Important: If you accept a credential configuration (credential JSON/File/Stream) from an
- * external source for authentication to Google Cloud Platform, you must validate it before
- * providing it to any Google API or library. Providing an unvalidated credential configuration to
- * Google APIs can compromise the security of your systems and data. For more information, refer
- * to {@link documentation}.
+ *
Important: This method does not validate the credential configuration. A security risk holds
+ * when a credential configuration is accepted from a source that is not under your control and
+ * used without validation on your side.
+ *
+ *
If you are loading your credential configuration from an untrusted source and have not
+ * mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon
+ * as possible to prevent security risks to your environment.
+ *
+ *
Regardless of the method used, it is always your responsibility to validate configurations
+ * received from external sources.
+ *
+ *
See the {@link documentation}
+ * for more details.
+ *
+ *
Returns a credential defined by a Json file.
*
* @param credentialStream the stream with the credential definition.
* @return the credential defined by the credentialStream.
* @throws IOException if the credential cannot be created from the stream.
+ * @deprecated This method is being deprecated because of a potential security risk.
+ * Please use {@link GoogleCredentials instead.
*/
@Beta
+ @Deprecated
public static GoogleCredential fromStream(InputStream credentialStream) throws IOException {
return fromStream(credentialStream, Utils.getDefaultTransport(), Utils.getDefaultJsonFactory());
}
/**
* {@link Beta}
- * Return a credential defined by a Json file.
*
- *
Important: If you accept a credential configuration (credential JSON/File/Stream) from an
- * external source for authentication to Google Cloud Platform, you must validate it before
- * providing it to any Google API or library. Providing an unvalidated credential configuration to
- * Google APIs can compromise the security of your systems and data. For more information, refer
- * to {@link documentation}.
+ *
Important: This method does not validate the credential configuration. A security risk holds
+ * when a credential configuration is accepted from a source that is not under your control and
+ * used without validation on your side.
+ *
+ *
If you are loading your credential configuration from an untrusted source and have not
+ * mitigated the risks (e.g. by validating the configuration yourself), make these changes as soon
+ * as possible to prevent security risks to your environment.
+ *
+ *
Regardless of the method used, it is always your responsibility to validate configurations
+ * received from external sources.
+ *
+ *
See the {@link documentation}
+ * for more details.
+ *
+ *
Returns a credential defined by a Json file.
*
* @param credentialStream the stream with the credential definition.
- * @param transport the transport for Http calls.
- * @param jsonFactory the factory for Json parsing and formatting.
* @return the credential defined by the credentialStream.
* @throws IOException if the credential cannot be created from the stream.
+ * @deprecated This method is being deprecated because of a potential security risk.
+ * Please use {@link GoogleCredentials instead.
*/
@Beta
+ @Deprecated
public static GoogleCredential fromStream(
InputStream credentialStream, HttpTransport transport, JsonFactory jsonFactory)
throws IOException {
From f238d59a661cf05ce0a8585c0d00ac50d832f6bc Mon Sep 17 00:00:00 2001
From: Diego Marquez
Date: Wed, 24 Sep 2025 11:47:27 -0400
Subject: [PATCH 03/10] fix: Use Cloud RAD in deprecation link in
GoogleCredential class (#2606)
---
.../api/client/googleapis/auth/oauth2/GoogleCredential.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/google-api-client/src/main/java/com/google/api/client/googleapis/auth/oauth2/GoogleCredential.java b/google-api-client/src/main/java/com/google/api/client/googleapis/auth/oauth2/GoogleCredential.java
index 80353273d..1d8c70a51 100644
--- a/google-api-client/src/main/java/com/google/api/client/googleapis/auth/oauth2/GoogleCredential.java
+++ b/google-api-client/src/main/java/com/google/api/client/googleapis/auth/oauth2/GoogleCredential.java
@@ -219,7 +219,7 @@ public static GoogleCredential getApplicationDefault(
* @return the credential defined by the credentialStream.
* @throws IOException if the credential cannot be created from the stream.
* @deprecated This method is being deprecated because of a potential security risk.
- * Please use {@link GoogleCredentials instead.
+ * Please use {@link GoogleCredentials instead.
*/
@Beta
@Deprecated
@@ -251,7 +251,7 @@ public static GoogleCredential fromStream(InputStream credentialStream) throws I
* @return the credential defined by the credentialStream.
* @throws IOException if the credential cannot be created from the stream.
* @deprecated This method is being deprecated because of a potential security risk.
- * Please use {@link GoogleCredentials instead.
+ * Please use {@link GoogleCredentials instead.
*/
@Beta
@Deprecated
From 067da19c31d7c5d5056abd22a055efdbfb95cfd7 Mon Sep 17 00:00:00 2001
From: Mridula <66699525+mpeddada1@users.noreply.github.com>
Date: Wed, 1 Oct 2025 23:26:31 -0400
Subject: [PATCH 04/10] ci: upgrade tests to JDK 25 (#2607)
---
.github/workflows/ci.yaml | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 05593d27a..c1a809fe1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -117,15 +117,15 @@ jobs:
- run: .kokoro/build.sh
env:
JOB_TYPE: test
- units-java24:
+ units-java25:
# Building using Java 8 and run the tests with Java 24 runtime
- name: "units (24)"
+ name: "units (25)"
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v3
with:
- java-version: 24
+ java-version: 25
distribution: temurin
- name: "Set jvm system property environment variable for surefire plugin (unit tests)"
# Maven surefire plugin (unit tests) allows us to specify JVM to run the tests.
From d014f619b46711b6b304217200fcbc4595ff821b Mon Sep 17 00:00:00 2001
From: Tomo Suzuki
Date: Mon, 22 Dec 2025 15:37:42 -0500
Subject: [PATCH 05/10] chore: remove build badges (#2610)
b/468377909
---
README.md | 6 ------
1 file changed, 6 deletions(-)
diff --git a/README.md b/README.md
index 40291459f..bd8852fd0 100644
--- a/README.md
+++ b/README.md
@@ -71,13 +71,7 @@ mvn install:install-file \
cd -
```
-## CI Status
-Java Version | Status
------------- | ------
-Java 7 | [](https://storage.googleapis.com/cloud-devrel-public/java/badges/google-api-java-client/java7.html)
-Java 8 | [](https://storage.googleapis.com/cloud-devrel-public/java/badges/google-api-java-client/java8.html)
-Java 11 | [](https://storage.googleapis.com/cloud-devrel-public/java/badges/google-api-java-client/java11.html)
## Dependencies
This library is built on top of two common libraries, also built by Google, and also designed to
From c0a4d8a6de79ec5e73cd23b6e7c92af11866b5d2 Mon Sep 17 00:00:00 2001
From: Tomo Suzuki
Date: Thu, 29 Jan 2026 16:03:40 -0500
Subject: [PATCH 06/10] chore: replace old java team with cloud-sdk-java-team
(#2612)
---
.github/CODEOWNERS | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index db2d8ad17..f90453e92 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -4,10 +4,10 @@
# For syntax help see:
# https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners#codeowners-syntax
-* @googleapis/yoshi-java
+* @googleapis/cloud-sdk-java-team
# The java-samples-reviewers team is the default owner for samples changes
samples/**/*.java @googleapis/java-samples-reviewers
# Generated snippets should not be owned by samples reviewers
-samples/snippets/generated/ @googleapis/yoshi-java
+samples/snippets/generated/ @googleapis/cloud-sdk-java-team
From 857362a29c6100fad69ccad3c78ec421ca317c44 Mon Sep 17 00:00:00 2001
From: Blake Li
Date: Tue, 10 Feb 2026 17:49:38 -0500
Subject: [PATCH 07/10] feat: next release from main branch is 2.9.0 (#2614)
---
.github/release-please.yml | 4 ++++
.github/sync-repo-settings.yaml | 14 ++++++++++++++
2 files changed, 18 insertions(+)
diff --git a/.github/release-please.yml b/.github/release-please.yml
index 3497d88b7..0e6e915af 100644
--- a/.github/release-please.yml
+++ b/.github/release-please.yml
@@ -26,3 +26,7 @@ branches:
handleGHRelease: true
releaseType: java-backport
branch: 2.7.x
+ - bumpMinorPreMajor: true
+ handleGHRelease: true
+ releaseType: java-backport
+ branch: 2.8.x
diff --git a/.github/sync-repo-settings.yaml b/.github/sync-repo-settings.yaml
index 9bf331a37..98249d537 100644
--- a/.github/sync-repo-settings.yaml
+++ b/.github/sync-repo-settings.yaml
@@ -101,6 +101,20 @@ branchProtectionRules:
- lint
- clirr
- cla/google
+ - pattern: 2.8.x
+ isAdminEnforced: true
+ requiredApprovingReviewCount: 1
+ requiresCodeOwnerReviews: true
+ requiresStrictStatusChecks: false
+ requiredStatusCheckContexts:
+ - units (8)
+ - units (11)
+ - windows
+ - dependencies (8)
+ - dependencies (11)
+ - lint
+ - clirr
+ - cla/google
permissionRules:
- team: yoshi-admins
permission: admin
From 8cdeb5e79a424fd47cd5e4eef4dd12f9fca5dea9 Mon Sep 17 00:00:00 2001
From: ldetmer <1771267+ldetmer@users.noreply.github.com>
Date: Thu, 12 Feb 2026 16:05:04 -0500
Subject: [PATCH 08/10] chore: update apache http transports to use default jdk
certs (#2616)
* chore: update apahce http transport clients to use default jdk certs
* fix typo
* fix formatting
* added back missing java doc
* fixed formatting and added additional test
* added IT tests for apache http transport
* move documentation update to separate PR
---
.../apache/v5/GoogleApache5HttpTransport.java | 23 ++--
.../v5/ITGoogleApache5HttpTransportTest.java | 26 ++++-
.../apache/v2/GoogleApacheHttpTransport.java | 23 ++--
.../v2/ITGoogleApacheHttpTransportTest.java | 102 ++++++++++++++++++
4 files changed, 143 insertions(+), 31 deletions(-)
create mode 100644 google-api-client/src/test/java/com/google/api/client/googleapis/apache/v2/ITGoogleApacheHttpTransportTest.java
diff --git a/google-api-client-apache-v5/src/main/java/com/google/api/client/googleapis/apache/v5/GoogleApache5HttpTransport.java b/google-api-client-apache-v5/src/main/java/com/google/api/client/googleapis/apache/v5/GoogleApache5HttpTransport.java
index 00a7673b3..f056024eb 100644
--- a/google-api-client-apache-v5/src/main/java/com/google/api/client/googleapis/apache/v5/GoogleApache5HttpTransport.java
+++ b/google-api-client-apache-v5/src/main/java/com/google/api/client/googleapis/apache/v5/GoogleApache5HttpTransport.java
@@ -14,10 +14,8 @@
package com.google.api.client.googleapis.apache.v5;
-import com.google.api.client.googleapis.GoogleUtils;
import com.google.api.client.googleapis.mtls.MtlsProvider;
import com.google.api.client.googleapis.mtls.MtlsUtils;
-import com.google.api.client.googleapis.util.Utils;
import com.google.api.client.http.apache.v5.Apache5HttpTransport;
import com.google.api.client.util.SslUtils;
import com.google.common.annotations.Beta;
@@ -48,11 +46,11 @@
public final class GoogleApache5HttpTransport {
/**
- * Returns a new instance of {@link Apache5HttpTransport} that uses {@link
- * GoogleUtils#getCertificateTrustStore()} for the trusted certificates. If
- * `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "true", and the default
- * client certificate key store from {@link Utils#loadDefaultMtlsKeyStore()} is not null, then the
- * transport uses the default client certificate and is mutual TLS.
+ * Returns a new instance of {@link Apache5HttpTransport} that uses default jdk certificates for
+ * the trusted certificates. If `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to
+ * "true", and the default client certificate key store from {@link
+ * Utils#loadDefaultMtlsKeyStore()} is not null, then the transport uses the default client
+ * certificate and is mutual TLS.
*/
public static Apache5HttpTransport newTrustedTransport()
throws GeneralSecurityException, IOException {
@@ -61,9 +59,8 @@ public static Apache5HttpTransport newTrustedTransport()
/**
* {@link Beta}
- * Returns a new instance of {@link Apache5HttpTransport} that uses {@link
- * GoogleUtils#getCertificateTrustStore()} for the trusted certificates. mtlsProvider can be used
- * to configure mutual TLS for the transport.
+ * Returns a new instance of {@link Apache5HttpTransport} that uses default jdk certificates for
+ * the trusted certificates. mtlsProvider can be used to configure mutual TLS for the transport.
*
* @param mtlsProvider MtlsProvider to configure mutual TLS for the transport
*/
@@ -109,22 +106,20 @@ public SocketFactoryRegistryHandler(MtlsProvider mtlsProvider)
mtlsKeyStorePassword = mtlsProvider.getKeyStorePassword();
}
- // Use the included trust store
- KeyStore trustStore = GoogleUtils.getCertificateTrustStore();
SSLContext sslContext = SslUtils.getTlsSslContext();
if (mtlsKeyStore != null && mtlsKeyStorePassword != null) {
this.isMtls = true;
SslUtils.initSslContext(
sslContext,
- trustStore,
+ null,
SslUtils.getPkixTrustManagerFactory(),
mtlsKeyStore,
mtlsKeyStorePassword,
SslUtils.getDefaultKeyManagerFactory());
} else {
this.isMtls = false;
- SslUtils.initSslContext(sslContext, trustStore, SslUtils.getPkixTrustManagerFactory());
+ SslUtils.initSslContext(sslContext, null, SslUtils.getPkixTrustManagerFactory());
}
LayeredConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext);
diff --git a/google-api-client-apache-v5/src/test/java/com/google/api/client/googleapis/apache/v5/ITGoogleApache5HttpTransportTest.java b/google-api-client-apache-v5/src/test/java/com/google/api/client/googleapis/apache/v5/ITGoogleApache5HttpTransportTest.java
index f8e9cbed1..8398606d3 100644
--- a/google-api-client-apache-v5/src/test/java/com/google/api/client/googleapis/apache/v5/ITGoogleApache5HttpTransportTest.java
+++ b/google-api-client-apache-v5/src/test/java/com/google/api/client/googleapis/apache/v5/ITGoogleApache5HttpTransportTest.java
@@ -30,10 +30,11 @@
public class ITGoogleApache5HttpTransportTest {
@Test
- public void testHttpRequestFailsWhenMakingRequestToSiteWithoutGoogleCerts()
+ public void testHttpRequestFailsWhenMakingRequestToSiteWithoutDefaultJdkCerts()
throws GeneralSecurityException, IOException {
Apache5HttpTransport apache5HttpTransport = GoogleApache5HttpTransport.newTrustedTransport();
- HttpGet httpGet = new HttpGet("https://maven.com/");
+ // Use a self-signed certificate site that won't be trusted by default trust store
+ HttpGet httpGet = new HttpGet("https://self-signed.badssl.com/");
Exception exception = null;
try {
apache5HttpTransport
@@ -43,7 +44,7 @@ public void testHttpRequestFailsWhenMakingRequestToSiteWithoutGoogleCerts()
new HttpClientResponseHandler() {
@Override
public Void handleResponse(ClassicHttpResponse response) {
- fail("Should not have been able to complete SSL request on non google site.");
+ fail("Should not have been able to complete SSL request with untrusted cert.");
return null;
}
});
@@ -73,4 +74,23 @@ public Void handleResponse(ClassicHttpResponse response) {
}
});
}
+
+ @Test
+ public void testHttpRequestPassesWhenMakingRequestToSiteContainedInDefaultCerts()
+ throws Exception {
+ Apache5HttpTransport apache5HttpTransport = GoogleApache5HttpTransport.newTrustedTransport();
+ HttpGet httpGet = new HttpGet("https://central.sonatype.com/");
+
+ apache5HttpTransport
+ .getHttpClient()
+ .execute(
+ httpGet,
+ new HttpClientResponseHandler() {
+ @Override
+ public Void handleResponse(ClassicHttpResponse response) {
+ assertEquals(200, response.getCode());
+ return null;
+ }
+ });
+ }
}
diff --git a/google-api-client/src/main/java/com/google/api/client/googleapis/apache/v2/GoogleApacheHttpTransport.java b/google-api-client/src/main/java/com/google/api/client/googleapis/apache/v2/GoogleApacheHttpTransport.java
index 93347cd3e..11c8dbbf3 100644
--- a/google-api-client/src/main/java/com/google/api/client/googleapis/apache/v2/GoogleApacheHttpTransport.java
+++ b/google-api-client/src/main/java/com/google/api/client/googleapis/apache/v2/GoogleApacheHttpTransport.java
@@ -14,10 +14,8 @@
package com.google.api.client.googleapis.apache.v2;
-import com.google.api.client.googleapis.GoogleUtils;
import com.google.api.client.googleapis.mtls.MtlsProvider;
import com.google.api.client.googleapis.mtls.MtlsUtils;
-import com.google.api.client.googleapis.util.Utils;
import com.google.api.client.http.apache.v2.ApacheHttpTransport;
import com.google.api.client.util.Beta;
import com.google.api.client.util.SslUtils;
@@ -47,11 +45,11 @@
public final class GoogleApacheHttpTransport {
/**
- * Returns a new instance of {@link ApacheHttpTransport} that uses {@link
- * GoogleUtils#getCertificateTrustStore()} for the trusted certificates. If
- * `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "true", and the default
- * client certificate key store from {@link Utils#loadDefaultMtlsKeyStore()} is not null, then the
- * transport uses the default client certificate and is mutual TLS.
+ * Returns a new instance of {@link ApacheHttpTransport} that uses default jdk certificates for
+ * the trusted certificates. If `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to
+ * "true", and the default client certificate key store from {@link
+ * Utils#loadDefaultMtlsKeyStore()} is not null, then the transport uses the default client
+ * certificate and is mutual TLS.
*/
public static ApacheHttpTransport newTrustedTransport()
throws GeneralSecurityException, IOException {
@@ -60,9 +58,8 @@ public static ApacheHttpTransport newTrustedTransport()
/**
* {@link Beta}
- * Returns a new instance of {@link ApacheHttpTransport} that uses {@link
- * GoogleUtils#getCertificateTrustStore()} for the trusted certificates. mtlsProvider can be used
- * to configure mutual TLS for the transport.
+ * Returns a new instance of {@link ApacheHttpTransport} that default jdk certs for the trusted
+ * certificates. mtlsProvider can be used to configure mutual TLS for the transport.
*
* @param mtlsProvider MtlsProvider to configure mutual TLS for the transport
*/
@@ -105,22 +102,20 @@ public SocketFactoryRegistryHandler(MtlsProvider mtlsProvider)
mtlsKeyStorePassword = mtlsProvider.getKeyStorePassword();
}
- // Use the included trust store
- KeyStore trustStore = GoogleUtils.getCertificateTrustStore();
SSLContext sslContext = SslUtils.getTlsSslContext();
if (mtlsKeyStore != null && mtlsKeyStorePassword != null) {
this.isMtls = true;
SslUtils.initSslContext(
sslContext,
- trustStore,
+ null,
SslUtils.getPkixTrustManagerFactory(),
mtlsKeyStore,
mtlsKeyStorePassword,
SslUtils.getDefaultKeyManagerFactory());
} else {
this.isMtls = false;
- SslUtils.initSslContext(sslContext, trustStore, SslUtils.getPkixTrustManagerFactory());
+ SslUtils.initSslContext(sslContext, null, SslUtils.getPkixTrustManagerFactory());
}
LayeredConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext);
diff --git a/google-api-client/src/test/java/com/google/api/client/googleapis/apache/v2/ITGoogleApacheHttpTransportTest.java b/google-api-client/src/test/java/com/google/api/client/googleapis/apache/v2/ITGoogleApacheHttpTransportTest.java
new file mode 100644
index 000000000..ef02117ad
--- /dev/null
+++ b/google-api-client/src/test/java/com/google/api/client/googleapis/apache/v2/ITGoogleApacheHttpTransportTest.java
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package com.google.api.client.googleapis.apache.v2;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.fail;
+
+import com.google.api.client.http.apache.v2.ApacheHttpTransport;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import javax.net.ssl.SSLHandshakeException;
+import org.apache.http.HttpResponse;
+import org.apache.http.client.ClientProtocolException;
+import org.apache.http.client.ResponseHandler;
+import org.apache.http.client.methods.HttpGet;
+import org.junit.Test;
+
+public class ITGoogleApacheHttpTransportTest {
+
+ @Test
+ public void testHttpRequestFailsWhenMakingRequestToSiteWithoutDefaultJdkCerts()
+ throws GeneralSecurityException, IOException {
+ ApacheHttpTransport apacheHttpTransport = GoogleApacheHttpTransport.newTrustedTransport();
+ // Use a self-signed certificate site that won't be trusted by default trust store
+ HttpGet httpGet = new HttpGet("https://self-signed.badssl.com/");
+ Exception exception = null;
+ try {
+ apacheHttpTransport
+ .getHttpClient()
+ .execute(
+ httpGet,
+ new ResponseHandler