Envoy proto sync to latest versions in grpc-java is blocked until sourced_metadata<envoy_v3_api_field_config.rbac.v3.Permission.sourced_metadata> is implemented.
Implementing sourced_metadata from rbac.proto would be cross-language, so would require a gRFC (yet to be published).