does null not work here?

@frankyn null setting doesn't works here see the respected example with response

        Storage storage = StorageOptions.getDefaultInstance().getService();
        String bucketName = RemoteStorageHelper.generateBucketName();
        try{
            Cors cors = Cors.newBuilder()
                    .setOrigins(ImmutableList.of(Cors.Origin.of("*")))
                    .setMethods(ImmutableList.of(HttpMethod.GET))
                    .setResponseHeaders(ImmutableList.of("Content-Type"))
                    .setMaxAgeSeconds(100)
                    .build();
            Bucket bucket =
                    storage.create(BucketInfo.newBuilder(bucketName).setCors(ImmutableList.of(cors)).build());
            System.out.println("Prior size : " + bucket.getCors().size());
            Bucket updatedBucket  = bucket.toBuilder().setCors(null).build().update();
            System.out.println("After updating operation size must be zero instead of : " + updatedBucket.getCors().size());

        }finally {
            RemoteStorageHelper.forceDelete(storage, bucketName, 5, TimeUnit.SECONDS);
        }

Response :

Prior size : 1
After updating operation size must be zero instead of : 1

@frankyn I have raise the issue in storage repo regarding this and will fixed it soon

I can see @frankyn 's argument, but following it's point, why need to call setCors() at all if it's empty or NULL?
Lots of folks (Effective Java 3rd ed.) prefer empty lists to using NULL, and I was going to comment w/ that, but really, if it's empty, why have to set it at all?

In this case the example is to remove CORS from a bucket metadata. Good call, I think we can move forward with this PR with ImmutableList.<Cors>Of()

Maybe one additional change that could be made here @athakor is to confirm that CORS are set before making a subsequent call. That way you reduce the need to make a patch request.

done

Maybe one additional change that could be made here @athakor is to confirm that CORS are set before making a subsequent call. That way you reduce the need to make a patch request.

Use cors.clear() instead if all cors will be deleted.

done