[Snyk] Security upgrade io.grpc:grpc-all from 1.45.1 to 1.48.0

[chrislin22]

Snyk has created this PR to fix 10 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improper Certificate Validation SNYK-JAVA-ORGBOUNCYCASTLE-18519200	751	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Improper Verification of Cryptographic Signature SNYK-JAVA-ORGBOUNCYCASTLE-18518017	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Inefficient Algorithmic Complexity SNYK-JAVA-ORGBOUNCYCASTLE-18518042	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Memory Allocation with Excessive Size Value SNYK-JAVA-ORGBOUNCYCASTLE-18518090	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Uncontrolled Recursion SNYK-JAVA-ORGBOUNCYCASTLE-18519013	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Improper Validation of Integrity Check Value SNYK-JAVA-ORGBOUNCYCASTLE-18519133	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Improper Validation of Integrity Check Value SNYK-JAVA-ORGBOUNCYCASTLE-18519154	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Improper Validation of Integrity Check Value SNYK-JAVA-ORGBOUNCYCASTLE-18519169	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Memory Allocation with Excessive Size Value SNYK-JAVA-ORGBOUNCYCASTLE-18519186	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit
	Improper Validation of Integrity Check Value SNYK-JAVA-ORGBOUNCYCASTLE-18519220	721	io.grpc:grpc-all: 1.45.1 -> 1.48.0 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Recursion

[chrislin22]

This upgrade from gRPC-Java 1.45.1 to 1.48.0 is a minor version update but carries a medium risk due to a potential behavioral change in version 1.47.0.

Potential Breaking Change:

• A behavioral change was reported in version 1.47.0 where creating a ManagedChannel with NettyChannelBuilder and a round_robin load balancing policy for a DNS address with multiple replicas caused failures. The issue was resolved by downgrading to 1.45.1.

Other Changes:

• v1.48.0: Includes bug fixes and a new feature for xDS (ignore_resource_deletion).
• v1.46.0 & v1.47.0: These versions primarily contain bug fixes and improvements.

Recommendation:
Given the reported issue, this upgrade should be handled with caution. It is critical to perform integration testing after the upgrade, especially if your application uses NettyChannelBuilder with the round_robin load balancing policy for service discovery.

Source: gRPC-Java GitHub Issue #9387, Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.