[Snyk] Fix for 1 vulnerabilities

[caniszczyk]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• functions-framework-invoker/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Missing Release of Memory after Effective Lifetime SNYK-JAVA-ORGECLIPSEJETTY-18230890	721	org.eclipse.jetty:jetty-server: 11.0.14 -> 11.0.23 org.eclipse.jetty:jetty-servlet: 11.0.14 -> 11.0.23 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Missing Release of Memory after Effective Lifetime

[caniszczyk]

This upgrade from version 11.0.14 to 11.0.23 for jetty-server and jetty-servlet is a minor version update within an End-of-Life (EOL) release line. While it contains important security fixes, it also introduces a behavioral change related to transitive dependencies that may require action.

Key Changes:

• Potential Transitive Dependency Breakage: Starting with version 11.0.16, a change was made where websocket-jetty-server no longer includes jetty-annotations as a transitive dependency. Applications that rely on this for JSP compilation may experience a NullPointerException at runtime.
• Security Fixes: This range includes patches for multiple vulnerabilities, including CVE-2023-36478 (High Severity Information Disclosure) and CVE-2023-44487 (HTTP/2 Rapid Reset Attack).
• Cookie Parsing: Version 11.0.15 adjusts cookie parsing to be more tolerant of non-compliant cookies compared to 11.0.14.

Recommendation:
After upgrading, verify applications that use JSPs. If you encounter a NullPointerException related to JSP compilation or TldCache, explicitly add org.eclipse.jetty:jetty-annotations as a dependency to your project.

Source: GitHub Issue #10766, Jetty Release Announcements

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}