fix CVE-2024-7254

CHANGES.md

@@ -9,7 +9,8 @@ Release Notes.
 * Add agent self-observability.
 * Fix intermittent ClassCircularityError by preloading ThreadLocalRandom since ByteBuddy 1.12.11
 * Add witness class/method for resteasy-server plugin(v3/v4/v6)
-* Add async-profiler feature for performance analysis 
+* Add async-profiler feature for performance analysis
+* Upgrade grpc-protobuf to 1.68.1
 
 All issues and pull requests are [here](https://github.com/apache/skywalking/milestone/222?closed=1)
 

dist-material/LICENSE

@@ -216,7 +216,7 @@ The following components are provided under the Apache License. See project link
 The text of each license is the standard Apache 2.0 license.
 
     raphw (byte-buddy) 1.14.9: http://bytebuddy.net/ , Apache 2.0
-    Google: grpc-java 1.53.0: https://github.com/grpc/grpc-java, Apache 2.0
+    Google: grpc-java 1.68.1: https://github.com/grpc/grpc-java, Apache 2.0
     Google: gson 2.8.9: https://github.com/google/gson , Apache 2.0
     Google: proto-google-common-protos 2.0.1: https://github.com/googleapis/googleapis , Apache 2.0
     Google: jsr305 3.0.2: http://central.maven.org/maven2/com/google/code/findbugs/jsr305/3.0.0/jsr305-3.0.0.pom , Apache 2.0

pom.xml

@@ -87,7 +87,7 @@
 
         <!-- core lib dependency -->
         <bytebuddy.version>1.14.9</bytebuddy.version>
-        <grpc.version>1.53.0</grpc.version>
+        <grpc.version>1.68.1</grpc.version>
         <netty.version>4.1.100.Final</netty.version>
         <gson.version>2.8.9</gson.version>
         <os-maven-plugin.version>1.6.2</os-maven-plugin.version>