Bump grpc from 1.56.0 to 1.64.0 to address CVE list

[hezhangjian]

CVE-2023-44487(7.5), CVE-2023-4785(7.5), CVE-2023-33953(7.5)

[hezhangjian]

@dlg99 @eolivelli @hangc0276 @merlimat @nicoloboschi @StevenLuMT @wenbingshen @zhaijack PTAL

[hangc0276]

We need to be careful to upgrade grpc versions. Pulsar also uses grpc and the version needs to be sync and compatible

[hezhangjian]

We need to be careful to upgrade grpc versions. Pulsar also uses grpc and the version needs to be sync and compatible

I agree. But bk should go first.

[hezhangjian]

@lhotari please also take a look

[lhotari]

@lhotari please also take a look

protobuf version should be upgraded at the same time to ensure that it's compatible with grpc. Pick the version that grpc uses.

[hezhangjian]

@lhotari fixed, please take a look again. :)

[lhotari]

@lhotari fixed, please take a look again. :)

We could also migrate to use protobuf-bom in dependencyManagement.

      <dependency>
        <groupId>com.google.protobuf</groupId>
        <artifactId>protobuf-bom</artifactId>
        <version>${protobuf.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

[lhotari]

It looks like grpc 1.64.0 was released yesterday. Should we go directly to the latest release?

[lhotari]

LGTM

[hezhangjian]

@lhotari I aggree change the dest version to 1.64.0. updated.

[hezhangjian]

@lhotari I found owasp check is broken, it doesn't trigger when I change the pom.xml. do you have any advice?

bookkeeper/.github/workflows/bk-ci.yml

Lines 482 to 487 in c2e8037

	owasp-dependency-check:
	name: OWASP Dependency Check
	runs-on: ubuntu-latest
	timeout-minutes: 60
	needs: [ 'build-and-license-check' ]
	if: ${{ needs.build-and-license-check.outputs.need_owasp == 'true' }}

bookkeeper/.github/changes-filter.yaml

Lines 12 to 16 in c2e8037

	need_owasp:
	- 'pom.xml'
	- '**/pom.xml'
	- 'src/owasp-dependency-check-false-positives.xml'
	- 'src/owasp-dependency-check-suppressions.xml'