…e condition (#12681)

This change addresses a race condition in
ClientSideCredentialAccessBoundaryFactory that occurred when multiple
concurrent calls were made to generateToken.

The fix involves:
- Waiting on the RefreshTask itself rather than its internal task.
- Using a single listener in RefreshTask to ensure finishRefreshTask
completes before the outer future unblocks waiting threads.
- Adding a regression test generateToken_freshInstance_concurrent_noNpe.

* chore: Enable SSL debug logs for GraalVM image

* chore: Pass SSL debug config to the native image

* chore: Unset the tool options

* chore: Set the native image truststore directly

* chore: Test runtime args for graalvm

* chore: Use the execution-id

* chore: latest runs

* chore: Add comments to explain

Original-PR: googleapis/google-auth-library-java#1914

* chore: migrate tests from JUnit 4 to JUnit 5

* fix: move @test annotations to separate lines

* chore: Fix JUnit annotations being on the same line

* chore: Fix samples imports to use new junit and truth

* chore: Fix sonatype complaints in tests

* chore: Address sonatype complaints

* chore: Address the next batch of complaints

* chore: Fix all the tests

* refactor(TokenVerifierTest): use assertThrows for expected exceptions

* chore: Fix line issues

* chore: Fix remaining sonatype complaints

* chore: Revert Junit5 changes in samples directory

* chore: Revert Junit5 changes in samples directory

* chore: Remove end of file whitespace

* chore: Remove whitespace

* chore: Fix lint issues

Original-PR: googleapis/google-auth-library-java#1870

* fix: allow for ES algorithm in GdchCredentials

* test: partially adapt tests

* test: finish adjusting tests

* chore: format

* fix: restore credential name

* docs: restore license

* fix: restore removed code

* test: increase coverage

* test(gdch): parameterize test

* test: remove unused var

* chore: remove unused throw clause

* test: parameterize more

* fix: remove unused parameter

* fix: make variables final as intended

* fix: remove unused throw clause

* fix: remove unused throw clause

* fix: make OAuth2Credentials clock package private for production code

* fix: use non deprecated base 64 encoder

* test: parameterize flagged tests

* chore: format

* test: fix assertion

* build: remove unused dependency

* test: run linux gce only on linux envs

* fix: sonarqube flags (use java.util.Base64)

* fix: improve error message template

* fix: keep overload of "with audience" that takes an URI

* fix: restore public getter of getApiAudience

* docs: add javadoc for signing logic

* test: test private signature and decode methods

* fix: add null and empty check for audience string

* docs: add javadoc for audience getters

* fix: use enum for possible algorithms

* fix: use obsolete javadoc instead of @deprecated

* refactor: use OAuth2Utils validate methods in GdchCredentials

* fix: restore GoogleAuthException throwing in GdchCredentials

* refactor: downgrade Pkcs8Algorithm and privateKeyFromPkcs8 to package-private

* refactor: split parseBody into parseJson and parseQuery in test utilities

* refactor: remove validation reflection by making signUsingEsSha256 package-private

* test: use hardcoded string literal for gdch api audience in test

* test: refactor to use assertThrows in GdchCredentialsTest and remove host OS check in DefaultCredentialsProviderTest

* fix: add comment about EC algorithm support in GdchCredentials

* fix: update GDCH audience error message to be more descriptive

* refactor: rename getApiAudienceString to getGdchAudience

* fix: Remove unused import

* docs: update GDCH audience getter javadocs

* test: add null-checks to builder and corresponding tests

* refactor: consolidate token type constants using OAuth2Utils

* refactor: throw GoogleAuthException for signing and transcoding errors

* docs: add javadoc to related test utils

* fix: use GoogleAuthException

* test: use assertThrows where applicable

* refactor: replace Preconditions with Strings.isNullOrEmpty for audience checks

* fix: consistent exception message

* chore: format

* test: use lowercase os name

* chore: address review comments for PR #1896

* chore: format

* Finalizing GDCH credentials support by addressing reviewer comments

* chore: format

* fix: parse EC private keys with  SEC1 algorithm

* chore: format

* fix: separate PKCs8 vs SEC1 logic in GdchCredentials

* fix: improved exception message, added comments to extractPrivateKeyValue

Original-PR: googleapis/google-auth-library-java#1896

…1907)

* feat: Refactor X509Provider

* Added back accidentally removed tests.

* Lint fixes

* Addressed the PR comments.

* Test for windows OS cert default path

* lint fixes.

* Added Copyright headers.

* Addressed comments.

* Test fix.

* Added separate test class for mTLS-utils. Added missing cert and malformed cert tests to X509Provider.

* Lint fix.

Original-PR: googleapis/google-auth-library-java#1907

…try (#12624)

Remove dev gate flag and BetaApi tags from big query open telemetry
tracing, as we are feature complete.

Note by removing dev gate we will have added additional telemetry may
contain sensitive data such as resource names, full URLs, and error
messages.

Fixes #12100

Generated by @diegomarquezp via
[generate_new_client_hermetic_build.yaml](https://github.com/googleapis/google-cloud-java/actions/workflows/generate_new_client_hermetic_build.yaml)

Command used:

```
python generation/new_client_hermetic_build/add-new-client-config.py add-new-library --api-shortname "appoptimize" --name-pretty "App Optimize API" --api-description "The App Optimize API provides developers and platform teams with tools to monitor, analyze, and improve the performance and cost-efficiency of their cloud applications." --proto-path "google/cloud/appoptimize/v1beta" --product-docs "https://docs.cloud.google.com/app-optimize/overview" 

```

---------

Co-authored-by: Diego Marquez <[email protected]>

…#12752)

[b/501419313](https://b.corp.google.com/501419313)

- Remove pre-emptive BigQueryStatement object creation in
BigQueryDatabaseMetData constructor.
- Make DataBaseMetadata field in BigQueryConnection class static.

)

#12710)

This pull request is generated with proto changes between
[googleapis/googleapis@cd09084](googleapis/googleapis@cd09084)
(exclusive) and
[googleapis/googleapis@e182cf5](googleapis/googleapis@e182cf5)
(inclusive).

BEGIN_COMMIT_OVERRIDE
BEGIN_NESTED_COMMIT
fix(deps): update the Java code generator (gapic-generator-java) to
2.69.0
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [chronicle] Add DataTableService to Chronicle v1 Client Libraries

PiperOrigin-RevId: 898791366

Source Link:
[googleapis/googleapis@e182cf5](googleapis/googleapis@e182cf5)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [vectorsearch] Added CMEK support
feat: [vectorsearch] Added UpdateIndex support
docs: [vectorsearch] Updated documentation for listing locations
docs: [vectorsearch] Updated documentation for Collection.data_schema

PiperOrigin-RevId: 898465628

Source Link:
[googleapis/googleapis@8d0f6d8](googleapis/googleapis@8d0f6d8)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [discoveryengine] add AUTO condition to SearchAsYouTypeSpec in
v1alpha and v1beta

PiperOrigin-RevId: 897859462

Source Link:
[googleapis/googleapis@f01ba6b](googleapis/googleapis@f01ba6b)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [kms] support external-μ in the Digest

PiperOrigin-RevId: 897686352

Source Link:
[googleapis/googleapis@7fbf256](googleapis/googleapis@7fbf256)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [kms] add a variable to SingleTenantHsmInstanceCreate to control
whether future key portability features will be usable on the instance

PiperOrigin-RevId: 897676455

Source Link:
[googleapis/googleapis@bc600b8](googleapis/googleapis@bc600b8)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [databasecenter] Add support for BigQuery datasets and
reservations
feat: [databasecenter] Introduce resource affiliation and lineage
tracking
feat: [databasecenter] Enhance maintenance information with state,
upcoming maintenance, and failure reasons

PiperOrigin-RevId: 897584246

Source Link:
[googleapis/googleapis@7f9e9ff](googleapis/googleapis@7f9e9ff)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
docs: [shopping-merchant-inventories] A comment for field `name` in
message `.google.shopping.merchant.products.v1.LocalInventory` is
changed
docs: [shopping-merchant-inventories] A comment for field `name` in
message `.google.shopping.merchant.products.v1.RegionalInventory` is
changed
feat: [shopping-merchant-inventories] a new field `base64_encoded_name`
is added to the `LocalInventory` message
feat: [shopping-merchant-inventories] new field `base64_encoded_name` is
added to the `RegionalInventory` message

PiperOrigin-RevId: 897575741

Source Link:
[googleapis/googleapis@6db5d2e](googleapis/googleapis@6db5d2e)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [dataplex] Allow Data Documentation DataScans to support BigQuery
Dataset resources in addition to BigQuery table resources
docs: [dataplex] A comment for message `DataDocumentationResult` is
changed
docs: [dataplex] A comment for field `table_result` in message
`.google.cloud.dataplex.v1.DataDocumentationResult` is changed

PiperOrigin-RevId: 897564665

Source Link:
[googleapis/googleapis@1991351](googleapis/googleapis@1991351)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
docs: [network-management] Update comment for the `region` field in
`RouteInfo`

PiperOrigin-RevId: 897473889

Source Link:
[googleapis/googleapis@66fcc02](googleapis/googleapis@66fcc02)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
chore: [dialogflow-cx] Add ruby_package to missing proto files in
google-cloud-dialogflow-cx-v3

PiperOrigin-RevId: 897389079

Source Link:
[googleapis/googleapis@b6669d7](googleapis/googleapis@b6669d7)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [dataproc] Add `Engine` field to support LightningEngine in
clusters and add support for stop ttl

PiperOrigin-RevId: 897294662

Source Link:
[googleapis/googleapis@2da8658](googleapis/googleapis@2da8658)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [shopping-merchant-products] a new field `base64_encoded_name` is
added to the `Product` message
feat: [shopping-merchant-products] new fields - `base64_encoded_name`
and `base64_encoded_product` added to the `ProductInput` message
docs: [shopping-merchant-products] A comment for field `name` in message
`.google.shopping.merchant.products.v1.ProductInput` is changed
docs: [shopping-merchant-products] A comment for field `name` in message
`.google.shopping.merchant.products.v1.Product` is changed

PiperOrigin-RevId: 896968813

Source Link:
[googleapis/googleapis@2aba484](googleapis/googleapis@2aba484)
END_NESTED_COMMIT
BEGIN_NESTED_COMMIT
feat: [infra-manager] adding DeploymentGroups, you can now manage
deployment of multiple module root dependencies in a single DAG

PiperOrigin-RevId: 896570259

Source Link:
[googleapis/googleapis@f5cb7af](googleapis/googleapis@f5cb7af)
END_NESTED_COMMIT
END_COMMIT_OVERRIDE

---------

Co-authored-by: Diego <[email protected]>

This PR remove `@BetaApi` from observability classes. `@InternalApi`
annotations are also removed because they are either package private or
need to be used externally.

…12775)

This PR updates the path filter in `sdk-platform-java-ci.yaml` to
include `google-auth-library-java/**`. This ensures that any changes to
the auth library will also trigger the CI build for the SDK platform.

🤖 I have created a release *beep* *boop*
---


<details><summary>1.85.0-SNAPSHOT</summary>

### Updating meta-information for bleeding-edge SNAPSHOT release.
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

java-logging has been migrated to google-cloud-java but java-pubsub is
still in a separate repo. Updating the CI to reflect it.

sdk-platform-java already has [its own
ci](https://github.com/googleapis/google-cloud-java/blob/main/.github/workflows/sdk-platform-java-ci.yaml).
There is no need to run units in a separate CI.

🤖 I have created a release *beep* *boop*
---


<details><summary>1.85.0</summary>

##
[1.85.0](v1.84.0...v1.85.0)
(2026-04-14)


### Features

* [appoptimize] new module for appoptimize
([#12768](#12768))
([050187d](050187d))
* [chronicle] Add DataTableService to Chronicle v1 Client Libraries
([fc62b1e](fc62b1e))
* [databasecenter] Add support for BigQuery datasets and
([fc62b1e](fc62b1e))
* [dataplex] Allow Data Documentation DataScans to support BigQuery
([fc62b1e](fc62b1e))
* [dataproc] Add `Engine` field to support LightningEngine in
([fc62b1e](fc62b1e))
* [discoveryengine] add AUTO condition to SearchAsYouTypeSpec in
([fc62b1e](fc62b1e))
* [infra-manager] adding DeploymentGroups, you can now manage
([fc62b1e](fc62b1e))
* [kms] add a variable to SingleTenantHsmInstanceCreate to control
([fc62b1e](fc62b1e))
* [kms] support external-μ in the Digest
([fc62b1e](fc62b1e))
* [shopping-merchant-products] a new field `base64_encoded_name` is
([fc62b1e](fc62b1e))
* [vectorsearch] Added CMEK support
([fc62b1e](fc62b1e))


### Bug Fixes

* **auth:** Address ClientSideCredentialAccessBoundary RefreshTask race
condition
([#12681](#12681))
([30088d2](30088d2))
* **bqjdbc:** lazily instantiate Statement in BigQueryDatabaseMetaData
([#12752](#12752))
([72e5508](72e5508))
* **deps:** update the Java code generator (gapic-generator-java) to
([fc62b1e](fc62b1e))
* **gdch:** support EC private keys
([#1896](#1896))
([bf926fb](bf926fb))
* update appoptimize version to 0.0.1 to match released repo
([#12782](#12782))
([80dfac6](80dfac6))


### Documentation

* [network-management] Update comment for the `region` field in
([fc62b1e](fc62b1e))
* [shopping-merchant-inventories] A comment for field `name` in
([fc62b1e](fc62b1e))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).