fix: upgrade netty (#52)

* fix: upgrade netty

* fix: update jackson suppression

Author: aaron-steinfeld

grpc-client-utils/build.gradle.kts

@@ -10,8 +10,8 @@ dependencies {
   api(platform("io.grpc:grpc-bom:1.57.2"))
   api("io.grpc:grpc-context")
   api("io.grpc:grpc-api")
-  api(platform("io.netty:netty-bom:4.1.94.Final")) {
-    because("CVE-2023-34462")
+  api(platform("io.netty:netty-bom:4.1.100.Final")) {
+    because("CVE-2023-44487")
   }
 
   implementation(project(":grpc-context-utils"))

grpc-server-utils/build.gradle.kts

@@ -14,8 +14,8 @@ dependencies {
   api("io.grpc:grpc-context")
   api("io.grpc:grpc-api")
 
-  api(platform("io.netty:netty-bom:4.1.94.Final")) {
-    because("CVE-2023-34462")
+  api(platform("io.netty:netty-bom:4.1.100.Final")) {
+    because("CVE-2023-44487")
   }
 
   implementation(project(":grpc-context-utils"))

owasp-suppressions.xml

@@ -7,7 +7,7 @@
         <packageUrl regex="true">^pkg:maven/org\.hypertrace\..*@.*$</packageUrl>
         <cpe>cpe:/a:grpc:grpc</cpe>
     </suppress>
-    <suppress until="2023-09-30Z">
+    <suppress until="2023-11-30Z">
         <notes><![CDATA[
   file name: jackson-databind-2.14.2.jar
   This is currently disputed.