@@ -21,7 +21,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC-ProtoRPC'
-  version = '1.49.0-dev'
+  version = '1.49.4'
   s.version  = version
   s.summary  = 'RPC library for Protocol Buffers, based on gRPC'
   s.homepage = 'https://grpc.io'

gRPC-RxLibrary.podspec

@@ -21,7 +21,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC-RxLibrary'
-  version = '1.49.0-dev'
+  version = '1.49.4'
   s.version  = version
   s.summary  = 'Reactive Extensions library for iOS/OSX.'
   s.homepage = 'https://grpc.io'

gRPC.podspec

@@ -20,7 +20,7 @@
 
 Pod::Spec.new do |s|
   s.name     = 'gRPC'
-  version = '1.49.0-dev'
+  version = '1.49.4'
   s.version  = version
   s.summary  = 'gRPC client library for iOS/OSX'
   s.homepage = 'https://grpc.io'

grpc.def

@@ -147,6 +147,8 @@ EXPORTS
     grpc_tls_certificate_provider_file_watcher_create
     grpc_tls_certificate_provider_release
     grpc_tls_credentials_options_create
+    grpc_tls_credentials_options_set_min_tls_version
+    grpc_tls_credentials_options_set_max_tls_version
     grpc_tls_credentials_options_set_certificate_provider
     grpc_tls_credentials_options_watch_root_certs
     grpc_tls_credentials_options_set_root_cert_name

include/grpc/grpc_security.h

@@ -813,6 +813,24 @@ GRPCAPI void grpc_tls_certificate_provider_release(
  */
 GRPCAPI grpc_tls_credentials_options* grpc_tls_credentials_options_create(void);
 
+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the minimum TLS version that will be negotiated during the TLS
+ * handshake. If not set, the underlying SSL library will set it to TLS v1.2.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_min_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version min_tls_version);
+
+/**
+ * EXPERIMENTAL API - Subject to change
+ *
+ * Sets the maximum TLS version that will be negotiated during the TLS
+ * handshake. If not set, the underlying SSL library will set it to TLS v1.3.
+ */
+GRPCAPI void grpc_tls_credentials_options_set_max_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version max_tls_version);
+
 /**
  * EXPERIMENTAL API - Subject to change
  *

include/grpcpp/security/tls_credentials_options.h

@@ -104,6 +104,15 @@ class TlsCredentialsOptions {
   // version > 1.1.
   void set_crl_directory(const std::string& path);
 
+  // Sets the minimum TLS version that will be negotiated during the TLS
+  // handshake. If not set, the underlying SSL library will use TLS v1.2.
+  // @param tls_version: The minimum TLS version.
+  void set_min_tls_version(grpc_tls_version tls_version);
+  // Sets the maximum TLS version that will be negotiated during the TLS
+  // handshake. If not set, the underlying SSL library will use TLS v1.3.
+  // @param tls_version: The maximum TLS version.
+  void set_max_tls_version(grpc_tls_version tls_version);
+
   // ----- Getters for member fields ----
   // Get the internal c options. This function shall be used only internally.
   grpc_tls_credentials_options* c_credentials_options() const {

package.xml

@@ -13,16 +13,16 @@
  <date>2019-09-24</date>
  <time>16:06:07</time>
  <version>
-  <release>1.49.0dev</release>
-  <api>1.49.0dev</api>
+  <release>1.49.4</release>
+  <api>1.49.4</api>
  </version>
  <stability>
-  <release>beta</release>
-  <api>beta</api>
+  <release>stable</release>
+  <api>stable</api>
  </stability>
  <license>Apache 2.0</license>
  <notes>
-- gRPC Core 1.49.0 update
+- gRPC Core 1.49.4 update
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">

setup.py

@@ -105,6 +105,7 @@ CLASSIFIERS = [
     'Programming Language :: Python :: 3.8',
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
+    'Programming Language :: Python :: 3.11',
     'License :: OSI Approved :: Apache Software License',
 ]
 

src/boringssl/boringssl_prefix_symbols.h

@@ -1,4 +1,4 @@
-// generated by generate_boringssl_prefix_header.sh on BoringSSL commit: b9232f9e27e5668bc0414879dcdedb2a59ea75f2
+// generated by generate_boringssl_prefix_header.sh on BoringSSL commit: 6195bf8242156c9a2fa75702eee058f91b86a88b
 
 // Copyright (c) 2018, Google Inc.
 //

src/core/ext/filters/client_channel/client_channel.cc

@@ -737,10 +737,14 @@ void ClientChannel::ExternalConnectivityWatcher::Notify(
   // Hop back into the work_serializer to clean up.
   // Not needed in state SHUTDOWN, because the tracker will
   // automatically remove all watchers in that case.
+  // Note: The callback takes a ref in case the ref inside the state tracker
+  // gets removed before the callback runs via a SHUTDOWN notification.
   if (state != GRPC_CHANNEL_SHUTDOWN) {
+    Ref(DEBUG_LOCATION, "RemoveWatcherLocked()").release();
     chand_->work_serializer_->Run(
         [this]() ABSL_EXCLUSIVE_LOCKS_REQUIRED(*chand_->work_serializer_) {
           RemoveWatcherLocked();
+          Unref(DEBUG_LOCATION, "RemoveWatcherLocked()");
         },
         DEBUG_LOCATION);
   }
@@ -754,9 +758,13 @@ void ClientChannel::ExternalConnectivityWatcher::Cancel() {
   }
   ExecCtx::Run(DEBUG_LOCATION, on_complete_, GRPC_ERROR_CANCELLED);
   // Hop back into the work_serializer to clean up.
+  // Note: The callback takes a ref in case the ref inside the state tracker
+  // gets removed before the callback runs via a SHUTDOWN notification.
+  Ref(DEBUG_LOCATION, "RemoveWatcherLocked()").release();
   chand_->work_serializer_->Run(
       [this]() ABSL_EXCLUSIVE_LOCKS_REQUIRED(*chand_->work_serializer_) {
         RemoveWatcherLocked();
+        Unref(DEBUG_LOCATION, "RemoveWatcherLocked()");
       },
       DEBUG_LOCATION);
 }

src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.cc

@@ -219,7 +219,6 @@ class GrpcLb : public LoadBalancingPolicy {
     void SendClientLoadReportLocked();
 
     // EventEngine callbacks
-    void MaybeSendClientLoadReport();
     void MaybeSendClientLoadReportLocked();
 
     static void ClientLoadReportDone(void* arg, grpc_error_handle error);
@@ -996,15 +995,11 @@ void GrpcLb::BalancerCallState::ScheduleNextClientLoadReportLocked() {
       GetDefaultEventEngine()->RunAfter(client_stats_report_interval_, [this] {
         ApplicationCallbackExecCtx callback_exec_ctx;
         ExecCtx exec_ctx;
-        MaybeSendClientLoadReport();
+        grpclb_policy()->work_serializer()->Run(
+            [this] { MaybeSendClientLoadReportLocked(); }, DEBUG_LOCATION);
       });
 }
 
-void GrpcLb::BalancerCallState::MaybeSendClientLoadReport() {
-  grpclb_policy()->work_serializer()->Run(
-      [this] { MaybeSendClientLoadReportLocked(); }, DEBUG_LOCATION);
-}
-
 void GrpcLb::BalancerCallState::MaybeSendClientLoadReportLocked() {
   client_load_report_handle_.reset();
   if (this != grpclb_policy()->lb_calld_.get()) {

src/core/ext/filters/client_channel/lb_policy/outlier_detection/outlier_detection.cc

@@ -649,6 +649,12 @@ void OutlierDetectionLb::UpdateLocked(UpdateArgs args) {
         }
       } else if (!config_->CountingEnabled()) {
         // If counting is not enabled, reset state.
+        if (GRPC_TRACE_FLAG_ENABLED(grpc_outlier_detection_lb_trace)) {
+          gpr_log(GPR_INFO,
+                  "[outlier_detection_lb %p] counting disabled; disabling "
+                  "ejection for %s (%p)",
+                  this, address_key.c_str(), subchannel_state.get());
+        }
         subchannel_state->DisableEjection();
       }
       current_addresses.emplace(address_key);

src/core/ext/filters/client_channel/lb_policy/pick_first/pick_first.cc

@@ -162,9 +162,9 @@ class PickFirst : public LoadBalancingPolicy {
   // Lateset update args.
   UpdateArgs latest_update_args_;
   // All our subchannels.
-  OrphanablePtr<PickFirstSubchannelList> subchannel_list_;
+  RefCountedPtr<PickFirstSubchannelList> subchannel_list_;
   // Latest pending subchannel list.
-  OrphanablePtr<PickFirstSubchannelList> latest_pending_subchannel_list_;
+  RefCountedPtr<PickFirstSubchannelList> latest_pending_subchannel_list_;
   // Selected subchannel in \a subchannel_list_.
   PickFirstSubchannelData* selected_ = nullptr;
   // Are we in IDLE state?
@@ -227,7 +227,7 @@ void PickFirst::AttemptToConnectUsingLatestUpdateArgsLocked() {
             "[PF %p] Shutting down previous pending subchannel list %p", this,
             latest_pending_subchannel_list_.get());
   }
-  latest_pending_subchannel_list_ = MakeOrphanable<PickFirstSubchannelList>(
+  latest_pending_subchannel_list_ = MakeRefCounted<PickFirstSubchannelList>(
       this, std::move(addresses), latest_update_args_.args);
   latest_pending_subchannel_list_->StartWatchingLocked();
   // Empty update or no valid subchannels.  Put the channel in

src/core/ext/filters/client_channel/lb_policy/ring_hash/ring_hash.cc

@@ -56,7 +56,6 @@
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/orphanable.h"
-#include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/gprpp/unique_type_name.h"
@@ -160,9 +159,8 @@ class RingHash : public LoadBalancingPolicy {
  private:
   ~RingHash() override;
 
-  // Forward declarations.
+  // Forward declaration.
   class RingHashSubchannelList;
-  class Ring;
 
   // Data for a particular subchannel in a subchannel list.
   // This subclass adds the following functionality:
@@ -211,32 +209,25 @@ class RingHash : public LoadBalancingPolicy {
     absl::Status connectivity_status_ ABSL_GUARDED_BY(&mu_);
   };
 
-  // A list of subchannels.
+  // A list of subchannels and the ring containing those subchannels.
   class RingHashSubchannelList
       : public SubchannelList<RingHashSubchannelList, RingHashSubchannelData> {
    public:
+    struct RingEntry {
+      uint64_t hash;
+      RingHashSubchannelData* subchannel;
+    };
+
     RingHashSubchannelList(RingHash* policy, ServerAddressList addresses,
-                           const ChannelArgs& args)
-        : SubchannelList(policy,
-                         (GRPC_TRACE_FLAG_ENABLED(grpc_lb_ring_hash_trace)
-                              ? "RingHashSubchannelList"
-                              : nullptr),
-                         std::move(addresses), policy->channel_control_helper(),
-                         args),
-          num_idle_(num_subchannels()),
-          ring_(MakeRefCounted<Ring>(policy, Ref(DEBUG_LOCATION, "Ring"))) {
-      // Need to maintain a ref to the LB policy as long as we maintain
-      // any references to subchannels, since the subchannels'
-      // pollset_sets will include the LB policy's pollset_set.
-      policy->Ref(DEBUG_LOCATION, "subchannel_list").release();
-    }
+                           const ChannelArgs& args);
 
     ~RingHashSubchannelList() override {
-      ring_.reset(DEBUG_LOCATION, "~RingHashSubchannelList");
       RingHash* p = static_cast<RingHash*>(policy());
       p->Unref(DEBUG_LOCATION, "subchannel_list");
     }
 
+    const std::vector<RingEntry>& ring() const { return ring_; }
+
     // Updates the counters of subchannels in each state when a
     // subchannel transitions from old_state to new_state.
     void UpdateStateCountersLocked(grpc_connectivity_state old_state,
@@ -261,17 +252,12 @@ class RingHash : public LoadBalancingPolicy {
       return true;
     }
 
-    void ShutdownLocked() override {
-      ring_.reset(DEBUG_LOCATION, "RingHashSubchannelList::ShutdownLocked()");
-      SubchannelList::ShutdownLocked();
-    }
-
     size_t num_idle_;
     size_t num_ready_ = 0;
     size_t num_connecting_ = 0;
     size_t num_transient_failure_ = 0;
 
-    RefCountedPtr<Ring> ring_;
+    std::vector<RingEntry> ring_;
 
     // The index of the subchannel currently doing an internally
     // triggered connection attempt, if any.
@@ -284,73 +270,83 @@ class RingHash : public LoadBalancingPolicy {
     absl::Status last_failure_;
   };
 
-  class Ring : public RefCounted<Ring> {
-   public:
-    struct Entry {
-      uint64_t hash;
-      RingHashSubchannelData* subchannel;
-    };
-
-    Ring(RingHash* parent,
-         RefCountedPtr<RingHashSubchannelList> subchannel_list);
-
-    const std::vector<Entry>& ring() const { return ring_; }
-
-   private:
-    RefCountedPtr<RingHashSubchannelList> subchannel_list_;
-    std::vector<Entry> ring_;
-  };
-
   class Picker : public SubchannelPicker {
    public:
-    Picker(RefCountedPtr<RingHash> parent, RefCountedPtr<Ring> ring)
-        : parent_(std::move(parent)), ring_(std::move(ring)) {}
+    explicit Picker(RefCountedPtr<RingHashSubchannelList> subchannel_list)
+        : subchannel_list_(std::move(subchannel_list)) {}
+
+    ~Picker() override {
+      // Hop into WorkSerializer to unref the subchannel list, since that may
+      // trigger the unreffing of the underlying subchannels.
+      MakeOrphanable<WorkSerializerRunner>(std::move(subchannel_list_));
+    }
 
     PickResult Pick(PickArgs args) override;
 
    private:
-    // A fire-and-forget class that schedules subchannel connection attempts
-    // on the control plane WorkSerializer.
-    class SubchannelConnectionAttempter : public Orphanable {
+    // An interface for running a callback in the control plane WorkSerializer.
+    class WorkSerializerRunner : public Orphanable {
      public:
-      explicit SubchannelConnectionAttempter(
-          RefCountedPtr<RingHash> ring_hash_lb)
-          : ring_hash_lb_(std::move(ring_hash_lb)) {
+      explicit WorkSerializerRunner(
+          RefCountedPtr<RingHashSubchannelList> subchannel_list)
+          : subchannel_list_(std::move(subchannel_list)) {
         GRPC_CLOSURE_INIT(&closure_, RunInExecCtx, this, nullptr);
       }
 
-      void AddSubchannel(RefCountedPtr<SubchannelInterface> subchannel) {
-        subchannels_.push_back(std::move(subchannel));
-      }
-
       void Orphan() override {
         // Hop into ExecCtx, so that we're not holding the data plane mutex
         // while we run control-plane code.
         ExecCtx::Run(DEBUG_LOCATION, &closure_, GRPC_ERROR_NONE);
       }
 
+      // Will be invoked inside of the WorkSerializer.
+      virtual void Run() {}
+
+     protected:
+      RingHash* ring_hash_lb() const {
+        return static_cast<RingHash*>(subchannel_list_->policy());
+      }
+
      private:
       static void RunInExecCtx(void* arg, grpc_error_handle /*error*/) {
-        auto* self = static_cast<SubchannelConnectionAttempter*>(arg);
-        self->ring_hash_lb_->work_serializer()->Run(
+        auto* self = static_cast<WorkSerializerRunner*>(arg);
+        self->ring_hash_lb()->work_serializer()->Run(
             [self]() {
-              if (!self->ring_hash_lb_->shutdown_) {
-                for (auto& subchannel : self->subchannels_) {
-                  subchannel->RequestConnection();
-                }
-              }
+              self->Run();
               delete self;
             },
             DEBUG_LOCATION);
       }
 
-      RefCountedPtr<RingHash> ring_hash_lb_;
+      RefCountedPtr<RingHashSubchannelList> subchannel_list_;
       grpc_closure closure_;
+    };
+
+    // A fire-and-forget class that schedules subchannel connection attempts
+    // on the control plane WorkSerializer.
+    class SubchannelConnectionAttempter : public WorkSerializerRunner {
+     public:
+      explicit SubchannelConnectionAttempter(
+          RefCountedPtr<RingHashSubchannelList> subchannel_list)
+          : WorkSerializerRunner(std::move(subchannel_list)) {}
+
+      void AddSubchannel(RefCountedPtr<SubchannelInterface> subchannel) {
+        subchannels_.push_back(std::move(subchannel));
+      }
+
+      void Run() override {
+        if (!ring_hash_lb()->shutdown_) {
+          for (auto& subchannel : subchannels_) {
+            subchannel->RequestConnection();
+          }
+        }
+      }
+
+     private:
       std::vector<RefCountedPtr<SubchannelInterface>> subchannels_;
     };
 
-    RefCountedPtr<RingHash> parent_;
-    RefCountedPtr<Ring> ring_;
+    RefCountedPtr<RingHashSubchannelList> subchannel_list_;
   };
 
   void ShutdownLocked() override;
@@ -359,117 +355,12 @@ class RingHash : public LoadBalancingPolicy {
   RefCountedPtr<RingHashLbConfig> config_;
 
   // list of subchannels.
-  OrphanablePtr<RingHashSubchannelList> subchannel_list_;
-  OrphanablePtr<RingHashSubchannelList> latest_pending_subchannel_list_;
+  RefCountedPtr<RingHashSubchannelList> subchannel_list_;
+  RefCountedPtr<RingHashSubchannelList> latest_pending_subchannel_list_;
   // indicating if we are shutting down.
   bool shutdown_ = false;
 };
 
-//
-// RingHash::Ring
-//
-
-RingHash::Ring::Ring(RingHash* parent,
-                     RefCountedPtr<RingHashSubchannelList> subchannel_list)
-    : subchannel_list_(std::move(subchannel_list)) {
-  size_t num_subchannels = subchannel_list_->num_subchannels();
-  // Store the weights while finding the sum.
-  struct AddressWeight {
-    std::string address;
-    // Default weight is 1 for the cases where a weight is not provided,
-    // each occurrence of the address will be counted a weight value of 1.
-    uint32_t weight = 1;
-    double normalized_weight;
-  };
-  std::vector<AddressWeight> address_weights;
-  size_t sum = 0;
-  address_weights.reserve(num_subchannels);
-  for (size_t i = 0; i < num_subchannels; ++i) {
-    RingHashSubchannelData* sd = subchannel_list_->subchannel(i);
-    const ServerAddressWeightAttribute* weight_attribute = static_cast<
-        const ServerAddressWeightAttribute*>(sd->address().GetAttribute(
-        ServerAddressWeightAttribute::kServerAddressWeightAttributeKey));
-    AddressWeight address_weight;
-    address_weight.address =
-        grpc_sockaddr_to_string(&sd->address().address(), false).value();
-    // Weight should never be zero, but ignore it just in case, since
-    // that value would screw up the ring-building algorithm.
-    if (weight_attribute != nullptr && weight_attribute->weight() > 0) {
-      address_weight.weight = weight_attribute->weight();
-    }
-    sum += address_weight.weight;
-    address_weights.push_back(std::move(address_weight));
-  }
-  // Calculating normalized weights and find min and max.
-  double min_normalized_weight = 1.0;
-  double max_normalized_weight = 0.0;
-  for (auto& address : address_weights) {
-    address.normalized_weight = static_cast<double>(address.weight) / sum;
-    min_normalized_weight =
-        std::min(address.normalized_weight, min_normalized_weight);
-    max_normalized_weight =
-        std::max(address.normalized_weight, max_normalized_weight);
-  }
-  // Scale up the number of hashes per host such that the least-weighted host
-  // gets a whole number of hashes on the ring. Other hosts might not end up
-  // with whole numbers, and that's fine (the ring-building algorithm below can
-  // handle this). This preserves the original implementation's behavior: when
-  // weights aren't provided, all hosts should get an equal number of hashes. In
-  // the case where this number exceeds the max_ring_size, it's scaled back down
-  // to fit.
-  const size_t min_ring_size = parent->config_->min_ring_size();
-  const size_t max_ring_size = parent->config_->max_ring_size();
-  const double scale = std::min(
-      std::ceil(min_normalized_weight * min_ring_size) / min_normalized_weight,
-      static_cast<double>(max_ring_size));
-  // Reserve memory for the entire ring up front.
-  const size_t ring_size = std::ceil(scale);
-  ring_.reserve(ring_size);
-  // Populate the hash ring by walking through the (host, weight) pairs in
-  // normalized_host_weights, and generating (scale * weight) hashes for each
-  // host. Since these aren't necessarily whole numbers, we maintain running
-  // sums -- current_hashes and target_hashes -- which allows us to populate the
-  // ring in a mostly stable way.
-  absl::InlinedVector<char, 196> hash_key_buffer;
-  double current_hashes = 0.0;
-  double target_hashes = 0.0;
-  uint64_t min_hashes_per_host = ring_size;
-  uint64_t max_hashes_per_host = 0;
-  for (size_t i = 0; i < num_subchannels; ++i) {
-    const std::string& address_string = address_weights[i].address;
-    hash_key_buffer.assign(address_string.begin(), address_string.end());
-    hash_key_buffer.emplace_back('_');
-    auto offset_start = hash_key_buffer.end();
-    target_hashes += scale * address_weights[i].normalized_weight;
-    size_t count = 0;
-    while (current_hashes < target_hashes) {
-      const std::string count_str = absl::StrCat(count);
-      hash_key_buffer.insert(offset_start, count_str.begin(), count_str.end());
-      absl::string_view hash_key(hash_key_buffer.data(),
-                                 hash_key_buffer.size());
-      const uint64_t hash = XXH64(hash_key.data(), hash_key.size(), 0);
-      ring_.push_back({hash, subchannel_list_->subchannel(i)});
-      ++count;
-      ++current_hashes;
-      hash_key_buffer.erase(offset_start, hash_key_buffer.end());
-    }
-    min_hashes_per_host =
-        std::min(static_cast<uint64_t>(i), min_hashes_per_host);
-    max_hashes_per_host =
-        std::max(static_cast<uint64_t>(i), max_hashes_per_host);
-  }
-  std::sort(ring_.begin(), ring_.end(),
-            [](const Entry& lhs, const Entry& rhs) -> bool {
-              return lhs.hash < rhs.hash;
-            });
-  if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_ring_hash_trace)) {
-    gpr_log(GPR_INFO,
-            "[RH %p picker %p] created ring from subchannel_list=%p "
-            "with %" PRIuPTR " ring entries",
-            parent, this, subchannel_list_.get(), ring_.size());
-  }
-}
-
 //
 // RingHash::Picker
 //
@@ -483,7 +374,7 @@ RingHash::PickResult RingHash::Picker::Pick(PickArgs args) {
     return PickResult::Fail(
         absl::InternalError("ring hash value is not a number"));
   }
-  const std::vector<Ring::Entry>& ring = ring_->ring();
+  const auto& ring = subchannel_list_->ring();
   // Ported from https://github.com/RJ/ketama/blob/master/libketama/ketama.c
   // (ketama_get_server) NOTE: The algorithm depends on using signed integers
   // for lowp, highp, and first_index. Do not change them!
@@ -516,7 +407,9 @@ RingHash::PickResult RingHash::Picker::Pick(PickArgs args) {
       [&](RefCountedPtr<SubchannelInterface> subchannel) {
         if (subchannel_connection_attempter == nullptr) {
           subchannel_connection_attempter =
-              MakeOrphanable<SubchannelConnectionAttempter>(parent_);
+              MakeOrphanable<SubchannelConnectionAttempter>(
+                  subchannel_list_->Ref(DEBUG_LOCATION,
+                                        "SubchannelConnectionAttempter"));
         }
         subchannel_connection_attempter->AddSubchannel(std::move(subchannel));
       };
@@ -541,7 +434,7 @@ RingHash::PickResult RingHash::Picker::Pick(PickArgs args) {
   bool found_second_subchannel = false;
   bool found_first_non_failed = false;
   for (size_t i = 1; i < ring.size(); ++i) {
-    const Ring::Entry& entry = ring[(first_index + i) % ring.size()];
+    const auto& entry = ring[(first_index + i) % ring.size()];
     if (entry.subchannel == ring[first_index].subchannel) {
       continue;
     }
@@ -585,6 +478,117 @@ RingHash::PickResult RingHash::Picker::Pick(PickArgs args) {
 // RingHash::RingHashSubchannelList
 //
 
+RingHash::RingHashSubchannelList::RingHashSubchannelList(
+    RingHash* policy, ServerAddressList addresses, const ChannelArgs& args)
+    : SubchannelList(policy,
+                     (GRPC_TRACE_FLAG_ENABLED(grpc_lb_ring_hash_trace)
+                          ? "RingHashSubchannelList"
+                          : nullptr),
+                     std::move(addresses), policy->channel_control_helper(),
+                     args),
+      num_idle_(num_subchannels()) {
+  // Need to maintain a ref to the LB policy as long as we maintain
+  // any references to subchannels, since the subchannels'
+  // pollset_sets will include the LB policy's pollset_set.
+  policy->Ref(DEBUG_LOCATION, "subchannel_list").release();
+  // Construct the ring.
+  // Store the weights while finding the sum.
+  struct AddressWeight {
+    std::string address;
+    // Default weight is 1 for the cases where a weight is not provided,
+    // each occurrence of the address will be counted a weight value of 1.
+    uint32_t weight = 1;
+    double normalized_weight;
+  };
+  std::vector<AddressWeight> address_weights;
+  size_t sum = 0;
+  address_weights.reserve(num_subchannels());
+  for (size_t i = 0; i < num_subchannels(); ++i) {
+    RingHashSubchannelData* sd = subchannel(i);
+    const ServerAddressWeightAttribute* weight_attribute = static_cast<
+        const ServerAddressWeightAttribute*>(sd->address().GetAttribute(
+        ServerAddressWeightAttribute::kServerAddressWeightAttributeKey));
+    AddressWeight address_weight;
+    address_weight.address =
+        grpc_sockaddr_to_string(&sd->address().address(), false).value();
+    // Weight should never be zero, but ignore it just in case, since
+    // that value would screw up the ring-building algorithm.
+    if (weight_attribute != nullptr && weight_attribute->weight() > 0) {
+      address_weight.weight = weight_attribute->weight();
+    }
+    sum += address_weight.weight;
+    address_weights.push_back(std::move(address_weight));
+  }
+  // Calculating normalized weights and find min and max.
+  double min_normalized_weight = 1.0;
+  double max_normalized_weight = 0.0;
+  for (auto& address : address_weights) {
+    address.normalized_weight = static_cast<double>(address.weight) / sum;
+    min_normalized_weight =
+        std::min(address.normalized_weight, min_normalized_weight);
+    max_normalized_weight =
+        std::max(address.normalized_weight, max_normalized_weight);
+  }
+  // Scale up the number of hashes per host such that the least-weighted host
+  // gets a whole number of hashes on the ring. Other hosts might not end up
+  // with whole numbers, and that's fine (the ring-building algorithm below can
+  // handle this). This preserves the original implementation's behavior: when
+  // weights aren't provided, all hosts should get an equal number of hashes. In
+  // the case where this number exceeds the max_ring_size, it's scaled back down
+  // to fit.
+  const size_t min_ring_size = policy->config_->min_ring_size();
+  const size_t max_ring_size = policy->config_->max_ring_size();
+  const double scale = std::min(
+      std::ceil(min_normalized_weight * min_ring_size) / min_normalized_weight,
+      static_cast<double>(max_ring_size));
+  // Reserve memory for the entire ring up front.
+  const size_t ring_size = std::ceil(scale);
+  ring_.reserve(ring_size);
+  // Populate the hash ring by walking through the (host, weight) pairs in
+  // normalized_host_weights, and generating (scale * weight) hashes for each
+  // host. Since these aren't necessarily whole numbers, we maintain running
+  // sums -- current_hashes and target_hashes -- which allows us to populate the
+  // ring in a mostly stable way.
+  absl::InlinedVector<char, 196> hash_key_buffer;
+  double current_hashes = 0.0;
+  double target_hashes = 0.0;
+  uint64_t min_hashes_per_host = ring_size;
+  uint64_t max_hashes_per_host = 0;
+  for (size_t i = 0; i < num_subchannels(); ++i) {
+    const std::string& address_string = address_weights[i].address;
+    hash_key_buffer.assign(address_string.begin(), address_string.end());
+    hash_key_buffer.emplace_back('_');
+    auto offset_start = hash_key_buffer.end();
+    target_hashes += scale * address_weights[i].normalized_weight;
+    size_t count = 0;
+    while (current_hashes < target_hashes) {
+      const std::string count_str = absl::StrCat(count);
+      hash_key_buffer.insert(offset_start, count_str.begin(), count_str.end());
+      absl::string_view hash_key(hash_key_buffer.data(),
+                                 hash_key_buffer.size());
+      const uint64_t hash = XXH64(hash_key.data(), hash_key.size(), 0);
+      ring_.push_back({hash, subchannel(i)});
+      ++count;
+      ++current_hashes;
+      hash_key_buffer.erase(offset_start, hash_key_buffer.end());
+    }
+    min_hashes_per_host =
+        std::min(static_cast<uint64_t>(i), min_hashes_per_host);
+    max_hashes_per_host =
+        std::max(static_cast<uint64_t>(i), max_hashes_per_host);
+  }
+  std::sort(ring_.begin(), ring_.end(),
+            [](const RingHashSubchannelList::RingEntry& lhs,
+               const RingHashSubchannelList::RingEntry& rhs) -> bool {
+              return lhs.hash < rhs.hash;
+            });
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_lb_ring_hash_trace)) {
+    gpr_log(GPR_INFO,
+            "[RH %p] created subchannel list %p with %" PRIuPTR " ring entries",
+            policy, this, ring_.size());
+  }
+}
+
 void RingHash::RingHashSubchannelList::UpdateStateCountersLocked(
     grpc_connectivity_state old_state, grpc_connectivity_state new_state) {
   if (old_state == GRPC_CHANNEL_IDLE) {
@@ -673,8 +677,7 @@ void RingHash::RingHashSubchannelList::UpdateRingHashConnectivityStateLocked(
   // Note that we use our own picker regardless of connectivity state.
   p->channel_control_helper()->UpdateState(
       state, status,
-      absl::make_unique<Picker>(p->Ref(DEBUG_LOCATION, "RingHashPicker"),
-                                ring_));
+      absl::make_unique<Picker>(Ref(DEBUG_LOCATION, "RingHashPicker")));
   // While the ring_hash policy is reporting TRANSIENT_FAILURE, it will
   // not be getting any pick requests from the priority policy.
   // However, because the ring_hash policy does not attempt to
@@ -836,7 +839,7 @@ void RingHash::UpdateLocked(UpdateArgs args) {
     gpr_log(GPR_INFO, "[RH %p] replacing latest pending subchannel list %p",
             this, latest_pending_subchannel_list_.get());
   }
-  latest_pending_subchannel_list_ = MakeOrphanable<RingHashSubchannelList>(
+  latest_pending_subchannel_list_ = MakeRefCounted<RingHashSubchannelList>(
       this, std::move(addresses), args.args);
   latest_pending_subchannel_list_->StartWatchingLocked();
   // If we have no existing list or the new list is empty, immediately

src/core/ext/filters/client_channel/lb_policy/round_robin/round_robin.cc

@@ -182,12 +182,12 @@ class RoundRobin : public LoadBalancingPolicy {
   void ShutdownLocked() override;
 
   // List of subchannels.
-  OrphanablePtr<RoundRobinSubchannelList> subchannel_list_;
+  RefCountedPtr<RoundRobinSubchannelList> subchannel_list_;
   // Latest pending subchannel list.
   // When we get an updated address list, we create a new subchannel list
   // for it here, and we wait to swap it into subchannel_list_ until the new
   // list becomes READY.
-  OrphanablePtr<RoundRobinSubchannelList> latest_pending_subchannel_list_;
+  RefCountedPtr<RoundRobinSubchannelList> latest_pending_subchannel_list_;
 
   bool shutdown_ = false;
 };
@@ -288,7 +288,7 @@ void RoundRobin::UpdateLocked(UpdateArgs args) {
     gpr_log(GPR_INFO, "[RR %p] replacing previous pending subchannel list %p",
             this, latest_pending_subchannel_list_.get());
   }
-  latest_pending_subchannel_list_ = MakeOrphanable<RoundRobinSubchannelList>(
+  latest_pending_subchannel_list_ = MakeRefCounted<RoundRobinSubchannelList>(
       this, std::move(addresses), args.args);
   latest_pending_subchannel_list_->StartWatchingLocked();
   // If the new list is empty, immediately promote it to

src/core/ext/filters/client_channel/lb_policy/subchannel_list.h

@@ -35,8 +35,8 @@
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/debug_location.h"
+#include "src/core/lib/gprpp/dual_ref_counted.h"
 #include "src/core/lib/gprpp/manual_constructor.h"
-#include "src/core/lib/gprpp/orphanable.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/load_balancing/lb_policy.h"
@@ -131,7 +131,7 @@ class SubchannelData {
    public:
     Watcher(
         SubchannelData<SubchannelListType, SubchannelDataType>* subchannel_data,
-        RefCountedPtr<SubchannelListType> subchannel_list)
+        WeakRefCountedPtr<SubchannelListType> subchannel_list)
         : subchannel_data_(subchannel_data),
           subchannel_list_(std::move(subchannel_list)) {}
 
@@ -148,7 +148,7 @@ class SubchannelData {
 
    private:
     SubchannelData<SubchannelListType, SubchannelDataType>* subchannel_data_;
-    RefCountedPtr<SubchannelListType> subchannel_list_;
+    WeakRefCountedPtr<SubchannelListType> subchannel_list_;
   };
 
   // Starts watching the connectivity state of the subchannel.
@@ -176,7 +176,7 @@ class SubchannelData {
 
 // A list of subchannels.
 template <typename SubchannelListType, typename SubchannelDataType>
-class SubchannelList : public InternallyRefCounted<SubchannelListType> {
+class SubchannelList : public DualRefCounted<SubchannelListType> {
  public:
   // Starts watching the connectivity state of all subchannels.
   // Must be called immediately after instantiation.
@@ -200,10 +200,7 @@ class SubchannelList : public InternallyRefCounted<SubchannelListType> {
   // Resets connection backoff of all subchannels.
   void ResetBackoffLocked();
 
-  void Orphan() override {
-    ShutdownLocked();
-    InternallyRefCounted<SubchannelListType>::Unref(DEBUG_LOCATION, "shutdown");
-  }
+  void Orphan() override;
 
  protected:
   SubchannelList(LoadBalancingPolicy* policy, const char* tracer,
@@ -213,8 +210,6 @@ class SubchannelList : public InternallyRefCounted<SubchannelListType> {
 
   virtual ~SubchannelList();
 
-  virtual void ShutdownLocked();
-
  private:
   // For accessing Ref() and Unref().
   friend class SubchannelData<SubchannelListType, SubchannelDataType>;
@@ -327,7 +322,7 @@ void SubchannelData<SubchannelListType,
   }
   GPR_ASSERT(pending_watcher_ == nullptr);
   pending_watcher_ =
-      new Watcher(this, subchannel_list()->Ref(DEBUG_LOCATION, "Watcher"));
+      new Watcher(this, subchannel_list()->WeakRef(DEBUG_LOCATION, "Watcher"));
   subchannel_->WatchConnectivityState(
       std::unique_ptr<SubchannelInterface::ConnectivityStateWatcherInterface>(
           pending_watcher_));
@@ -365,7 +360,7 @@ SubchannelList<SubchannelListType, SubchannelDataType>::SubchannelList(
     LoadBalancingPolicy* policy, const char* tracer,
     ServerAddressList addresses,
     LoadBalancingPolicy::ChannelControlHelper* helper, const ChannelArgs& args)
-    : InternallyRefCounted<SubchannelListType>(tracer),
+    : DualRefCounted<SubchannelListType>(tracer),
       policy_(policy),
       tracer_(tracer) {
   if (GPR_UNLIKELY(tracer_ != nullptr)) {
@@ -419,7 +414,7 @@ void SubchannelList<SubchannelListType,
 }
 
 template <typename SubchannelListType, typename SubchannelDataType>
-void SubchannelList<SubchannelListType, SubchannelDataType>::ShutdownLocked() {
+void SubchannelList<SubchannelListType, SubchannelDataType>::Orphan() {
   if (GPR_UNLIKELY(tracer_ != nullptr)) {
     gpr_log(GPR_INFO, "[%s %p] Shutting down subchannel_list %p", tracer_,
             policy_, this);

src/core/ext/filters/client_channel/lb_policy/weighted_target/weighted_target.cc

@@ -50,6 +50,7 @@
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/time.h"
 #include "src/core/lib/gprpp/work_serializer.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/pollset_set.h"
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/load_balancing/lb_policy.h"
@@ -456,6 +457,8 @@ WeightedTargetLb::WeightedChild::DelayedRemovalTimer::DelayedRemovalTimer(
     : weighted_child_(std::move(weighted_child)) {
   timer_handle_ = GetDefaultEventEngine()->RunAfter(
       kChildRetentionInterval, [self = Ref()]() mutable {
+        ApplicationCallbackExecCtx app_exec_ctx;
+        ExecCtx exec_ctx;
         self->weighted_child_->weighted_target_policy_->work_serializer()->Run(
             [self = std::move(self)] { self->OnTimerLocked(); },
             DEBUG_LOCATION);

src/core/ext/filters/client_channel/resolver/google_c2p/google_c2p_resolver.cc

@@ -414,15 +414,35 @@ void GoogleCloud2ProdResolver::StartXdsResolver() {
 
 class GoogleCloud2ProdResolverFactory : public ResolverFactory {
  public:
-  // TODO(roth): Remove experimental suffix once this code is proven stable,
-  // and update the scheme in google_c2p_resolver_test.cc when doing so.
+  absl::string_view scheme() const override { return "google-c2p"; }
+
+  bool IsValidUri(const URI& uri) const override {
+    if (GPR_UNLIKELY(!uri.authority().empty())) {
+      gpr_log(GPR_ERROR, "google-c2p URI scheme does not support authorities");
+      return false;
+    }
+    return true;
+  }
+
+  OrphanablePtr<Resolver> CreateResolver(ResolverArgs args) const override {
+    if (!IsValidUri(args.uri)) return nullptr;
+    return MakeOrphanable<GoogleCloud2ProdResolver>(std::move(args));
+  }
+};
+
+// TODO(apolcyn): remove this class after user code has updated to the
+// stable "google-c2p" URI scheme.
+class ExperimentalGoogleCloud2ProdResolverFactory : public ResolverFactory {
+ public:
   absl::string_view scheme() const override {
     return "google-c2p-experimental";
   }
 
   bool IsValidUri(const URI& uri) const override {
     if (GPR_UNLIKELY(!uri.authority().empty())) {
-      gpr_log(GPR_ERROR, "google-c2p URI scheme does not support authorities");
+      gpr_log(
+          GPR_ERROR,
+          "google-c2p-experimental URI scheme does not support authorities");
       return false;
     }
     return true;
@@ -439,6 +459,8 @@ class GoogleCloud2ProdResolverFactory : public ResolverFactory {
 void RegisterCloud2ProdResolver(CoreConfiguration::Builder* builder) {
   builder->resolver_registry()->RegisterResolverFactory(
       absl::make_unique<GoogleCloud2ProdResolverFactory>());
+  builder->resolver_registry()->RegisterResolverFactory(
+      absl::make_unique<ExperimentalGoogleCloud2ProdResolverFactory>());
 }
 
 }  // namespace grpc_core

src/core/lib/event_engine/forkable.cc

@@ -22,15 +22,17 @@
 
 #include "absl/container/flat_hash_set.h"
 
+#include "src/core/lib/gprpp/no_destruct.h"
 #include "src/core/lib/gprpp/sync.h"
 
 namespace grpc_event_engine {
 namespace experimental {
 
 namespace {
-grpc_core::Mutex g_mu;
-bool g_registered{false};
-absl::flat_hash_set<Forkable*> g_forkables;
+grpc_core::NoDestruct<grpc_core::Mutex> g_mu;
+bool g_registered ABSL_GUARDED_BY(g_mu){false};
+grpc_core::NoDestruct<absl::flat_hash_set<Forkable*>> g_forkables
+    ABSL_GUARDED_BY(g_mu);
 }  // namespace
 
 Forkable::Forkable() { ManageForkable(this); }
@@ -38,39 +40,40 @@ Forkable::Forkable() { ManageForkable(this); }
 Forkable::~Forkable() { StopManagingForkable(this); }
 
 void RegisterForkHandlers() {
-  grpc_core::MutexLock lock(&g_mu);
-  GPR_ASSERT(!absl::exchange(g_registered, true));
-  pthread_atfork(PrepareFork, PostforkParent, PostforkChild);
+  grpc_core::MutexLock lock(g_mu.get());
+  if (!absl::exchange(g_registered, true)) {
+    pthread_atfork(PrepareFork, PostforkParent, PostforkChild);
+  }
 };
 
 void PrepareFork() {
-  grpc_core::MutexLock lock(&g_mu);
-  for (auto* forkable : g_forkables) {
+  grpc_core::MutexLock lock(g_mu.get());
+  for (auto* forkable : *g_forkables) {
     forkable->PrepareFork();
   }
 }
 void PostforkParent() {
-  grpc_core::MutexLock lock(&g_mu);
-  for (auto* forkable : g_forkables) {
+  grpc_core::MutexLock lock(g_mu.get());
+  for (auto* forkable : *g_forkables) {
     forkable->PostforkParent();
   }
 }
 
 void PostforkChild() {
-  grpc_core::MutexLock lock(&g_mu);
-  for (auto* forkable : g_forkables) {
+  grpc_core::MutexLock lock(g_mu.get());
+  for (auto* forkable : *g_forkables) {
     forkable->PostforkChild();
   }
 }
 
 void ManageForkable(Forkable* forkable) {
-  grpc_core::MutexLock lock(&g_mu);
-  g_forkables.insert(forkable);
+  grpc_core::MutexLock lock(g_mu.get());
+  g_forkables->insert(forkable);
 }
 
 void StopManagingForkable(Forkable* forkable) {
-  grpc_core::MutexLock lock(&g_mu);
-  g_forkables.erase(forkable);
+  grpc_core::MutexLock lock(g_mu.get());
+  g_forkables->erase(forkable);
 }
 
 }  // namespace experimental

src/core/lib/iomgr/resolve_address_posix.cc

@@ -184,6 +184,8 @@ DNSResolver::TaskHandle NativeDNSResolver::LookupSRV(
     grpc_pollset_set* /* interested_parties */,
     absl::string_view /* name_server */) {
   GetDefaultEventEngine()->Run([on_resolved] {
+    ApplicationCallbackExecCtx app_exec_ctx;
+    ExecCtx exec_ctx;
     on_resolved(absl::UnimplementedError(
         "The Native resolver does not support looking up SRV records"));
   });
@@ -197,6 +199,8 @@ DNSResolver::TaskHandle NativeDNSResolver::LookupTXT(
     absl::string_view /* name_server */) {
   // Not supported
   GetDefaultEventEngine()->Run([on_resolved] {
+    ApplicationCallbackExecCtx app_exec_ctx;
+    ExecCtx exec_ctx;
     on_resolved(absl::UnimplementedError(
         "The Native resolver does not support looking up TXT records"));
   });

src/core/lib/iomgr/resolve_address_windows.cc

@@ -168,6 +168,8 @@ DNSResolver::TaskHandle NativeDNSResolver::LookupSRV(
     grpc_pollset_set* /* interested_parties */,
     absl::string_view /* name_server */) {
   GetDefaultEventEngine()->Run([on_resolved] {
+    ApplicationCallbackExecCtx app_exec_ctx;
+    ExecCtx exec_ctx;
     on_resolved(absl::UnimplementedError(
         "The Native resolver does not support looking up SRV records"));
   });
@@ -181,6 +183,8 @@ DNSResolver::TaskHandle NativeDNSResolver::LookupTXT(
     absl::string_view /* name_server */) {
   // Not supported
   GetDefaultEventEngine()->Run([on_resolved] {
+    ApplicationCallbackExecCtx app_exec_ctx;
+    ExecCtx exec_ctx;
     on_resolved(absl::UnimplementedError(
         "The Native resolver does not support looking up TXT records"));
   });

src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc

@@ -120,3 +120,15 @@ void grpc_tls_credentials_options_set_tls_session_key_log_file_path(
   }
   options->set_tls_session_key_log_file_path(path != nullptr ? path : "");
 }
+
+void grpc_tls_credentials_options_set_min_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version min_tls_version) {
+  GPR_ASSERT(options != nullptr);
+  options->set_min_tls_version(min_tls_version);
+}
+
+void grpc_tls_credentials_options_set_max_tls_version(
+    grpc_tls_credentials_options* options, grpc_tls_version max_tls_version) {
+  GPR_ASSERT(options != nullptr);
+  options->set_max_tls_version(max_tls_version);
+}

src/core/lib/security/credentials/tls/tls_credentials.cc

@@ -46,6 +46,19 @@ bool CredentialOptionSanityCheck(grpc_tls_credentials_options* options,
     gpr_log(GPR_ERROR, "TLS credentials options is nullptr.");
     return false;
   }
+  // In this case, there will be non-retriable handshake errors.
+  if (options->min_tls_version() > options->max_tls_version()) {
+    gpr_log(GPR_ERROR, "TLS min version must not be higher than max version.");
+    return false;
+  }
+  if (options->max_tls_version() > grpc_tls_version::TLS1_3) {
+    gpr_log(GPR_ERROR, "TLS max version must not be higher than v1.3.");
+    return false;
+  }
+  if (options->min_tls_version() < grpc_tls_version::TLS1_2) {
+    gpr_log(GPR_ERROR, "TLS min version must not be lower than v1.2.");
+    return false;
+  }
   // In the following conditions, there won't be any issues, but it might
   // indicate callers are doing something wrong with the API.
   if (is_client && options->cert_request_type() !=

src/cpp/common/tls_credentials_options.cc

@@ -85,6 +85,18 @@ void TlsCredentialsOptions::set_certificate_verifier(
   }
 }
 
+void TlsCredentialsOptions::set_min_tls_version(grpc_tls_version tls_version) {
+  grpc_tls_credentials_options* options = c_credentials_options();
+  GPR_ASSERT(options != nullptr);
+  grpc_tls_credentials_options_set_min_tls_version(options, tls_version);
+}
+
+void TlsCredentialsOptions::set_max_tls_version(grpc_tls_version tls_version) {
+  grpc_tls_credentials_options* options = c_credentials_options();
+  GPR_ASSERT(options != nullptr);
+  grpc_tls_credentials_options_set_max_tls_version(options, tls_version);
+}
+
 void TlsCredentialsOptions::set_check_call_host(bool check_call_host) {
   grpc_tls_credentials_options* options = c_credentials_options();
   GPR_ASSERT(options != nullptr);

src/cpp/common/version_cc.cc

@@ -25,5 +25,5 @@
 #include <grpcpp/support/config.h>
 
 namespace grpc {
-std::string Version() { return "1.49.0-dev"; }
+std::string Version() { return "1.49.4"; }
 }  // namespace grpc

src/cpp/server/orca/orca_service.cc

@@ -123,8 +123,6 @@ class OrcaService::Reactor : public ServerWriteReactor<ByteBuffer>,
   }
 
   bool MaybeScheduleTimer() {
-    grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
-    grpc_core::ExecCtx exec_ctx;
     grpc::internal::MutexLock lock(&timer_mu_);
     if (cancelled_) return false;
     timer_handle_ = GetDefaultEventEngine()->RunAfter(

src/cpp/server/secure_server_credentials.cc

@@ -152,8 +152,13 @@ std::shared_ptr<ServerCredentials> LocalServerCredentials(
 
 std::shared_ptr<ServerCredentials> TlsServerCredentials(
     const grpc::experimental::TlsServerCredentialsOptions& options) {
-  return std::shared_ptr<ServerCredentials>(new SecureServerCredentials(
-      grpc_tls_server_credentials_create(options.c_credentials_options())));
+  grpc_server_credentials* c_creds =
+      grpc_tls_server_credentials_create(options.c_credentials_options());
+  if (c_creds == nullptr) {
+    return nullptr;
+  }
+  return std::shared_ptr<ServerCredentials>(
+      new SecureServerCredentials(c_creds));
 }
 
 }  // namespace experimental

src/csharp/build/dependencies.props

@@ -1,7 +1,7 @@
 <!-- This file is generated -->
 <Project>
   <PropertyGroup>
-    <GrpcCsharpVersion>2.49.0-dev</GrpcCsharpVersion>
-    <GoogleProtobufVersion>3.21.5</GoogleProtobufVersion>
+    <GrpcCsharpVersion>2.49.4</GrpcCsharpVersion>
+    <GoogleProtobufVersion>3.21.6</GoogleProtobufVersion>
   </PropertyGroup>
 </Project>

src/objective-c/!ProtoCompiler-gRPCCppPlugin.podspec

@@ -42,7 +42,7 @@ Pod::Spec.new do |s|
   # exclamation mark ensures that other "regular" pods will be able to find it as it'll be installed
   # before them.
   s.name     = '!ProtoCompiler-gRPCCppPlugin'
-  v = '1.49.0-dev'
+  v = '1.49.4'
   s.version  = v
   s.summary  = 'The gRPC ProtoC plugin generates C++ files from .proto services.'
   s.description = <<-DESC
@@ -100,7 +100,7 @@ Pod::Spec.new do |s|
   s.preserve_paths = plugin
 
   # Restrict the protoc version to the one supported by this plugin.
-  s.dependency '!ProtoCompiler', '3.21.5'
+  s.dependency '!ProtoCompiler', '3.21.6'
   # For the Protobuf dependency not to complain:
   s.ios.deployment_target = '9.0'
   s.osx.deployment_target = '10.10'

src/objective-c/!ProtoCompiler-gRPCPlugin.podspec

@@ -42,7 +42,7 @@ Pod::Spec.new do |s|
   # exclamation mark ensures that other "regular" pods will be able to find it as it'll be installed
   # before them.
   s.name     = '!ProtoCompiler-gRPCPlugin'
-  v = '1.49.0-dev'
+  v = '1.49.4'
   s.version  = v
   s.summary  = 'The gRPC ProtoC plugin generates Objective-C files from .proto services.'
   s.description = <<-DESC
@@ -102,7 +102,7 @@ Pod::Spec.new do |s|
   s.preserve_paths = plugin
 
   # Restrict the protoc version to the one supported by this plugin.
-  s.dependency '!ProtoCompiler', '3.21.5'
+  s.dependency '!ProtoCompiler', '3.21.6'
   # For the Protobuf dependency not to complain:
   s.ios.deployment_target = '9.0'
   s.osx.deployment_target = '10.10'

src/objective-c/!ProtoCompiler.podspec

@@ -36,7 +36,7 @@ Pod::Spec.new do |s|
   # exclamation mark ensures that other "regular" pods will be able to find it as it'll be installed
   # before them.
   s.name     = '!ProtoCompiler'
-  v = '3.21.5'
+  v = '3.21.6'
   s.version  = v
   s.summary  = 'The Protobuf Compiler (protoc) generates Objective-C files from .proto files'
   s.description = <<-DESC

src/objective-c/GRPCClient/version.h

@@ -22,4 +22,4 @@
 // instead. This file can be regenerated from the template by running
 // `tools/buildgen/generate_projects.sh`.
 
-#define GRPC_OBJC_VERSION_STRING @"1.49.0-dev"
+#define GRPC_OBJC_VERSION_STRING @"1.49.4"

src/objective-c/tests/version.h

@@ -22,5 +22,5 @@
 // instead. This file can be regenerated from the template by running
 // `tools/buildgen/generate_projects.sh`.
 
-#define GRPC_OBJC_VERSION_STRING @"1.49.0-dev"
+#define GRPC_OBJC_VERSION_STRING @"1.49.4"
 #define GRPC_C_VERSION_STRING @"27.0.0"

src/php/composer.json

@@ -2,7 +2,7 @@
   "name": "grpc/grpc-dev",
   "description": "gRPC library for PHP - for Development use only",
   "license": "Apache-2.0",
-  "version": "1.49.0",
+  "version": "1.49.4",
   "require": {
     "php": ">=7.0.0",
     "google/protobuf": "^v3.3.0"

src/php/ext/grpc/version.h

@@ -20,6 +20,6 @@
 #ifndef VERSION_H
 #define VERSION_H
 
-#define PHP_GRPC_VERSION "1.49.0dev"
+#define PHP_GRPC_VERSION "1.49.4"
 
 #endif /* VERSION_H */

src/python/grpcio/README.rst

@@ -10,7 +10,7 @@ Package for gRPC Python.
 
 Supported Python Versions
 -------------------------
-Python >= 3.6
+Python >= 3.7
 
 Installation
 ------------

src/python/grpcio/grpc/_grpcio_metadata.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio/grpc/_grpcio_metadata.py.template`!!!
 
-__version__ = """1.49.0.dev0"""
+__version__ = """1.49.4"""

src/python/grpcio/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_admin/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_admin/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_channelz/README.rst

@@ -5,7 +5,7 @@ Channelz is a live debug tool in gRPC Python.
 
 Supported Python Versions
 -------------------------
-Python >= 3.6
+Python >= 3.7
 
 Dependencies
 ------------

src/python/grpcio_channelz/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_channelz/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_channelz/setup.py

@@ -55,6 +55,7 @@ CLASSIFIERS = [
     'Programming Language :: Python :: 3.8',
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
+    'Programming Language :: Python :: 3.11',
     'License :: OSI Approved :: Apache Software License',
 ]
 
@@ -63,7 +64,7 @@ PACKAGE_DIRECTORIES = {
 }
 
 INSTALL_REQUIRES = (
-    'protobuf>=3.12.0',
+    'protobuf>=4.21.3',
     'grpcio>={version}'.format(version=grpc_version.VERSION),
 )
 

src/python/grpcio_csds/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_csds/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_csds/setup.py

@@ -39,7 +39,7 @@ PACKAGE_DIRECTORIES = {
 }
 
 INSTALL_REQUIRES = (
-    'protobuf>=3.12.0',
+    'protobuf>=4.21.3',
     'xds-protos>=0.0.7',
     'grpcio>={version}'.format(version=grpc_version.VERSION),
 )

src/python/grpcio_health_checking/README.rst

@@ -5,7 +5,7 @@ Reference package for GRPC Python health checking.
 
 Supported Python Versions
 -------------------------
-Python >= 3.6
+Python >= 3.7
 
 Dependencies
 ------------

src/python/grpcio_health_checking/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_health_checking/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_health_checking/setup.py

@@ -54,6 +54,7 @@ CLASSIFIERS = [
     'Programming Language :: Python :: 3.8',
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
+    'Programming Language :: Python :: 3.11',
     'License :: OSI Approved :: Apache Software License',
 ]
 
@@ -62,7 +63,7 @@ PACKAGE_DIRECTORIES = {
 }
 
 INSTALL_REQUIRES = (
-    'protobuf>=3.12.0',
+    'protobuf>=4.21.3',
     'grpcio>={version}'.format(version=grpc_version.VERSION),
 )
 

src/python/grpcio_reflection/README.rst

@@ -5,7 +5,7 @@ Reference package for reflection in GRPC Python.
 
 Supported Python Versions
 -------------------------
-Python >= 3.6
+Python >= 3.7
 
 Dependencies
 ------------

src/python/grpcio_reflection/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_reflection/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_reflection/setup.py

@@ -55,6 +55,7 @@ CLASSIFIERS = [
     'Programming Language :: Python :: 3.8',
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
+    'Programming Language :: Python :: 3.11',
     'License :: OSI Approved :: Apache Software License',
 ]
 
@@ -63,7 +64,7 @@ PACKAGE_DIRECTORIES = {
 }
 
 INSTALL_REQUIRES = (
-    'protobuf>=3.12.0',
+    'protobuf>=4.21.3',
     'grpcio>={version}'.format(version=grpc_version.VERSION),
 )
 

src/python/grpcio_status/README.rst

@@ -5,7 +5,7 @@ Reference package for GRPC Python status proto mapping.
 
 Supported Python Versions
 -------------------------
-Python >= 3.6
+Python >= 3.7
 
 Dependencies
 ------------

src/python/grpcio_status/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_status/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_status/setup.py

@@ -54,6 +54,7 @@ CLASSIFIERS = [
     'Programming Language :: Python :: 3.8',
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
+    'Programming Language :: Python :: 3.11',
     'License :: OSI Approved :: Apache Software License',
 ]
 
@@ -62,7 +63,7 @@ PACKAGE_DIRECTORIES = {
 }
 
 INSTALL_REQUIRES = (
-    'protobuf>=3.12.0',
+    'protobuf>=4.21.3',
     'grpcio>={version}'.format(version=grpc_version.VERSION),
     'googleapis-common-protos>=1.5.5',
 )

src/python/grpcio_testing/README.rst

@@ -5,7 +5,7 @@ Testing utilities for gRPC Python
 
 Supported Python Versions
 -------------------------
-Python >= 3.6
+Python >= 3.7
 
 Dependencies
 ------------

src/python/grpcio_testing/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_testing/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_testing/setup.py

@@ -49,7 +49,7 @@ PACKAGE_DIRECTORIES = {
 }
 
 INSTALL_REQUIRES = (
-    'protobuf>=3.12.0',
+    'protobuf>=4.21.3',
     'grpcio>={version}'.format(version=grpc_version.VERSION),
 )
 

src/python/grpcio_tests/grpc_version.py

@@ -14,4 +14,4 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/src/python/grpcio_tests/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
+VERSION = '1.49.4'

src/python/grpcio_tests/setup.py

@@ -67,7 +67,9 @@ PACKAGE_DATA = {
         'credentials/server1.key',
         'credentials/server1.pem',
     ],
-    'tests.protoc_plugin.protos.invocation_testing': ['same.proto',],
+    'tests.protoc_plugin.protos.invocation_testing': [
+        'same.proto', 'compiler.proto'
+    ],
     'tests.protoc_plugin.protos.invocation_testing.split_messages': [
         'messages.proto',
     ],

src/python/grpcio_tests/tests/protoc_plugin/_split_definitions_test.py

@@ -26,6 +26,7 @@ import unittest
 
 import grpc
 from grpc_tools import protoc
+import pkg_resources
 import six
 
 from tests.unit import test_common
@@ -37,6 +38,8 @@ _COMMON_NAMESPACE = b'package grpc_protoc_plugin.invocation_testing;'
 _RELATIVE_PROTO_PATH = 'relative_proto_path'
 _RELATIVE_PYTHON_OUT = 'relative_python_out'
 
+_TEST_DIR = os.path.dirname(os.path.realpath(__file__))
+
 
 @contextlib.contextmanager
 def _system_path(path_insertion):
@@ -321,10 +324,30 @@ def _create_test_case_classes():
             yield _create_test_case_class(split_proto, protoc_style)
 
 
+class WellKnownTypesTest(unittest.TestCase):
+
+    def testWellKnownTypes(self):
+        os.chdir(_TEST_DIR)
+        out_dir = tempfile.mkdtemp(suffix="wkt_test", dir='.')
+        well_known_protos_include = pkg_resources.resource_filename(
+            'grpc_tools', '_proto')
+        args = [
+            'grpc_tools.protoc',
+            '--proto_path=protos',
+            '--proto_path={}'.format(well_known_protos_include),
+            '--python_out={}'.format(out_dir),
+            '--grpc_python_out={}'.format(out_dir),
+            'protos/invocation_testing/compiler.proto',
+        ]
+        rc = protoc.main(args)
+        self.assertEqual(0, rc)
+
+
 def load_tests(loader, tests, pattern):
-    tests = tuple(
+    tests = (tuple(
         loader.loadTestsFromTestCase(test_case_class)
-        for test_case_class in _create_test_case_classes())
+        for test_case_class in _create_test_case_classes()) +
+             tuple(loader.loadTestsFromTestCase(WellKnownTypesTest)))
     return unittest.TestSuite(tests=tests)
 
 

src/python/grpcio_tests/tests/protoc_plugin/protos/invocation_testing/compiler.proto

@@ -0,0 +1,30 @@
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+import "google/protobuf/any.proto";
+import "google/protobuf/api.proto";
+import "google/protobuf/compiler/plugin.proto";
+import "google/protobuf/descriptor.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/source_context.proto";
+import "google/protobuf/struct.proto";
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/type.proto";
+import "google/protobuf/wrappers.proto";
+
+package test_compiler;

src/python/grpcio_tests/tests_py3_only/interop/Dockerfile.client

@@ -1,11 +1,6 @@
-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
+FROM python:3.9-slim-bookworm
 
-RUN apt-get update -y && \
-        apt-get install -y \
-            build-essential \
-            clang \
-            python3 \
-            python3-dev
+RUN apt-get update -y && apt-get upgrade -y && apt-get install -y build-essential clang curl
 
 WORKDIR /workdir
 
@@ -16,13 +11,18 @@ COPY . .
 RUN tools/bazel build -c dbg //src/python/grpcio_tests/tests_py3_only/interop:xds_interop_client
 RUN cp -rL /workdir/bazel-bin/src/python/grpcio_tests/tests_py3_only/interop/xds_interop_client* /artifacts/
 
-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
-COPY --from=0 /artifacts ./
+FROM python:3.9-slim-bookworm
 
 ENV GRPC_VERBOSITY="DEBUG"
 ENV GRPC_TRACE="xds_client,xds_resolver,xds_cluster_manager_lb,cds_lb,xds_cluster_resolver_lb,priority_lb,xds_cluster_impl_lb,weighted_target_lb,ring_hash_lb,outlier_detection_lb"
 
-RUN apt-get update -y && apt-get install -y python3
+RUN apt-get update -y \
+  && apt-get install -y python3 \
+  && apt-get -y autoremove \
+  && rm -rf /var/lib/apt/lists/*
+
 RUN ln -s /usr/bin/python3 /usr/bin/python
 
+COPY --from=0 /artifacts ./
+
 ENTRYPOINT ["/xds_interop_client"]

src/python/grpcio_tests/tests_py3_only/interop/Dockerfile.server

@@ -1,11 +1,6 @@
-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
+FROM python:3.9-slim-bookworm
 
-RUN apt-get update -y && \
-        apt-get install -y \
-            build-essential \
-            clang \
-            python3 \
-            python3-dev
+RUN apt-get update -y && apt-get upgrade -y && apt-get install -y build-essential clang curl
 
 WORKDIR /workdir
 
@@ -16,13 +11,18 @@ COPY . .
 RUN tools/bazel build -c dbg //src/python/grpcio_tests/tests_py3_only/interop:xds_interop_server
 RUN cp -rL /workdir/bazel-bin/src/python/grpcio_tests/tests_py3_only/interop/xds_interop_server* /artifacts/
 
-FROM phusion/baseimage:master@sha256:65ea10d5f757e5e86272625f8675d437dd83d8db64bdb429e2354d58f5462750
-COPY --from=0 /artifacts ./
+FROM python:3.9-slim-bookworm
 
 ENV GRPC_VERBOSITY="DEBUG"
 ENV GRPC_TRACE="xds_client,xds_resolver,xds_cluster_manager_lb,cds_lb,xds_cluster_resolver_lb,priority_lb,xds_cluster_impl_lb,weighted_target_lb"
 
-RUN apt-get update -y && apt-get install -y python3
+RUN apt-get update -y \
+    && apt-get install -y python3 \
+    && apt-get -y autoremove \
+    && rm -rf /var/lib/apt/lists/*
+
 RUN ln -s /usr/bin/python3 /usr/bin/python
 
+COPY --from=0 /artifacts ./
+
 ENTRYPOINT ["/xds_interop_server"]

src/ruby/ext/grpc/extconf.rb

@@ -86,7 +86,6 @@ end
 
 env_append 'CPPFLAGS', '-DGPR_BACKWARDS_COMPATIBILITY_MODE'
 env_append 'CPPFLAGS', '-DGRPC_XDS_USER_AGENT_NAME_SUFFIX="\"RUBY\""'
-env_append 'CPPFLAGS', '-DGRPC_RUBY_WINDOWS_UCRT' if windows_ucrt
 
 require_relative '../../lib/grpc/version'
 env_append 'CPPFLAGS', '-DGRPC_XDS_USER_AGENT_VERSION_SUFFIX="\"' + GRPC::VERSION + '\""'
@@ -111,6 +110,7 @@ unless windows
   exit 1 unless $? == 0
 end
 
+$CFLAGS << ' -DGRPC_RUBY_WINDOWS_UCRT' if windows_ucrt
 $CFLAGS << ' -I' + File.join(grpc_root, 'include')
 
 ext_export_file = File.join(grpc_root, 'src', 'ruby', 'ext', 'grpc', 'ext-export')

src/ruby/ext/grpc/rb_grpc_imports.generated.c

@@ -170,6 +170,8 @@ grpc_tls_certificate_provider_static_data_create_type grpc_tls_certificate_provi
 grpc_tls_certificate_provider_file_watcher_create_type grpc_tls_certificate_provider_file_watcher_create_import;
 grpc_tls_certificate_provider_release_type grpc_tls_certificate_provider_release_import;
 grpc_tls_credentials_options_create_type grpc_tls_credentials_options_create_import;
+grpc_tls_credentials_options_set_min_tls_version_type grpc_tls_credentials_options_set_min_tls_version_import;
+grpc_tls_credentials_options_set_max_tls_version_type grpc_tls_credentials_options_set_max_tls_version_import;
 grpc_tls_credentials_options_set_certificate_provider_type grpc_tls_credentials_options_set_certificate_provider_import;
 grpc_tls_credentials_options_watch_root_certs_type grpc_tls_credentials_options_watch_root_certs_import;
 grpc_tls_credentials_options_set_root_cert_name_type grpc_tls_credentials_options_set_root_cert_name_import;
@@ -456,6 +458,8 @@ void grpc_rb_load_imports(HMODULE library) {
   grpc_tls_certificate_provider_file_watcher_create_import = (grpc_tls_certificate_provider_file_watcher_create_type) GetProcAddress(library, "grpc_tls_certificate_provider_file_watcher_create");
   grpc_tls_certificate_provider_release_import = (grpc_tls_certificate_provider_release_type) GetProcAddress(library, "grpc_tls_certificate_provider_release");
   grpc_tls_credentials_options_create_import = (grpc_tls_credentials_options_create_type) GetProcAddress(library, "grpc_tls_credentials_options_create");
+  grpc_tls_credentials_options_set_min_tls_version_import = (grpc_tls_credentials_options_set_min_tls_version_type) GetProcAddress(library, "grpc_tls_credentials_options_set_min_tls_version");
+  grpc_tls_credentials_options_set_max_tls_version_import = (grpc_tls_credentials_options_set_max_tls_version_type) GetProcAddress(library, "grpc_tls_credentials_options_set_max_tls_version");
   grpc_tls_credentials_options_set_certificate_provider_import = (grpc_tls_credentials_options_set_certificate_provider_type) GetProcAddress(library, "grpc_tls_credentials_options_set_certificate_provider");
   grpc_tls_credentials_options_watch_root_certs_import = (grpc_tls_credentials_options_watch_root_certs_type) GetProcAddress(library, "grpc_tls_credentials_options_watch_root_certs");
   grpc_tls_credentials_options_set_root_cert_name_import = (grpc_tls_credentials_options_set_root_cert_name_type) GetProcAddress(library, "grpc_tls_credentials_options_set_root_cert_name");

src/ruby/ext/grpc/rb_grpc_imports.generated.h

@@ -485,6 +485,12 @@ extern grpc_tls_certificate_provider_release_type grpc_tls_certificate_provider_
 typedef grpc_tls_credentials_options*(*grpc_tls_credentials_options_create_type)(void);
 extern grpc_tls_credentials_options_create_type grpc_tls_credentials_options_create_import;
 #define grpc_tls_credentials_options_create grpc_tls_credentials_options_create_import
+typedef void(*grpc_tls_credentials_options_set_min_tls_version_type)(grpc_tls_credentials_options* options, grpc_tls_version min_tls_version);
+extern grpc_tls_credentials_options_set_min_tls_version_type grpc_tls_credentials_options_set_min_tls_version_import;
+#define grpc_tls_credentials_options_set_min_tls_version grpc_tls_credentials_options_set_min_tls_version_import
+typedef void(*grpc_tls_credentials_options_set_max_tls_version_type)(grpc_tls_credentials_options* options, grpc_tls_version max_tls_version);
+extern grpc_tls_credentials_options_set_max_tls_version_type grpc_tls_credentials_options_set_max_tls_version_import;
+#define grpc_tls_credentials_options_set_max_tls_version grpc_tls_credentials_options_set_max_tls_version_import
 typedef void(*grpc_tls_credentials_options_set_certificate_provider_type)(grpc_tls_credentials_options* options, grpc_tls_certificate_provider* provider);
 extern grpc_tls_credentials_options_set_certificate_provider_type grpc_tls_credentials_options_set_certificate_provider_import;
 #define grpc_tls_credentials_options_set_certificate_provider grpc_tls_credentials_options_set_certificate_provider_import

src/ruby/lib/grpc/version.rb

@@ -14,5 +14,5 @@
 
 # GRPC contains the General RPC module.
 module GRPC
-  VERSION = '1.49.0.dev'
+  VERSION = '1.49.4'
 end

src/ruby/tools/version.rb

@@ -14,6 +14,6 @@
 
 module GRPC
   module Tools
-    VERSION = '1.49.0.dev'
+    VERSION = '1.49.4'
   end
 end

templates/gRPC-Core.podspec.template

@@ -195,7 +195,7 @@
       ss.header_mappings_dir = '.'
       ss.libraries = 'z'
       ss.dependency "#{s.name}/Interface", version
-      ss.dependency 'BoringSSL-GRPC', '0.0.24'
+      ss.dependency 'BoringSSL-GRPC', '0.0.25'
       % for abseil_spec in grpc_abseil_specs:
       ss.dependency '${abseil_spec}', abseil_version
       % endfor

templates/src/objective-c/BoringSSL-GRPC.podspec.template

@@ -69,7 +69,7 @@
 
   Pod::Spec.new do |s|
     s.name     = 'BoringSSL-GRPC'
-    version = '0.0.24'
+    version = '0.0.25'
     s.version  = version
     s.summary  = 'BoringSSL is a fork of OpenSSL that is designed to meet Google\'s needs.'
     # Adapted from the homepage:

templates/tools/dockerfile/ruby_deps.include

@@ -6,11 +6,11 @@ RUN apt-get update && apt-get install -y gnupg2 && apt-get clean
 RUN gpg2 --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
 RUN \curl -sSL https://get.rvm.io | bash -s stable
 
-# Install Ruby 2.5
+# Install Ruby 2.7
 RUN apt-get update && apt-get install -y procps && apt-get clean
-RUN /bin/bash -l -c "rvm install ruby-2.5"
-RUN /bin/bash -l -c "rvm use --default ruby-2.5"
+RUN /bin/bash -l -c "rvm install ruby-2.7"
+RUN /bin/bash -l -c "rvm use --default ruby-2.7"
 RUN /bin/bash -l -c "echo 'gem: --no-document' > ~/.gemrc"
 RUN /bin/bash -l -c "echo 'export PATH=/usr/local/rvm/bin:$PATH' >> ~/.bashrc"
-RUN /bin/bash -l -c "echo 'rvm --default use ruby-2.5' >> ~/.bashrc"
-RUN /bin/bash -l -c "gem install bundler --no-document -v 1.9"
+RUN /bin/bash -l -c "echo 'rvm --default use ruby-2.7' >> ~/.bashrc"
+RUN /bin/bash -l -c "gem install bundler --no-document"

test/core/client_channel/resolvers/dns_resolver_cooldown_test.cc

@@ -114,6 +114,8 @@ class TestDNSResolver : public grpc_core::DNSResolver {
       grpc_pollset_set* /* interested_parties */,
       absl::string_view /* name_server */) override {
     GetDefaultEventEngine()->Run([on_resolved] {
+      grpc_core::ApplicationCallbackExecCtx app_exec_ctx;
+      grpc_core::ExecCtx exec_ctx;
       on_resolved(absl::UnimplementedError(
           "The Testing DNS resolver does not support looking up SRV records"));
     });
@@ -127,6 +129,8 @@ class TestDNSResolver : public grpc_core::DNSResolver {
       absl::string_view /* name_server */) override {
     // Not supported
     GetDefaultEventEngine()->Run([on_resolved] {
+      grpc_core::ApplicationCallbackExecCtx app_exec_ctx;
+      grpc_core::ExecCtx exec_ctx;
       on_resolved(absl::UnimplementedError(
           "The Testing DNS resolver does not support looking up TXT records"));
     });

test/core/client_channel/resolvers/google_c2p_resolver_test.cc

@@ -47,7 +47,7 @@ namespace {
 
 void TryConnectAndDestroy(const char* fake_metadata_server_address) {
   grpc::ChannelArguments args;
-  std::string target = "google-c2p-experimental:///servername_not_used";
+  std::string target = "google-c2p:///servername_not_used";
   args.SetInt("grpc.testing.google_c2p_resolver_pretend_running_on_gcp", 1);
   args.SetString("grpc.testing.google_c2p_resolver_metadata_server_override",
                  fake_metadata_server_address);

test/core/end2end/fuzzers/api_fuzzer.cc

@@ -206,6 +206,8 @@ class FuzzerDNSResolver : public grpc_core::DNSResolver {
       grpc_pollset_set* /* interested_parties */,
       absl::string_view /* name_server */) override {
     GetDefaultEventEngine()->Run([on_resolved] {
+      grpc_core::ApplicationCallbackExecCtx app_exec_ctx;
+      grpc_core::ExecCtx exec_ctx;
       on_resolved(absl::UnimplementedError(
           "The Fuzzing DNS resolver does not support looking up SRV records"));
     });
@@ -219,6 +221,8 @@ class FuzzerDNSResolver : public grpc_core::DNSResolver {
       absl::string_view /* name_server */) override {
     // Not supported
     GetDefaultEventEngine()->Run([on_resolved] {
+      grpc_core::ApplicationCallbackExecCtx app_exec_ctx;
+      grpc_core::ExecCtx exec_ctx;
       on_resolved(absl::UnimplementedError(
           "The Fuzing DNS resolver does not support looking up TXT records"));
     });

test/core/end2end/goaway_server_test.cc

@@ -115,6 +115,8 @@ class TestDNSResolver : public grpc_core::DNSResolver {
       grpc_pollset_set* /* interested_parties */,
       absl::string_view /* name_server */) override {
     GetDefaultEventEngine()->Run([on_resolved] {
+      grpc_core::ApplicationCallbackExecCtx app_exec_ctx;
+      grpc_core::ExecCtx exec_ctx;
       on_resolved(absl::UnimplementedError(
           "The Testing DNS resolver does not support looking up SRV records"));
     });
@@ -128,6 +130,8 @@ class TestDNSResolver : public grpc_core::DNSResolver {
       absl::string_view /* name_server */) override {
     // Not supported
     GetDefaultEventEngine()->Run([on_resolved] {
+      grpc_core::ApplicationCallbackExecCtx app_exec_ctx;
+      grpc_core::ExecCtx exec_ctx;
       on_resolved(absl::UnimplementedError(
           "The Testing DNS resolver does not support looking up TXT records"));
     });

test/core/security/grpc_tls_credentials_options_test.cc

@@ -65,6 +65,24 @@ class GrpcTlsCredentialsOptionsTest : public ::testing::Test {
   HostNameCertificateVerifier hostname_certificate_verifier_;
 };
 
+TEST_F(GrpcTlsCredentialsOptionsTest, BadTlsVersionsForChannelCredentials) {
+  auto options = grpc_tls_credentials_options_create();
+  options->set_max_tls_version(grpc_tls_version::TLS1_2);
+  options->set_min_tls_version(grpc_tls_version::TLS1_3);
+  auto credentials = grpc_tls_credentials_create(options);
+  EXPECT_EQ(credentials, nullptr);
+  delete options;
+}
+
+TEST_F(GrpcTlsCredentialsOptionsTest, BadTlsVersionsForServerCredentials) {
+  auto server_options = grpc_tls_credentials_options_create();
+  server_options->set_max_tls_version(grpc_tls_version::TLS1_2);
+  server_options->set_min_tls_version(grpc_tls_version::TLS1_3);
+  auto server_credentials = grpc_tls_server_credentials_create(server_options);
+  EXPECT_EQ(server_credentials, nullptr);
+  delete server_options;
+}
+
 //
 // Tests for Default Root Certs.
 //

test/core/surface/public_headers_must_be_c89.c

@@ -214,6 +214,8 @@ int main(int argc, char **argv) {
   printf("%lx", (unsigned long) grpc_tls_certificate_provider_file_watcher_create);
   printf("%lx", (unsigned long) grpc_tls_certificate_provider_release);
   printf("%lx", (unsigned long) grpc_tls_credentials_options_create);
+  printf("%lx", (unsigned long) grpc_tls_credentials_options_set_min_tls_version);
+  printf("%lx", (unsigned long) grpc_tls_credentials_options_set_max_tls_version);
   printf("%lx", (unsigned long) grpc_tls_credentials_options_set_certificate_provider);
   printf("%lx", (unsigned long) grpc_tls_credentials_options_watch_root_certs);
   printf("%lx", (unsigned long) grpc_tls_credentials_options_set_root_cert_name);

test/cpp/client/credentials_test.cc

@@ -30,6 +30,7 @@
 
 #include "src/core/lib/gpr/env.h"
 #include "src/core/lib/gpr/tmpfile.h"
+#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 #include "src/cpp/client/secure_credentials.h"
 #include "test/cpp/util/tls_test_utils.h"
 
@@ -396,6 +397,23 @@ TEST(CredentialsTest, TlsChannelCredentialsWithCrlDirectory) {
   GPR_ASSERT(channel_credentials.get() != nullptr);
 }
 
+TEST(CredentialsTest, TlsChannelCredentialsWithGoodMinAndMaxTlsVersions) {
+  grpc::experimental::TlsChannelCredentialsOptions options;
+  options.set_min_tls_version(grpc_tls_version::TLS1_2);
+  options.set_max_tls_version(grpc_tls_version::TLS1_3);
+  auto channel_credentials = grpc::experimental::TlsCredentials(options);
+  EXPECT_NE(channel_credentials, nullptr);
+}
+
+TEST(CredentialsTest, TlsChannelCredentialsWithBadMinAndMaxTlsVersions) {
+  grpc::experimental::TlsChannelCredentialsOptions options;
+  options.set_min_tls_version(grpc_tls_version::TLS1_3);
+  options.set_max_tls_version(grpc_tls_version::TLS1_2);
+  auto channel_credentials = grpc::experimental::TlsCredentials(options);
+  EXPECT_EQ(channel_credentials, nullptr);
+  delete options.c_credentials_options();
+}
+
 }  // namespace
 }  // namespace testing
 }  // namespace grpc

test/cpp/server/credentials_test.cc

@@ -24,6 +24,7 @@
 #include <grpcpp/security/server_credentials.h>
 #include <grpcpp/security/tls_credentials_options.h>
 
+#include "src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h"
 #include "src/cpp/client/secure_credentials.h"
 #include "test/core/util/port.h"
 #include "test/core/util/test_config.h"
@@ -176,6 +177,25 @@ TEST(CredentialsTest, TlsServerCredentialsWithAsyncExternalVerifier) {
   GPR_ASSERT(server_credentials.get() != nullptr);
 }
 
+TEST(CredentialsTest, TlsServerCredentialsWithGoodMinMaxTlsVersions) {
+  grpc::experimental::TlsServerCredentialsOptions options(
+      /*certificate_provider=*/nullptr);
+  options.set_min_tls_version(grpc_tls_version::TLS1_2);
+  options.set_max_tls_version(grpc_tls_version::TLS1_3);
+  auto server_credentials = grpc::experimental::TlsServerCredentials(options);
+  EXPECT_NE(server_credentials, nullptr);
+}
+
+TEST(CredentialsTest, TlsServerCredentialsWithBadMinMaxTlsVersions) {
+  grpc::experimental::TlsServerCredentialsOptions options(
+      /*certificate_provider=*/nullptr);
+  options.set_min_tls_version(grpc_tls_version::TLS1_3);
+  options.set_max_tls_version(grpc_tls_version::TLS1_2);
+  auto server_credentials = grpc::experimental::TlsServerCredentials(options);
+  EXPECT_EQ(server_credentials, nullptr);
+  delete options.c_credentials_options();
+}
+
 }  // namespace
 }  // namespace testing
 }  // namespace grpc

test/distrib/php/run_distrib_test.sh

@@ -19,7 +19,10 @@ cd "$(dirname "$0")"
 
 cp -r "$EXTERNAL_GIT_ROOT"/input_artifacts/grpc-*.tgz .
 
-find . -regex ".*/grpc-[0-9].*.tgz" | cut -b3- | \
-    MAKEFLAGS=-j xargs pecl install
+# get name of the PHP package archive to test (we don't know
+# the exact version string in advance)
+GRPC_PEAR_PACKAGE_NAME=$(find . -regex '.*/grpc-[0-9].*.tgz' | sed 's|./||')
+
+MAKEFLAGS=-j pecl install "${GRPC_PEAR_PACKAGE_NAME}"
 
 php -d extension=grpc.so -d max_execution_time=300 distribtest.php

test/distrib/php/run_distrib_test_macos.sh

@@ -19,7 +19,12 @@ cd "$(dirname "$0")"
 
 cp -r "$EXTERNAL_GIT_ROOT"/input_artifacts/grpc-*.tgz .
 
-find . -regex ".*/grpc-[0-9].*.tgz" | cut -b3- | \
-    xargs sudo MAKEFLAGS=-j pecl install
+# get name of the PHP package archive to test (we don't know
+# the exact version string in advance)
+GRPC_PEAR_PACKAGE_NAME=$(find . -regex '.*/grpc-[0-9].*.tgz' | sed 's|./||')
+
+# Use -j4 since higher parallelism can lead to "resource unavailable"
+# errors during the build. See b/257261061#comment4
+sudo MAKEFLAGS=-j4 pecl install "${GRPC_PEAR_PACKAGE_NAME}"
 
 php -d extension=grpc.so -d max_execution_time=300 distribtest.php

third_party/boringssl-with-bazel

@@ -1 +1 @@
-Subproject commit b9232f9e27e5668bc0414879dcdedb2a59ea75f2
+Subproject commit 6195bf8242156c9a2fa75702eee058f91b86a88b

third_party/protobuf

@@ -1 +1 @@
-Subproject commit ab840345966d0fa8e7100d771c92a73bfbadd25c
+Subproject commit 24487dd1045c7f3d64a21f38a3f0c06cc4cf2edb

third_party/protobuf.patch

@@ -5,7 +5,7 @@ index 97ac28028..8b7585d9d 100644
 @@ -31,3 +31,9 @@
  # Copyright 2007 Google Inc. All Rights Reserved.
 
- __version__ = '4.21.5'
+ __version__ = '4.21.6'
 +
 +if __name__ != '__main__':
 +  try:

third_party/zlib

@@ -1 +1 @@
-Subproject commit 21767c654d31d2dccdde4330529775c6c5fd5389
+Subproject commit 04f42ceca40f73e2978b50e93806c2a18c1281fc

tools/distrib/python/grpc_version.py

@@ -14,5 +14,5 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/tools/distrib/python/grpcio_tools/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
-PROTOBUF_VERSION = '3.21.5'
+VERSION = '1.49.4'
+PROTOBUF_VERSION = '3.21.6'

tools/distrib/python/grpcio_tools/grpc_version.py

@@ -14,5 +14,5 @@
 
 # AUTO-GENERATED FROM `$REPO_ROOT/templates/tools/distrib/python/grpcio_tools/grpc_version.py.template`!!!
 
-VERSION = '1.49.0.dev0'
-PROTOBUF_VERSION = '3.21.5'
+VERSION = '1.49.4'
+PROTOBUF_VERSION = '3.21.6'

tools/distrib/python/make_grpcio_tools.py

@@ -84,7 +84,10 @@ GRPC_PYTHON_INCLUDE = os.path.join(GRPC_PYTHON_ROOT, 'grpc_root', 'include')
 BAZEL_DEPS = os.path.join(GRPC_ROOT, 'tools', 'distrib', 'python',
                           'bazel_deps.sh')
 BAZEL_DEPS_PROTOC_LIB_QUERY = '//:protoc_lib'
-BAZEL_DEPS_COMMON_PROTOS_QUERY = '//:well_known_type_protos'
+BAZEL_DEPS_COMMON_PROTOS_QUERIES = [
+    '//:well_known_type_protos',
+    '//:built_in_runtime_protos',
+]
 
 
 def protobuf_submodule_commit_hash():
@@ -112,10 +115,12 @@ def get_deps():
         for name in cc_files_output
         if name.endswith('.cc') and name.startswith(PROTOBUF_CC_PREFIX)
     ]
-    proto_files_output = bazel_query(BAZEL_DEPS_COMMON_PROTOS_QUERY)
+    raw_proto_files = []
+    for target in BAZEL_DEPS_COMMON_PROTOS_QUERIES:
+        raw_proto_files += bazel_query(target)
     proto_files = [
         name[len(PROTOBUF_PROTO_PREFIX):]
-        for name in proto_files_output
+        for name in raw_proto_files
         if name.endswith('.proto') and name.startswith(PROTOBUF_PROTO_PREFIX)
     ]
     commit_hash = protobuf_submodule_commit_hash()