[Snyk] Security upgrade io.grpc:grpc-all from 1.45.1 to 1.84.0

[chrislin22]

Snyk has created this PR to fix 3 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IONETTY-18170202	756	io.grpc:grpc-all: 1.45.1 -> 1.84.0 Proof of Concept
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IONETTY-18170204	756	io.grpc:grpc-all: 1.45.1 -> 1.84.0 Proof of Concept
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IONETTY-18233079	756	io.grpc:grpc-all: 1.45.1 -> 1.84.0 Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[chrislin22]

This is a large version upgrade for gRPC-Java, spanning approximately 40 minor releases. While not a major version bump, the cumulative changes introduce significant risk and require careful validation.

Key Breaking Changes & Risks:

• Java Version Requirement: gRPC-Java requires Java 8 or later. Versions older than 1.42.x were the last to support Java 7. Ensure your environment meets the Java 8+ requirement.
• Behavioral Changes: Numerous behavioral changes have been introduced that could affect runtime behavior. A critical one is that RFC 3986 URI parsing is now enabled by default, which may affect how service URIs are resolved.
• API Evolution: While many changes are additive, some internal APIs have been removed. Code using reflection to access gRPC internals may break.
• Dependency Upgrades: Core dependencies like Netty, Guava, and Protobuf have been upgraded multiple times. This can introduce transitive dependency conflicts within your project.
• Load Balancing and xDS: There are extensive changes to load balancing policies (e.g., how inactive children are handled) and the xDS service discovery implementation.

Recommendation:
This upgrade should be treated with caution. Developers must thoroughly test the application, paying close attention to service discovery, connection management, and URI handling. Review the official release notes for the specific gRPC features your application uses.

Source: gRPC-Java GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.