Protobuf-java was upgraded to 4.28.2 to address google#4584. The vulnerability [CVE-2024-7254](GHSA-735f-pc8j-v9w8) is fixed in protobuf-java 3.25.5, as initially suggested in google#4584. Protobuf-java saw major breaking changes in 4.26, partially mitigated in the 27 series. Because it takes time to adopt to these breaking changes, it is better I think to only address the vulnerability and not jump into the breaking releases yet. Specifically, the problem is that now everyone that uses error-prone is forced to jump to the breaking Protobuf releases today. This includes all users of the chain of Google BOMs (libraries-bom, first-party-dependencies, google-cloud-bom and gapic-generator-java-bom). Those still reference 3.25.5 [1]. This PR fixes the issue. I think error-prone should then be released and included in gapic-generator-java-pom-parent. Thank you! [1] https://github.com/googleapis/sdk-platform-java/blob/main/gapic-generator-java-pom-parent/pom.xml#L34

Google protobuf vulnerability #4584

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions