Bump grpc-stub from 1.13.1 to 1.23.0

[dependabot-preview]

⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

---

Bumps grpc-stub from 1.13.1 to 1.23.0.

Release notes

Sourced from grpc-stub's releases.

v1.23.0

This release resolves the DoS vulnerability CVE-2019-9515 (SETTINGS flood). Users using the grpc-netty server with untrusted clients should upgrade.

Dependencies

• Bump netty to 4.1.38
• Bump PerfMark to 0.17.0
• Bump protobuf to 3.9.0

Bug Fixes

• netty: Limit number of frames a client can cause the server to enqueue (#6056). Addresses CVE-2019-9515 (Settings flood). While grpc-java was not vulnerable to CVE-2019-9512 (Ping flood) nor CVE-2019-9514 (Reset flood), the fix provides protections against these attacks as well
• alts: Fix server hang (#5900)
• context: Fix race between CancellableContext and Context (#5981)
• stub: Avoid race in onHalfClose server StreamObserver (#5991)
• core: Avoid using partially-closed resources that threw during close in SharedResourceHolder (#6048). This avoids a permanent hang when using google-cloud-java. See Dataproc: RejectedExecutionException: event executor terminated googleapis/google-cloud-java#5810 and googleapis/google-cloud-java#5801

API Changes

• core: Add @Nullable to getter for trailers on StatusRuntimeException (#5951)
• core: ClientStream.getAttributes() can be called at any time (#5904)
• core,netty: Block server shutdown until the socket is unbound (#5905)
• netty: Users providing EventLoopGroup and/or ChannelType for NettyServerBuilder and NettyChannelBuilder requires to provide all of them or none. Otherwise, it will throw an IllegalStateException (#6014)

New Features

• Make //compiler:grpc_java_plugin publicly visible again (#5947)
• java_grpc_library.bzl: Work with proto_library rules using strip_import_prefix / import_prefix (#5959)
• Make .proto import path computation work with virtual protos in the main repository (#5967)
• core: Attach debug information about stream to DEADLINE_EXCEEDED (#5892)

Documentation

• Provide an example of hedging in examples
• compiler: Add note about where to download precompiled version of plugin (#6022)

Acknowledgements

@​aaliddell Adam Liddell
@​DarrienG Darrien Glasser
@​jadekler Jean de Klerk
@​lberki Lukacs T. Berki
@​liym stbridge
@​mkobit Mike Kobit
@​tiggerlee2 Shuangtai Li
@​zhaonian Zhaonian Luan

v1.22.2

This release resolves the DoS vulnerability CVE-2019-9515 (SETTINGS flood). Users using the grpc-netty server with untrusted clients should upgrade.

Bug fixes

• netty: Limit number of frames a client can cause the server to enqueue (#6056). Addresses CVE-2019-9515 (Settings flood). While grpc-java was not vulnerable to CVE-2019-9512 (Ping flood) nor CVE-2019-9514 (Reset flood), the fix provides protections against these attacks as well
• core: Avoid using partially-closed resources that threw during close in SharedResourceHolder (#6048). This avoids a permanent hang when using google-cloud-java. See Dataproc: RejectedExecutionException: event executor terminated googleapis/google-cloud-java#5810 and googleapis/google-cloud-java#5801

v1.22.1

... (truncated)

Commits

• b3ed852 Bump version to 1.23.0
• 0bb54b2 Update README etc to reference 1.23.0
• dd1315f netty: Limit number of frames client can cause server to enqueue
• 8779c6a core: handle removing partially-closed resources for throwing on close. Fixes...
• 79bc50c doc: fix version bug in documentation/android-channel-builder.md
• 188b4d1 compiler: add note about where to download precompiled version of plugin (#6022)
• 99993be xds: implement a server interceptor for taking server application metrics and...
• 50df56f xds: add a missing test case for CallMetricRecorder and polish test data. (#6...
• 57e7bd3 all: update to proto 3.9.0
• 65109e6 netty: Netty{Server,Channel}Builder requires all or none of ELG and ChannelTy...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.