Batched Dependabot updates

[dependabot-batcher]

This PR was created by the Dependabot Batcher Action by combining the following PRs:

Sun Jul 09 2023

• Bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.102.0 to 1.103.0 in /assets/aws #28862
• Bump golang.org/x/oauth2 from 0.9.0 to 0.10.0 in /build.assets/tooling #28861
• Bump google.golang.org/grpc from 1.56.1 to 1.56.2 in /api #28860
• Bump cloud.google.com/go/iam from 1.1.0 to 1.1.1 #28859
• Bump golang.org/x/oauth2 from 0.9.0 to 0.10.0 in /assets/backport #28858
• Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.35.0 to 1.36.0 #28857
• Bump github.com/aws/aws-sdk-go-v2/service/glue from 1.53.0 to 1.54.0 #28856
• Bump github.com/aws/aws-sdk-go-v2/service/sqs from 1.22.0 to 1.23.2 #28855
• Bump github.com/bufbuild/connect-go from 1.7.0 to 1.9.0 #28854
• Bump k8s.io/apiextensions-apiserver from 0.27.2 to 0.27.3 #28852
• Bump github.com/sashabaranov/go-openai from 1.12.0 to 1.13.0 #28850
• Bump golang.org/x/oauth2 from 0.9.0 to 0.10.0 #28849
• Bump tough-cookie from 4.1.2 to 4.1.3 #28840
• Bump google.golang.org/grpc from 1.52.3 to 1.53.0 in /examples/desktop-registration #28736
• Bump @grpc/grpc-js from 1.6.7 to 1.8.8 #28735
• Bump google.golang.org/grpc from 1.43.0 to 1.53.0 in /examples/go-client #28728
• Bump github.com/aws/aws-sdk-go-v2/service/rds from 1.44.1 to 1.46.1 #28851
• Bump github.com/aws/aws-sdk-go-v2/service/ecs from 1.27.1 to 1.28.0 #28853

[rosstimothy]

@ravicious @gzdunek will this and the corresponding yarn.lock changes cause any issues?

[gzdunek]

It should be fine, I didn't see any breaking changes in the changelog. I also didn't notice any problems when testing locally.

[ravicious]

Do we typically backport those to all active release branches?

[rosstimothy]

Do we typically backport those to all active release branches?

No. Dependency updates are generally only backported to address a CVE or if they are critical to a feature or fixing a bug.

[jentfoo]

@rosstimothy and @codingllama, in this case this update did address a couple CVE's:

• https://github.com/gravitational/teleport/security/dependabot/176
• https://github.com/gravitational/teleport/security/dependabot/177

Can we get the protobufjs and tough-cookie npm updates backported?

[rosstimothy]

@rosstimothy and @codingllama, in this case this update did address a couple CVE's:

• protobufjs Prototype Pollution vulnerability
• tough-cookie Prototype Pollution vulnerability

Can we get the protobufjs and tough-cookie npm updates backported?

@jentfoo like with previous CVE updates I would update the dependencies directly on the release branches instead of trying to backport dependatbot PRs. You're likely to have a much easier time that way than trying to resolve any conflicts which may arise from a backport.

[rosstimothy]

@jentfoo see the following for updates to release branches:

• [v11] Update tough-cookie and @grpc/grpc-js #28916
• [v12] Update tough-cookie and @grpc/grpc-js #28915
• [v13] Update tough-cookie and @grpc/grpc-js #28914

[jentfoo]

Thank you @rosstimothy! We need to figure out how to automate these still too, but till then I will keep trying to watch for anything slipping through the cracks.