Vulnerability in protobuf-java

[salaboy]

Expected Behavior

A HIGH vulnerability was found in pkg:maven/com.google.protobuf/protobuf-java@3.25.1

To solve this we should upgrade the GRPC library pkg:maven/io.grpc/grpc-protobuf@1.64.0 to https://central.sonatype.com/artifact/io.grpc/grpc-protobuf/1.68.2
which brings a new version of com.google.protobuf/protobuf-java -> 3.25.1

Actual Behavior

Steps to Reproduce the Problem

Release Note

RELEASE NOTE:

[salaboy]

There are still some transitive dependency issues with 1.64.0, we should use 1.69.0

+--- io.dapr:dapr-sdk:1.13.1
|    +--- io.dapr:dapr-sdk-autogen:1.13.1
|    |    +--- io.grpc:grpc-protobuf:1.64.0
|    |    |    +--- io.grpc:grpc-api:1.64.0 (*)
|    |    |    +--- com.google.code.findbugs:jsr305:3.0.2
|    |    |    +--- com.google.protobuf:protobuf-java:3.25.1
|    |    |    +--- com.google.api.grpc:proto-google-common-protos:2.29.0
|    |    |    |    \--- com.google.protobuf:protobuf-java:3.25.1

[salaboy]

PR sent that align all versions:

salaboy@salaboyMBP java-sdk % mvn dependency:tree | grep protobuf-java
[INFO] |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |     +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO]    |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] |  +- com.google.protobuf:protobuf-java:jar:3.25.5:compile
[INFO] +- com.google.protobuf:protobuf-java-util:jar:3.25.5:compile