apache / apache/rocketmq

[Bug] Upgrade Google Protobuf Java to remediate CVEs

Open Beginner friendly
#10,097 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
22.6k
Forks
12k
Avg merge
2d 20h
Merged PRs (30d)
26

Description

### Before Creating the Bug Report

- [x] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq/discussions).

- [x] I have searched the [GitHub Issues](https://github.com/apache/rocketmq/issues) and [GitHub Discussions](https://github.com/apache/rocketmq/discussions) of this repository and believe that this is not a duplicate.

- [x] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.

### Runtime platform environment

All

### RocketMQ version

develop

### JDK Version

_No response_

### Describe the Bug

Upgraded Protobuf to 3.25.8 to remediate CVE-2022-3509, CVE-2022-3510 and CVE-2024-7254

### Steps to Reproduce

N/A

### What Did You Expect to See?

N/A

### What Did You See Instead?

N/A

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating RocketMQ's Google Protobuf dependency declaration and confirm the currently resolved version. Review the listed CVEs and verify that the project resolves Protobuf 3.25.8; done means the dependency update is reflected and the relevant build or dependency checks pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.