chore: upgrade grpc due to vuln (#48)

* upgrade grpc and auth0 libs

* update

* revert jwks change

Author: SrikarMannepalli

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-6.5-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.6-all.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

grpc-client-rx-utils/build.gradle.kts

@@ -6,7 +6,7 @@ plugins {
 }
 
 dependencies {
-  api(platform("io.grpc:grpc-bom:1.56.0"))
+  api(platform("io.grpc:grpc-bom:1.57.2"))
   api("io.reactivex.rxjava3:rxjava:3.1.4")
   api("io.grpc:grpc-stub")
   api(project(":grpc-context-utils"))

grpc-client-utils/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 
 dependencies {
 
-  api(platform("io.grpc:grpc-bom:1.56.0"))
+  api(platform("io.grpc:grpc-bom:1.57.2"))
   api("io.grpc:grpc-context")
   api("io.grpc:grpc-api")
   api(platform("io.netty:netty-bom:4.1.94.Final")) {

grpc-context-utils/build.gradle.kts

@@ -10,7 +10,7 @@ tasks.test {
 }
 
 dependencies {
-  api(platform("io.grpc:grpc-bom:1.56.0"))
+  api(platform("io.grpc:grpc-bom:1.57.2"))
   implementation("io.grpc:grpc-core")
 
   implementation("com.auth0:java-jwt:4.4.0")

grpc-server-rx-utils/build.gradle.kts

@@ -6,7 +6,7 @@ plugins {
 }
 
 dependencies {
-  api(platform("io.grpc:grpc-bom:1.56.0"))
+  api(platform("io.grpc:grpc-bom:1.57.2"))
   api("io.reactivex.rxjava3:rxjava:3.1.4")
   api("io.grpc:grpc-stub")
 

grpc-server-utils/build.gradle.kts

@@ -10,7 +10,7 @@ tasks.test {
 }
 
 dependencies {
-  api(platform("io.grpc:grpc-bom:1.56.0"))
+  api(platform("io.grpc:grpc-bom:1.57.2"))
   api("io.grpc:grpc-context")
   api("io.grpc:grpc-api")
 

owasp-suppressions.xml

@@ -7,4 +7,12 @@
         <packageUrl regex="true">^pkg:maven/org\.hypertrace\..*@.*$</packageUrl>
         <cpe>cpe:/a:grpc:grpc</cpe>
     </suppress>
+    <suppress until="2023-08-31Z">
+        <notes><![CDATA[
+  file name: jackson-databind-2.14.2.jar
+  This is currently disputed.
+  ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
+        <cve>CVE-2023-35116</cve>
+    </suppress>
 </suppressions>