build(deps): bump com.google.api-client:google-api-client from 2.2.0 to 2.9.0

[dependabot]

Bumps com.google.api-client:google-api-client from 2.2.0 to 2.9.0.

Release notes

Sourced from com.google.api-client:google-api-client's releases.

v2.9.0

2.9.0 (2026-02-24)

Features

• Next release from main branch is 2.9.0 (#2614) (857362a)
• Update GoogleUtils#getCertificateTrustStore to first attempt t… (#2613) (dddb15b)

Bug Fixes

• sec: Warn users of unsafe credential generation methods (#2604) (d4c0a33)
• Use Cloud RAD in deprecation link in GoogleCredential class (#2606) (f238d59)

v2.8.1

2.8.1 (2025-08-14)

Bug Fixes

• deps: Update project.http.version to v2 (#2598) (4874da1)

v2.8.0

2.8.0 (2025-05-20)

Features

• Update default truststore to contain DigiCert Global Root G2](googleapis/google-api-java-client@965cc2a)

Bug Fixes

• deps: Update project.http.version to v1.47.0 (#2543) (922c382)

v2.7.2

2.7.2 (2025-01-22)

Bug Fixes

• Add warnings to users about using credentials from external sources (#2551) (3bb2879)

v2.7.1

2.7.1 (2024-12-10)

Bug Fixes

... (truncated)

Changelog

Sourced from com.google.api-client:google-api-client's changelog.

2.9.0 (2026-02-24)

Features

• Next release from main branch is 2.9.0 (#2614) (857362a)
• Update GoogleUtils#getCertificateTrustStore to first attempt t… (#2613) (dddb15b)

Bug Fixes

• sec: Warn users of unsafe credential generation methods (#2604) (d4c0a33)
• Use Cloud RAD in deprecation link in GoogleCredential class (#2606) (f238d59)

2.8.1 (2025-08-14)

Bug Fixes

• deps: Update project.http.version to v2 (#2598) (4874da1)

2.8.0 (2025-05-20)

Features

• Next release from main branch is 2.8.0 (#2563) (57882ad)

Bug Fixes

• deps: Update project.http.version to v1.47.0 (#2543) (922c382)

2.7.2 (2025-01-22)

Bug Fixes

• Add warnings to users about using credentials from external sources (#2551) (3bb2879)

2.7.1 (2024-12-10)

Bug Fixes

• deps: Update dependency com.google.api-client:google-api-client to v2.7.0 (#2475) (2fdd3e1)
• deps: Update dependency com.google.appengine:appengine-api-1.0-sdk to v2.0.31 (#2526) (06d17a7)
• deps: Update dependency com.google.auth:google-auth-library-bom to v1.30.0 (#2521) (0a9461b)
• deps: Update dependency com.google.cloud:libraries-bom to v26.51.0 (#2491) (b8a3d13)
• deps: Update dependency commons-codec:commons-codec to v1.17.1 (#2527) (e797532)

... (truncated)

Commits

• 1346160 chore(main): release 2.9.0 (#2605)
• dddb15b feat: update GoogleUtils#getCertificateTrustStore to first attempt t… (#2613)
• 8cdeb5e chore: update apache http transports to use default jdk certs (#2616)
• 857362a feat: next release from main branch is 2.9.0 (#2614)
• c0a4d8a chore: replace old java team with cloud-sdk-java-team (#2612)
• d014f61 chore: remove build badges (#2610)
• 067da19 ci: upgrade tests to JDK 25 (#2607)
• f238d59 fix: Use Cloud RAD in deprecation link in GoogleCredential class (#2606)
• d4c0a33 fix(sec): warn users of unsafe credential generation methods (#2604)
• 665acbe chore(main): release 2.8.2-SNAPSHOT (#2600)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[FrankChen021]

WONT_FIX_LARGE_CHANGE — closing after exact-head verification of e90f9c5754b61b3471a3ffafee7ff706e27be448 against current upstream master b3f08c83aa0492a8ed0e16b1b715f5abc0fa3d3a.

The PR is a one-line google-api-client 2.2.0 → 2.9.0 bump, but all five red jobs are deterministic PR-caused Maven Enforcer failures, not flaky or infrastructure failures:

• packaging (job 93635261386), strict-compilation (93635261322), static-checks (93635261298), and openrewrite (93635261311) fail RequireUpperBoundDeps in druid-iceberg-extensions: google-auth-library-{credentials,oauth2-http} resolves to 1.20.0 through google-cloud-storage:2.29.1, while google-api-client:2.9.0 requires 1.30.0.
• Those jobs, and validate-dist (93635261711), also expose druid-server selecting auto-value-annotations:1.8.1 through test Truth while the upgraded auth client requires 1.11.0.
• A focused local validate additionally reproduces the auth conflict in google-extensions.

Adding only the two obvious version pins would make the current checks quieter without making the dependency graph supported. The authoritative 2.9.0 POM upgrades the Google HTTP client family to 2.0.0, and the published 2.9.0 JAR manifest imports its HTTP/JSON/util packages in [2.0,3). Druid still centrally forces google-http-client core/Jackson to 1.42.3, while google-cloud-storage:2.29.1 contributes other HTTP modules at 1.43.3 and auth at 1.20.0. The resulting effective graph mixes 1.42.3, 1.43.3, and 2.0.0 HTTP modules plus auth 1.20.0/1.30.0. That is not compatibility-safe.

Compatibility review:

• The affected surface is broader than the root POM: cloud/gcp-common, server, Google, GCE, Iceberg, Kubernetes-overlord, and embedded-test modules. GcpModule also exposes Google HTTP types through bindings, so extension/plugin classloader compatibility is part of the change.
• Google API Client 2.9 changes trust-store selection and deprecates GoogleNetHttpTransport; Druid directly uses GoogleNetHttpTransport.newTrustedTransport() in GCP/GCE code. This can alter outbound TLS/private-CA/proxy behavior and needs deployment-level GCS/GCE/ADC testing.
• Google HTTP Client 2.0 documents a breaking Guava-family update. Java runtime level itself is acceptable for Druid, but coordinated HTTP 2, storage/gax/auth/grpc dependency management and live integration verification are required.
• japicmp (with missing optional classes ignored) found no general public binary/source break in API Client 2.2→2.9 or auth 1.20→1.30. It did flag a Java-serialization UID change for HTTP Client's public DateTime.SecondsAndNanos; Druid has no direct use, so no Druid stored-data format change was identified. Druid REST/SQL/config and persistence formats are otherwise untouched, but the network/TLS and extension-SPI risks remain unresolved.
• Licenses remain compatible (Apache-2.0/BSD-3-Clause), but the coordinated version alignment would require updating licenses.yaml, which still records the old API/auth/HTTP/AutoValue versions.
• GitHub's reviewed advisory database returned no exact-version advisory for API Client 2.2.0 that would justify rushing an unsafe partial migration.

There is concrete scope precedent: #16483 attempted only Google HTTP Client 1.42.3 → 1.44.2 and accumulated four follow-up alignment commits spanning Google, Iceberg, gRPC, OpenTelemetry, and license metadata before it was closed. Moving this PR to HTTP 2 safely is a larger migration.

A compatibility-safe repair therefore requires widespread dependency alignment and integration work outside a surgical dependency-PR fix. No patch, push, approval, or merge was performed.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.