Update protobuf-java to address CVE-2024-7254

bestbeforetoday · ejona86 · commit 2ff837ab6007 · 2024-09-24T07:39:50.000-07:00
Signed-off-by: Mark S. Lewis &lt;Mark.S.Lewis@outlook.com&gt;
diff --git a/examples/build.gradle b/examples/build.gradle
@@ -24,7 +24,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.3'
+def protobufVersion = '3.25.5'
 def protocVersion = protobufVersion
 
 dependencies {
diff --git a/examples/example-alts/build.gradle b/examples/example-alts/build.gradle
@@ -25,7 +25,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 
 dependencies {
     // grpc-alts transitively depends on grpc-netty-shaded, grpc-protobuf, and grpc-stub
diff --git a/examples/example-debug/build.gradle b/examples/example-debug/build.gradle
@@ -26,7 +26,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.3'
+def protobufVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/example-debug/pom.xml b/examples/example-debug/pom.xml
@@ -13,7 +13,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protoc.version>3.25.3</protoc.version>
+    <protoc.version>3.25.5</protoc.version>
     <!-- required for jdk9 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/examples/example-dualstack/build.gradle b/examples/example-dualstack/build.gradle
@@ -26,7 +26,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.3'
+def protobufVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/example-dualstack/pom.xml b/examples/example-dualstack/pom.xml
@@ -13,7 +13,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protoc.version>3.25.3</protoc.version>
+    <protoc.version>3.25.5</protoc.version>
     <!-- required for jdk9 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/examples/example-gauth/build.gradle b/examples/example-gauth/build.gradle
@@ -25,7 +25,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.3'
+def protobufVersion = '3.25.5'
 def protocVersion = protobufVersion
 
 
diff --git a/examples/example-gauth/pom.xml b/examples/example-gauth/pom.xml
@@ -13,7 +13,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protobuf.version>3.25.3</protobuf.version>
+    <protobuf.version>3.25.5</protobuf.version>
     <!-- required for jdk9 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/examples/example-gcp-csm-observability/build.gradle b/examples/example-gcp-csm-observability/build.gradle
@@ -26,7 +26,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 def openTelemetryVersion = '1.40.0'
 def openTelemetryPrometheusVersion = '1.40.0-alpha'
 
diff --git a/examples/example-gcp-observability/build.gradle b/examples/example-gcp-observability/build.gradle
@@ -26,7 +26,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/example-hostname/build.gradle b/examples/example-hostname/build.gradle
@@ -24,7 +24,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.3'
+def protobufVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/example-hostname/pom.xml b/examples/example-hostname/pom.xml
@@ -13,7 +13,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protoc.version>3.25.3</protoc.version>
+    <protoc.version>3.25.5</protoc.version>
     <!-- required for jdk9 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/examples/example-jwt-auth/build.gradle b/examples/example-jwt-auth/build.gradle
@@ -24,7 +24,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.3'
+def protobufVersion = '3.25.5'
 def protocVersion = protobufVersion
 
 dependencies {
diff --git a/examples/example-jwt-auth/pom.xml b/examples/example-jwt-auth/pom.xml
@@ -14,8 +14,8 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protobuf.version>3.25.3</protobuf.version>
-    <protoc.version>3.25.3</protoc.version>
+    <protobuf.version>3.25.5</protobuf.version>
+    <protoc.version>3.25.5</protoc.version>
     <!-- required for jdk9 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/examples/example-oauth/build.gradle b/examples/example-oauth/build.gradle
@@ -24,7 +24,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protobufVersion = '3.25.3'
+def protobufVersion = '3.25.5'
 def protocVersion = protobufVersion
 
 dependencies {
diff --git a/examples/example-oauth/pom.xml b/examples/example-oauth/pom.xml
@@ -14,8 +14,8 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protobuf.version>3.25.3</protobuf.version>
-    <protoc.version>3.25.3</protoc.version>
+    <protobuf.version>3.25.5</protobuf.version>
+    <protoc.version>3.25.5</protoc.version>
     <!-- required for jdk9 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/examples/example-opentelemetry/build.gradle b/examples/example-opentelemetry/build.gradle
@@ -25,7 +25,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 def openTelemetryVersion = '1.40.0'
 def openTelemetryPrometheusVersion = '1.40.0-alpha'
 
diff --git a/examples/example-orca/build.gradle b/examples/example-orca/build.gradle
@@ -19,7 +19,7 @@ java {
 }
 
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/example-reflection/build.gradle b/examples/example-reflection/build.gradle
@@ -19,7 +19,7 @@ java {
 }
 
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/example-servlet/build.gradle b/examples/example-servlet/build.gradle
@@ -17,7 +17,7 @@ java {
 }
 
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}",
diff --git a/examples/example-tls/build.gradle b/examples/example-tls/build.gradle
@@ -25,7 +25,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/example-tls/pom.xml b/examples/example-tls/pom.xml
@@ -13,7 +13,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protoc.version>3.25.3</protoc.version>
+    <protoc.version>3.25.5</protoc.version>
     <!-- required for jdk9 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/examples/example-xds/build.gradle b/examples/example-xds/build.gradle
@@ -24,7 +24,7 @@ java {
 // Feel free to delete the comment at the next line. It is just for safely
 // updating the version in our release process.
 def grpcVersion = '1.68.0-SNAPSHOT' // CURRENT_GRPC_VERSION
-def protocVersion = '3.25.3'
+def protocVersion = '3.25.5'
 
 dependencies {
     implementation "io.grpc:grpc-protobuf:${grpcVersion}"
diff --git a/examples/pom.xml b/examples/pom.xml
@@ -13,8 +13,8 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <grpc.version>1.68.0-SNAPSHOT</grpc.version><!-- CURRENT_GRPC_VERSION -->
-    <protobuf.version>3.25.3</protobuf.version>
-    <protoc.version>3.25.3</protoc.version>
+    <protobuf.version>3.25.5</protobuf.version>
+    <protoc.version>3.25.5</protoc.version>
     <!-- required for JDK 8 -->
     <maven.compiler.source>1.8</maven.compiler.source>
     <maven.compiler.target>1.8</maven.compiler.target>
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -6,7 +6,7 @@ nettytcnative = '2.0.65.Final'
 opencensus = "0.31.1"
 # Not upgrading to 4.x as it is not yet ABI compatible.
 # https://github.com/protocolbuffers/protobuf/issues/17247
-protobuf = "3.25.3"
+protobuf = "3.25.5"
 
 [libraries]
 android-annotations = "com.google.android:annotations:4.1.1.4"
