chore: update deps, suppressions (#218)

owasp-suppressions.xml

@@ -18,29 +18,21 @@
     <cve>CVE-2020-13956</cve>
   </suppress>
 
-  <suppress until="2023-11-30Z">
+  <suppress >
     <notes><![CDATA[
-   file name: zookeeper-api-1.3.0.jar
+   Below CVEs impact zookeeper itself, rather than the zookeeper api
    ]]></notes>
     <packageUrl regex="true">^pkg:maven/org\.apache\.helix/zookeeper\-api@.*$</packageUrl>
     <cve>CVE-2016-5017</cve>
     <cve>CVE-2018-8012</cve>
     <cve>CVE-2019-0201</cve>
     <cve>CVE-2023-44981</cve>
   </suppress>
-  <suppress until="2023-11-30Z">
-    <notes><![CDATA[
-     file name: jackson-databind-2.14.2.jar
-     This is currently disputed.
-     ]]></notes>
-    <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
-    <cve>CVE-2023-35116</cve>
-  </suppress>
-  <suppress until="2023-11-30Z">
+  <suppress>
     <notes><![CDATA[
-   file name: netty-handler-4.1.94.Final.jar
+    Fixed from 2.9.0 - awaiting vuln db update
    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/io\.netty/netty.*@.*$</packageUrl>
-    <vulnerabilityName>CVE-2023-4586</vulnerabilityName>
+    <packageUrl regex="true">^pkg:maven/com\.jayway\.jsonpath/json\[email protected]$</packageUrl>
+    <vulnerabilityName>CVE-2023-51074</vulnerabilityName>
   </suppress>
 </suppressions>

query-service-api/build.gradle.kts

@@ -15,7 +15,7 @@ protobuf {
   }
   plugins {
     id("grpc") {
-      artifact = "io.grpc:protoc-gen-grpc-java:1.57.2"
+      artifact = "io.grpc:protoc-gen-grpc-java:1.60.0"
     }
   }
   generateProtoTasks {
@@ -41,15 +41,10 @@ tasks.test {
 }
 
 dependencies {
-  api(platform("io.grpc:grpc-bom:1.57.2"))
+  api(platform("io.grpc:grpc-bom:1.60.0"))
   api("io.grpc:grpc-protobuf")
   api("io.grpc:grpc-stub")
   api("javax.annotation:javax.annotation-api:1.3.2")
-  constraints {
-    implementation("com.google.guava:guava:32.1.2-jre") {
-      because("Multiple vulnerabilities")
-    }
-  }
 
   testImplementation("org.junit.jupiter:junit-jupiter:5.7.1")
   testImplementation("com.google.protobuf:protobuf-java-util:3.22.0")

query-service-client/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 
 dependencies {
   api(project(":query-service-api"))
-  implementation("org.hypertrace.core.grpcutils:grpc-client-utils:0.12.6")
+  implementation("org.hypertrace.core.grpcutils:grpc-client-utils:0.13.1")
 
   // Logging
   implementation("org.slf4j:slf4j-api:1.7.32")

query-service-factory/build.gradle.kts

@@ -3,7 +3,7 @@ plugins {
 }
 
 dependencies {
-  api("org.hypertrace.core.serviceframework:platform-grpc-service-framework:0.1.62")
+  api("org.hypertrace.core.serviceframework:platform-grpc-service-framework:0.1.64")
 
   implementation(project(":query-service-impl"))
   implementation("com.google.inject:guice:5.0.1")

query-service-impl/build.gradle.kts

@@ -16,9 +16,6 @@ dependencies {
           "in org.jetbrains.kotlin:[email protected]",
       )
     }
-    implementation("com.fasterxml.jackson.core:jackson-databind:2.14.2") {
-      because("Multiple vulnerabilities")
-    }
     implementation("org.apache.calcite:calcite-core:1.34.0") {
       because("CVE-2022-39135")
     }
@@ -57,12 +54,15 @@ dependencies {
     implementation("org.apache.zookeeper:zookeeper:3.7.2") {
       because("CVE-2023-44981")
     }
+    implementation("com.jayway.jsonpath:json-path:2.9.0") {
+      because("CVE-2023-51074")
+    }
   }
   api(project(":query-service-api"))
   api("com.typesafe:config:1.4.1")
-  implementation("org.hypertrace.core.grpcutils:grpc-context-utils:0.12.6")
-  implementation("org.hypertrace.core.grpcutils:grpc-client-utils:0.12.6")
-  implementation("org.hypertrace.core.grpcutils:grpc-server-rx-utils:0.12.6")
+  implementation("org.hypertrace.core.grpcutils:grpc-context-utils:0.13.1")
+  implementation("org.hypertrace.core.grpcutils:grpc-client-utils:0.13.1")
+  implementation("org.hypertrace.core.grpcutils:grpc-server-rx-utils:0.13.1")
   implementation("org.hypertrace.core.attribute.service:attribute-service-api:0.14.26")
   implementation("org.hypertrace.core.attribute.service:attribute-projection-registry:0.14.26")
   implementation("org.hypertrace.core.attribute.service:caching-attribute-service-client:0.14.26")
@@ -74,7 +74,7 @@ dependencies {
   }
   implementation("org.slf4j:slf4j-api:1.7.32")
   implementation("commons-codec:commons-codec:1.15")
-  implementation("org.hypertrace.core.serviceframework:platform-metrics:0.1.62")
+  implementation("org.hypertrace.core.serviceframework:platform-metrics:0.1.64")
   implementation("com.google.protobuf:protobuf-java-util:3.22.0")
   implementation("com.google.guava:guava:32.1.2-jre")
   implementation("io.reactivex.rxjava3:rxjava:3.0.11")

query-service/build.gradle.kts

@@ -10,8 +10,8 @@ plugins {
 
 dependencies {
   implementation(project(":query-service-factory"))
-  implementation("org.hypertrace.core.grpcutils:grpc-server-utils:0.12.6")
-  implementation("org.hypertrace.core.serviceframework:platform-grpc-service-framework:0.1.62")
+  implementation("org.hypertrace.core.grpcutils:grpc-server-utils:0.13.1")
+  implementation("org.hypertrace.core.serviceframework:platform-grpc-service-framework:0.1.64")
   implementation("org.slf4j:slf4j-api:1.7.32")
   implementation("com.typesafe:config:1.4.1")
 
@@ -22,7 +22,7 @@ dependencies {
   integrationTestImplementation("org.testcontainers:testcontainers:1.16.2")
   integrationTestImplementation("org.testcontainers:junit-jupiter:1.16.2")
   integrationTestImplementation("org.testcontainers:kafka:1.16.2")
-  integrationTestImplementation("org.hypertrace.core.serviceframework:integrationtest-service-framework:0.1.62")
+  integrationTestImplementation("org.hypertrace.core.serviceframework:integrationtest-service-framework:0.1.64")
   integrationTestImplementation("com.github.stefanbirkner:system-lambda:1.2.0")
 
   integrationTestImplementation("org.apache.kafka:kafka-clients:7.2.1-ccs")