GRPC Uses Outdated Version Of protobuf-java

[mr1716]

What version of gRPC-Java are you using?

1.47.0

It looks like the version of protobuf-java used is outdated. It is version 3.19.2, and there are versions 3.19.4, 3.20.0, 3.20.1, 3.20.0, and 3.20.1 available that dont have vulnerabilities. Would it be possible to upgrade to one of these versions?

[ejona86]

What vulnerability is in protobuf-java 3.19.2? 3.19.3 and 3.19.4 didn't have any Java changes.

You are always able to upgrade the version of our dependencies (except for netty). So even in the case of a vulnerability in protobuf you don't have to wait for us. We do updates to help the ecosystem stop using the vulnerable version, though.

[mr1716]

@ejona86 I am just offering options to use. I am not the most familiar with the tool and which options would be best

[ejona86]

Is there a problem you are experiencing? Upgrading protobuf isn't a one-line change, but we do try to do it regularly.