[Bug] Upgrade Google Protobuf Java to remediate CVEs
- Dominant language
- Java
- Stars
- 22.6k
- Forks
- 12k
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 26
Description
### Before Creating the Bug Report
- [x] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq/discussions).
- [x] I have searched the [GitHub Issues](https://github.com/apache/rocketmq/issues) and [GitHub Discussions](https://github.com/apache/rocketmq/discussions) of this repository and believe that this is not a duplicate.
- [x] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.
### Runtime platform environment
All
### RocketMQ version
develop
### JDK Version
_No response_
### Describe the Bug
Upgraded Protobuf to 3.25.8 to remediate CVE-2022-3509, CVE-2022-3510 and CVE-2024-7254
### Steps to Reproduce
N/A
### What Did You Expect to See?
N/A
### What Did You See Instead?
N/A
### Additional Context
_No response_
Contributor guide
Research direction
Start by locating RocketMQ's Google Protobuf dependency declaration and confirm the currently resolved version. Review the listed CVEs and verify that the project resolves Protobuf 3.25.8; done means the dependency update is reflected and the relevant build or dependency checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100