Update frauddetectionservice

[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
org.apache.kafka:kafka-clients	dependencies	minor	3.4.0 -> 3.5.1
io.grpc:grpc-stub	dependencies	minor	1.50.3 -> 1.57.0

By merging this PR, the issue #36 will be automatically resolved and closed:

Severity	CVSS Score	CVE
High	7.5	CVE-2023-34453
High	7.5	CVE-2023-34454
High	7.5	CVE-2023-34455

By merging this PR, the issue #50 will be automatically resolved and closed:

Severity	CVSS Score	CVE
High	7.1	CVE-2023-2976

---

Release Notes

grpc/grpc-java

v1.57.0

gRPC Java 1.57.0 Release Notes

This release accidentally broke Java 8: NoSuchMethodError for some ByteBuffer methods. The issue is tracked in https:/grpc/grpc-java/issues/10432

API Changes

• Use fully qualified java.lang.String in all cases in generated code. This fixes compilation if a protobuf message is named “String”.
• Stabilize two io.grpc.Status methods (asRuntimeException & trailersFromThrowable)
• Stabilize io.grpc.ManagedChannelBuilder.useTransportSecurity (#​10244)
• Stabilize io.grpc.util.MutableHandlerRegistry (#​10348)

Behavior Changes

• xds: Handle loops and duplicates in xds Aggregate clusters
• core: Change delay for hedging retry after a non-fatal error to be 0 to match the gRFC (A6).
• api: CheckedForwardingClientCall now passes trailers from the caught exception
• xds: require EDS service name in CDS resources with an xdstp name
• xds: Use Rule order instead of RuleChain
• Wrap other name resolver types in a RetryingNameResolver . Previously, if authority was not overridden, then some name resolvers (such as grpclb) had no retry.
• xds: Environment variable "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT" is no longer respected, so xDS security cannot be disabled any more (#​10243)
• context, api: Package io.grpc is now consolidated into a single artifact grpc-api by moving classes from grpc-context to grpc-api. grpc-context now has a dependency on grpc-api (but excludes other dependencies of grpc-api) so any application previously using only grpc-context will now also bring in grpc-api. This fixes #​3522 which was the major issue preventing support of Java modules. We are not done fixing support, as some artifacts need to be split and Automatic-Module-Name needs to be added. The next release is likely to be more stable for modules.

New Features

• binder: Add UserHandle and BinderChannelCredentials to support cross-user communication (#​10197)
• xds,orca: LRS named metrics support

Improvements

• core: Resolve isAndroid only once on class loading. This can improve channel creation performance on Android.
• xds: Pick a subchannel with new static stride scheduler in WeightedRoundRobinLoadBalancer

Bug Fixes

• xds: Fix the server sending a GOAWAY when an LDS update with no changes other than ordering is received.
• netty: Fix NPE when a header with errors is received with endStream=true. This was causing logs to be filled with errors when health checkers didn’t specify a content type.
• okhttp: Fix the Socket data race when shutdown/closed during connecting that was causing a significant delay

Dependencies

• Upgraded Netty to 4.1.93-Final
• Update guava dependency to 32.0.1 to address CVE-2023-2976

Acknowledgements

• Benjamin Peterson
• Masakuni Oishi
• Philip K. Warren
• Stephane Landelle

v1.56.1

Bug fixes

• core: Fix regression in 1.54.0 where polling NameResolvers would not refresh after a resolution error (#​10328). The symptom is a transient failure like "UNAVAILABLE: Unable to resolve host" continuing potentially forever. This did not impact DnsNameResolver, but it did impacted GrpclbNameResolver which is the dns name resolver used when grpc-grpclb is in the classpath. So even users that think "I don't use grpclb" may have been impacted. round_robin is mainly impacted on startup, but if the error happened afterward it would commonly fix itself for short transient DNS failures. pick_first is impacted at all times; any failed DNS resolution could cause all future RPCs on the channel to fail.

v1.56.0

API Changes

• api: Stabilize the SynchronizationContext class (#​10130).
• api: Stabilize io.grpc.CallCredentials (#​10208, #​10211). thisUsesUnstableApi() is @Deprecated and has a default implementation. CallCredentials implementations should delete their implementation or remove @Overrides, as the method will be deleted in the future.
• api: Stabilize the ProxyDetector hierarchy and ManagedChannelBuilder.proxyDetector method.

Behavior Changes

• core: Sticky TRANSIENT_FAILURE in PickFirstLoadBalancer (#​10106). See gRFC A62. If it can't connect, pick-first will now immediately fail RPCs until after it successfully connects. RPCs will no longer be delayed while it performs those attempts, which previously could cause significant (error) latency. It now also performs reconnect attempts after failure and backoff without prompting; previously it required an RPC to trigger the reconnect. ManagedChannel.idleTimeout (defaults to 30 minutes) still applies and forces the channel idle after a period of no RPCs.
• stub: Add a null check for responseObserver into the methods for initiating a call that takes a responseObserver argument. This ensures a fail fast with a clearer cause instead of an NPE when the observer is first used.
• xds: Flip default for RLS being enabled to true for XDS (#​10248) (#​10252). If there are no RLS configurations in your XDS or you already enabled it with the environment variable this will have no effect. To disable it, set the flag GRPC_EXPERIMENTAL_XDS_RLS_LB to false.
• xds: Rename weighted_round_robin_experimental LB Policy to weighted_round_robin (#​10162).

New Features

• protobuf,protobuf-lite: Allow to configure protobuf recursion limit (#​10094).
• core: Optional address shuffle in PickFirstLoadBalancer (#​10110).
• xds: pick_first LB configuration (#​10181).

Improvements

• xds: Add error-per-second in weight formula for client-side WRR (#​10177).
• xds: Use application_utilization and fallback to cpu_utilization if unset in weight formula for client-side WRR. (#​10256).
• bazel: The README now mentions Bazel and where to find the example. (#​10217).

Bug Fixes

• binder: Handle unexpected exceptions on binder threads. (#​10092.
• ​​android,binder,cronet: .aar file when publishing. (#​10138).
• api: Fix boundary check in Status.fromCodeValue(). (#​10155).
• core: Don't use system Locale for content-type matching. (#​10097).
• okhttp: Fix signed-byte comparison in server when checking for ASCII in header (#​10151). Without fix, authority could contain utf-8.

Dependencies

• Version pinning (e.g., [1.56.0] instead of 1.56.0) has been removed from POMs, for both Netty and gRPC dependencies. The pinning was unreliable in Maven and ignored in Gradle, yet caused downloads during the build to fetch the version list. For a while we've had a BOM that helps reduce version skew. (#​10175).
• bazel: Add java toolchain type to all rules using java_common. (#​10225).
• Upgraded netty-tcnative-boringssl-static in grpc-netty-shaded to 2.0.61.Final (#​10260). Netty itself was not updated.
• Upgraded AndroidX Annotation to 1.6.0 (#​10178).
• Upgraded AndroidX Core to 1.10.0 (#​10178).
• Upgraded AndroidX Lifecycle-Common to 2.6.1 (#​10178).
• Upgraded OpenCensus to 0.31.1 (#​10178).
• Upgraded Cronet API to 108.5359.79 (#​10178).
• Upgraded proto-google-common-protos to 2.17.0 (#​10178).
• Upgraded Gson to 2.10.1 (#​10178).
• Upgraded PerfMark API to 0.26.0 (#​10178).
• Upgraded RE2/J to 1.7 (#​10178).

Acknowledgements

• @​chenwei321
• @​cushon
• @​kloyan
• @​kotlaja
• @​vorburger

v1.55.3

Bug fixes

• core: Fix regression in 1.54.0 where polling NameResolvers would not refresh after a resolution error (#​10328). The symptom is a transient failure like "UNAVAILABLE: Unable to resolve host" continuing potentially forever. This did not impact DnsNameResolver, but it did impacted GrpclbNameResolver which is the dns name resolver used when grpc-grpclb is in the classpath. So even users that think "I don't use grpclb" may have been impacted. round_robin is mainly impacted on startup, but if the error happened afterward it would commonly fix itself for short transient DNS failures. pick_first is impacted at all times; any failed DNS resolution could cause all future RPCs on the channel to fail.

v1.55.1

The 1.55.0 release failed. There were no artifacts published for it.

API Changes

• services: Rename MetricRecorder.setQps/clearQps to setQpsMetric/clearQpsMetric (#​10031)

Behavior Changes

• gcp-observability: Remove monitored resource detection for logging (https:/grpc/grpc-java/pull/10020). The cloud libraries will fill in these details instead
• protoc-gen-grpc-java: binaries for Linux ARM and PPC are now built using Ubuntu 18.04. They will no longer work on Ubuntu 16.04 and Debian 9

New Features

• api: Stabilize the frequently used compression APIs (#​9942): CallOptions.withCompression, CallOptions.getCompressor, AbstractStub.withCompression, ServerCall.setCompression, ServerCall.setMessageCompression
• api: Stabilize Detachable and HasByteBuffer
• gcp-observability: Stabilize GcpObservability (https:/grpc/grpc-java/pull/10024). The GcpObservability API provides a simple way to export logging, tracing, and metrics to Google Cloud Operations. See the Google Cloud blog post.
• census: Add new tracer annotation to indicate the time when name resolution completed for those RPCs that experienced name resolution delay, or the time when picking subchannel completed for those RPCs that experienced picking subchannel delay. (#​10014, #​10044)
• protoc-gen-grpc-java: binary for s390x is now published (#​9455). The glibc version used is available in Ubuntu 20.04, Debian 11, and CentOS 9 and later
• authz: Added FileWatcherAuthorizationServerInterceptor (#​9775)
• services: Added OrcaMetricReportingServerInterceptor.create(MetricRecorder) which adds common metrics per-RPC (#​9902)
• android: Add UdsChannelBuilder for using LocalSocket an Android (#​8418)
• alts: Observe the GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES environment variable user to adjust the max number of concurrent ALTS handshakes (#​10016)
• binder: Expose client identity via PeerUid and PeerUids (#​9952)
• binder: Add BindServiceFlags.setAllowActivityStarts() for BIND_ALLOW_ACTIVITY_STARTS added in Android U (#​10008)

Bug Fixes

• core: Fix NPE race during hedging (https:/grpc/grpc-java/pull/10007), fixing a Netty buffer memory leak for cancelled RPCs
• core: Allow transparent retries after a retry attempt and the configured max retries was 1 (#​10066)
• okhttp: properly implement OkHttpServerBuilder.maxConnectionAgeGrace() (#​9968)
• xds: Enable federation support. See gRFC A47
• xds: Enable Weighted Round Robin LB policy support. See gRFC A58
• xds: Avoid ClassCastException if the control plane changes the top-level policy (#​10091). This is expected to be unlikely, but is possible
• xds: Fix java.util.NoSuchElementException: SecurityProtocolNegotiators$ClientSdsHandler#​0 (#​10118). This error did not cause any problems, other than unnecessary logging
• xds: Avoid using the default locale for case insensitive path matching (#​10148)
• googleapis: Enable ignore_resource_deletion for google-c2p: resolver’s default xds bootstrap (#​10121)
• rls: Refresh name resolution on rejected addresses (#​10032)

New Examples

• Keepalive (#​9956)
• Cancellation (#​9962)
• Deadline (#​9958)
• Using waitForReady (#​9960)
• Client and Server sharing (#​9969)
• Reflection (#​9955)
• Doing debug (#​9957)
• Health service (#​9991)
• Error details (#​9997)
• Custom load balancing (#​9951)
• gRPC-level reverse proxy (#​10059)

Dependencies

• protobuf-java and protobuf-java-util upgraded to 3.22.3 (#​10045)

Acknowledgements

• @​carl-mastrangelo
• @​haubenr
• @​jpd236
• @​kenk42292

v1.54.2

Bug Fixes

• core: Fix regression in 1.54.0 where polling NameResolvers would not refresh after a resolution error (https:/grpc/grpc-java/pull/10328). The symptom is a transient failure like "UNAVAILABLE: Unable to resolve host" continuing potentially forever. This did not impact DnsNameResolver, but it did impacted GrpclbNameResolver which is the dns name resolver used when grpc-grpclb is in the classpath. So even users that think "I don't use grpclb" may have been impacted. round_robin is mainly impacted on startup, but if the error happened afterward it would commonly fix itself for short transient DNS failures. pick_first is impacted at all times; any failed DNS resolution could cause all future RPCs on the channel to fail.
• xds: Avoid using the default locale for case insensitive path matching (#​10149)
• xds: Avoid potential channel panic when control plane changes the field used to configure load balancing (#​10103)
• core: Allow transparent retries after a retry attempt and the configured max retries was 1 (#​10080)

v1.54.1

Bug Fixes

• core: Fix NPE race during hedging (https:/grpc/grpc-java/pull/10046), fixing a Netty buffer memory leak for cancelled RPCs

Behavior Changes

• gcp-observability: Remove monitored resource detection for logging (https:/grpc/grpc-java/pull/10026). The cloud libraries will fill in these details instead

API stabilizations

• Stabilize GcpObservability (https:/grpc/grpc-java/pull/10027)
  • The GcpObservability API provides users with a simple way to export logging, tracing, and metrics to Google Cloud Operations. For more information, please see this blog post.

v1.54.0

New Features

• xds: Add weightedRoundRobin LB policy. The WRR policy allows picking the subchannel by weight based on the metrics feedback from the backend using ORCA API. See gRFC A58: Weighted Round Robin LB Policy. (#​9873)
• census: Add per call latency metric which is latency across all attempts (#​9906)
• Generated code now has an interface named AsyncService that the <service-name>ImplBase class implements. This allows you to provide your own base class when used with the static <service-name>Grpc.bindService(AsyncService) method(#​9688).

Examples

• Add examples for gcp observability (#​9967)

Bugfixes

• rls:Fix throttling in route lookup where success and error metrics had been inverted (b/262779100) (#​9874)
• protobuf: update external javadoc link (#​9890)
• core: fix outlier detection default ejection time (#​9889)
• xds: deletion only to watchers of same control plane (#​9896)
• api: Target scheme is now properly case insensitive (#​9899). NameResolverProviders, however, are expected to return the scheme used for registration in lower-case
• api: ForwardingServerCall now forwards getMethodDescriptor(). Previously only SimpleForwardingServerCall forwarded the method

Behavior Changes

• xds:Allow a cluster’s sum of weights to exceed the maximum signed integer up to a limit of max unsigned integer (#​9864)
• grpclb: no SRV lookup for "metadata.google.internal."

Improvements

• xds, orca: Allow removing OobLoadReportListener from a subchannel in OrcaOobUil. (#​9881)
• services: ORCA API change to allow recording QPS in MetricRecorder and CallMetricRecorder. (#​9866)
• Move name resolution retry from managed channel to name resolver (take #​2) (#​9812)
• Rename AbstractXdsClient to ControlPlaneClient (#​9934)
• all: fix build with errorprone 2.18 (#​9886)
• build: allow Java 11+ to use modern error prone
• errorprone: enable UnnecessaryAnonymousClass (#​9927)
• core: add logger to OutlierDetectionLoadBalancer (#​9880)
• census: add trace annotation to report received message sizes (#​9944)
• gcp-observability: emit latency and payload size metrics by default when monitoring is enabled (#​9893)
• gcp-observability: add trace information like TraceId and SpanId in logs for log correlation when both logging and traces are enabled (#​9963)
• gcp-observability: close() will take longer, to ensure metrics and traces are flushed (#​9972)
• gcp-observability: update status code type in logs to Google RPC code instead of an integer (#​9959)
• gcp-observability: retain default opencensus-task identifier even when custom labels are specified in the configuration (#​9982)
• Build Improvements (#​9855)
• Fixes MethodDescriptor java documentation (#​9860)
• api: forward getSecurityLevel on PartialForwardingServerCall (#​9912)
• Updating ServerInterceptors.java to support different marshallers for Request and Response messages. (#​9877)

API stabilizations

• Stabilize method ServerBuilder.intercept which had previously been marked experimental. (#​9894)
• api:stabilize offloadExecutor usage in ManagedChannelBuilder and NameResolver. (#​9931)

Dependencies

• netty:Upgrade Netty from 4.1.79 to 4.1.87, tcnative from 2.0.54 to 2.0.56 (#​9784)
• gcp-observability: Transitive gRPC components now have the same gRPC version
• gcp-observability : Google cloud logging updated to 3.14.5

Acknowledgements

@​benjaminp
@​s-matyukevich
@​Faqa
@​antechrestos
@​carl-mastrangelo
@​ioanbsu

v1.53.0

New Features

• googleapis: Allow user set c2p bootstrap config (#​9856)
• xds: Add contain and stringMatcher in RouteConfiguration (#​9845)
• core: Add grpc-previous-rpc-attempts to the initial response metadata (#​9686)
• servlet: Implement gRPC server as a Servlet (#​8596)
• authz: Implement static authorization server interceptor (#​8934)

Examples

• servlet: Add servlet example (#​8596)

Bug Fixes

• xds: Update xds error handling logic. Specifically:
  • When the ads stream is closed only send errors to subscribers that haven't yet gotten results
  • Timers to detect missing resources don’t start until the adsStream is ready (#​9745)
  • Call subscriber onError callback when xds client fails to connect to server (#​9827)
• core: Delay retriable stream master listener close until all sub streams are closed. This fixes the call executor lifecycle and prevents potential RejectedExecutionException. (#​9754)
• core: Free unused MessageProducer in RetriableStream (#​9853), fixing a Netty buffer memory leak for cancelled RPCs
• api: Fail with NullPointerException when a Metadata.Marshaller returns null bytes (#​9781). This would previously cause a NullPointerException later during the RPC. Now the return value of the Marshaller is checked immediately, to help find the broken Marshaller

Behavior Changes

• xds: Disallow duplicate addresses in the RingHashLB. (#​9776)
• xds: EDS weight sums are allowed up to max unsigned int (was max signed int) (#​9765)
• xds: Drop xds v2 support (#​9760)

Dependencies

• JUnit upgraded to 4.13.2
• bazel: Dropped support for Bazel 4. We track the two most recent major versions of Bazel, Bazel 5 and 6. Bazel 4 may still work, but we are no longer testing it
• bazel: Include Tomcat annotations dependency for @Generated as used by autovalue (#​9762). Necessary for building xds and rls on Java 9+
• bazel: Export deps from Maven Central-specific stand-in targets (#​9780). Some Maven Central artifacts are a combination of multiple Bazel targets, like grpc-core is composed of //core:inprocess, //core:internal, //core:util, //api. There is a “//core:core_maven” target used by maven_install that uses the other targets. Previously the target used runtime_deps to discourage their use by Bazel users, but that could cause compilation failures from lack of hjars. These targets now use exports

Acknowledgement

@​cpovirk
@​niloc132
@​stephenh
@​olderwei
@​pandaapo
@​panxuefeng

v1.52.1

Bug Fixes

• xds: Fix an internal bug in xds resource subscription that might cause xds stream not accepting response update for that resource type entirely. (#​9810)

v1.52.0

gRPC Java 1.52.0 Release Notes

grpc-xds starting with 1.51.0 had a regression where resources might stop receiving updates. The trigger could happen hours or days after the binary had started. xDS users should avoid this release and use 1.50.x until patch releases with the fix are available. https:/grpc/grpc-java/pull/9809

API Changes

• Fix CallOptions to be properly @Immutable (#​9689)
• binder: Promote out of experimental status (#​9669). Much of the API is now stable

New Features

• xds: Support localities in multiple priorities (#​9683)
• xds: Log xDS node ID with verbosity INFO when environment variable GRPC_LOG_XDS_NODE_ID=true (#​9731)

Examples

• Add examples for name resolver and load balancer (#​9700)
• Swap to ChannelCredentials/ServerCredentials API, as it is preferred

Bug Fixes

• xds:Fix ConcurrentModificationException in PriorityLoadBalancer (#​9728)
• ManagedChannelImpl.SubchannelImpl fix args check to avoid NPE (#​9651)
• okhttp: Add missing server support for TLS ClientAuth (#​9711)
• binder: Ensure the security interceptor is always closest to the actual transport (#​9716)
• bazel: Include @​Generated dep for autovalue. This fixes builds of xds and rls using Java 9+
• xds: Nack xds response when weighted cluster total weight sums zero (#​9738)
• core: Fix a bug about a retriable stream lifecycle. It stops using the call executor resource in a retriable stream when the client call is closed, thus preventing potential channel panics. (#​9626)

Behavior Changes

• binder: Set default idle timeout to 60 seconds, and enable "strict lifecycle management". (#​9486)
• xds: Limit ring hash max size to 4K instead of 8M (#​9709). RingHashOptions.setRingSizeCap() can increase the limit
• binder: Set default idle timeout to 60 seconds, and add BinderChannelBuilder.strictLifecycleManagement() which disables idle timeout and prevents it from being changed (#​9486). Disabling idle timeout can be useful to find bugs in applications that fail to promptly shut down the channel and are particularly sensitive to keeping Binder instances alive.
• bazel: Replace ctx.host_configuration.host_path_separator with ctx.configuration.host_path_separator (#​9742). This changes no behavior today, but improves future compatibility with newer versions of Bazel
• xds: Refactor internal logics about LDS and CDS resource handling. It may cause minor log line changes about corresponding RDS and EDS subscriber event notification, but it should not change xds name resolution and LB behavior. (#​9724)

Dependencies

Acknowledgement

@​RapperCL
@​Smityz
@​pandaapo

v1.51.3

Bug Fixes

• xds: Fix an internal bug in xds resource subscription that might cause xds stream not accepting response update for that resource type entirely. (https:/grpc/grpc-java/pull/9811)

v1.51.1

grpc-xds starting with 1.51.0 had a regression where resources might stop receiving updates. The trigger could happen hours or days after the binary had started. xDS users should avoid this release and use 1.50.x until patch releases with the fix are available. https:/grpc/grpc-java/pull/9809

Bug Fixes

• xds: Fix ConcurrentModificationException in PriorityLoadBalancer. (#​9744)

v1.51.0

grpc-xds starting with 1.51.0 had a regression where resources might stop receiving updates. The trigger could happen hours or days after the binary had started. xDS users should avoid this release and use 1.50.x until patch releases with the fix are available. https:/grpc/grpc-java/pull/9809

Bug Fixes

• grpclb: Fix a debug logging message which incorrectly logged loadbalancer addresses under backend addresses. (#​9602)

New Features

• okhttp: okhttp server now supports maxConnectionAge and maxConnectionAgeGrace configuration for improved connection management. (#​9649)

Behavior Changes

• netty: switch default cumulation strategy from MERGE to ADAPTIVE. When accumulating incoming network data, Adaptive cumulator dynamically switches between MERGE and COMPOSE strategies to minimize the amount of copying while also limiting per-buffer overhead. (#​9558)

Acknowledgements

@​TrevorEdwards

---

• If you want to rebase/retry this PR, check this box