Update protobuf-java to 3.25.6 #1748
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![scala-steward-asf[bot]](https://avatars.githubusercontent.com/in/407462?s=60&v=4){kind=small}
pjfanning
approved these changes
Jan 26, 2025
pjfanning
requested changes
Jan 26, 2025
There was a problem hiding this comment.
Error: [01/26/2025 00:23:59.363] [RemoteRouterSpec-pekko.remote.default-remote-dispatcher-7] [Deserializer(pekko://RemoteRouterSpec)] Failed to deserialize message from [unknown] with serializer id [17] and manifest [d].
java.lang.UnsupportedOperationException: As of 2022/09/29 (release 21.7) makeExtensionsImmutable should not be called from protobuf gencode. If you are seeing this message, your gencode is vulnerable to a denial of service attack. You should regenerate your code using protobuf 25.6 or later. Use the latest version that meets your needs. However, if you understand the risks and wish to continue with vulnerable gencode, you can set the system property `-Dcom.google.protobuf.use_unsafe_pre22_gencode` on the command line. See security vulnerability: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2
at org.apache.pekko.protobufv3.internal.GeneratedMessage.warnPre22Gencode(GeneratedMessage.java:327)
at org.apache.pekko.protobufv3.internal.GeneratedMessageV3.makeExtensionsImmutable(GeneratedMessageV3.java:531)
|
I'm confused by this error, suggesting this should not happen as of version 21.7 but then recommending to regenerate with 25.6 or later. I can regenerate the classes though. |
13 tasks
|
@raboof thanks for rebuilding the Java files. They are not regenerated by the Pekko build. It looks like protobuf-java 3.25.6 has a new check so that it insists that you have generated the source with a more up to date version of Protoc that we have used for recent upgrades. It does look like something we would want to fix up for the 1.2.0-M1 release. If this PR builds ok, it is enough - I'm not worried about automating the code generation. I was trying this myself but my Mac won't let me use the protoc file from Google's releases on GitHub. I was in the middle of building it myself. |
raboof
force-pushed
the
update/protobuf-java-3.25.6
branch
from
e3fa87a to
77f69ea
Compare
yeah, it's confusing to me that the error is referring to 21.7 but seems to trigger for all versions before 25.6, though.
agreed
ah, I used the 'assign' feature in GitHub to signal that I was looking into it (it didn't seem worth a comment) |
|
Looks like we have some more old java files in our tests (distributed data). Affects 2 tests. In the 'docs' module as opposed to the code modules. TwoPhaseSetMessages |
pjfanning
force-pushed
the
update/protobuf-java-3.25.6
branch
from
c6b2c87 to
77f69ea
Compare
raboof
force-pushed
the
update/protobuf-java-3.25.6
branch
from
77f69ea to
91c83dc
Compare
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
About this PR
📦 Updates com.google.protobuf:protobuf-java from
3.25.5to3.25.6📜 GitHub Release Notes - Version Diff
Usage
✅ Please merge!
I'll automatically update this PR to resolve conflicts as long as you don't change it yourself.
If you'd like to skip this version, you can just close this PR. If you have any feedback, just mention me in the comments below.
Configure Scala Steward for your repository with a
.scala-steward.conffile.Have a fantastic day writing Scala!
🔍 Files still referring to the old version number
The following files still refer to the old version number (3.25.5).
You might want to review and update them manually.
⚙ Adjust future updates
Add this to your
.scala-steward.conffile to ignore future updates of this dependency:Or, add this to slow down future updates of this dependency: