fix: update netty due to vuln (#47)

Author: aaron-steinfeld

grpc-client-utils/build.gradle.kts

@@ -10,8 +10,8 @@ dependencies {
   api(platform("io.grpc:grpc-bom:1.56.0"))
   api("io.grpc:grpc-context")
   api("io.grpc:grpc-api")
-  api(platform("io.netty:netty-bom:4.1.86.Final")) {
-    because("CVE-2022-41881")
+  api(platform("io.netty:netty-bom:4.1.94.Final")) {
+    because("CVE-2023-34462")
   }
 
   implementation(project(":grpc-context-utils"))

grpc-server-utils/build.gradle.kts

@@ -14,8 +14,8 @@ dependencies {
   api("io.grpc:grpc-context")
   api("io.grpc:grpc-api")
 
-  api(platform("io.netty:netty-bom:4.1.86.Final")) {
-    because("CVE-2022-41881")
+  api(platform("io.netty:netty-bom:4.1.94.Final")) {
+    because("CVE-2023-34462")
   }
 
   implementation(project(":grpc-context-utils"))

owasp-suppressions.xml

@@ -1,3 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress>
+        <notes><![CDATA[
+   Any hypertrace dep
+   ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.hypertrace\..*@.*$</packageUrl>
+        <cpe>cpe:/a:grpc:grpc</cpe>
+    </suppress>
 </suppressions>