[Snyk] Security upgrade io.grpc:grpc-all from 1.45.1 to 1.83.0

[chrislin22]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Infinite loop SNYK-JAVA-IONETTY-18230935	721	io.grpc:grpc-all: 1.45.1 -> 1.83.0 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[chrislin22]

This is a significant major version upgrade across nearly 40 minor versions, introducing several breaking changes that require developer action and thorough testing.

Key Breaking Changes:

• ABI Breakage (as of v1.59.0): Internal builder classes (AbstractManagedChannelImplBuilder, AbstractServerImplBuilder) were removed. The release notes state that applications compiled with gRPC versions prior to 1.36.0 (which includes your starting version of 1.45.1) may need to be recompiled to work correctly.

• Android Minimum API Level: The minimum supported Android API level has been raised to 23 (Marshmallow). Projects targeting older Android versions will need to update their minSdkVersion.

• Exception Type Change (as of v1.74.0): The newer v2 blocking stub for unary RPCs now throws a checked StatusException instead of the previous unchecked StatusRuntimeException. This will require changes to error handling logic for any code using this stub.

• API Deprecations and Signature Changes:

  • StreamObservers was deprecated in v1.60.0.
  • LoadBalancer.acceptResolvedAddresses() changed its return type from boolean to Status in v1.60.0, affecting custom load balancer implementations.

Recommendation:
Due to the high number of changes and the explicit ABI break, a simple dependency bump is not recommended. Developers should:

1. Recompile their entire project against the new gRPC version.
2. Review and update error handling for blocking stubs to catch the new StatusException.
3. For Android projects, ensure the minSdkVersion is at least 23.
4. Review the release notes for the entire version range for other behavioral changes and dependency updates (e.g., Netty, Protobuf) that may impact the application.

Source: gRPC-Java GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.