Merge pull request #676 from conductor-oss/upgrade-protobuf-4.33.0

Upgrade protobuf to 4.33.0 (Security Fix)

Author: nthmost-orkes

annotations-processor/build.gradle

@@ -8,7 +8,7 @@ dependencies {
     api 'com.google.guava:guava:31.1-jre'
     api 'com.squareup:javapoet:1.13.0'
     api 'com.github.jknack:handlebars:4.5.0'
-    api 'com.google.protobuf:protobuf-java:3.21.12'
+    api "com.google.protobuf:protobuf-java:${revProtoBuf}"
     api 'jakarta.annotation:jakarta.annotation-api:2.1.1'
     api gradleApi()
 

dependencies.gradle

@@ -33,7 +33,7 @@ ext {
     revHamcrestAllMatchers = '1.8'
     revHealth = '1.1.4'
     revPostgres = '42.7.2'
-    revProtoBuf = '3.25.5'
+    revProtoBuf = '4.33.0'
     revJakartaAnnotation = '2.1.1'
     revJAXB = '4.0.1'
     revJAXRS = '4.0.0'

grpc/build.gradle

@@ -13,14 +13,14 @@
 
 buildscript {
     dependencies {
-        classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.19'
+        classpath 'com.google.protobuf:protobuf-gradle-plugin:0.9.5'
     }
 }
 
 plugins {
     id 'java'
     id 'idea'
-    id "com.google.protobuf" version "0.8.19"
+    id "com.google.protobuf" version "0.9.5"
 }
 
 repositories{
@@ -42,16 +42,18 @@ dependencies {
 
 }
 
-def artifactName = 'com.google.protobuf:protoc:3.14.0:osx-x86_64'
+// Use protoc 3.25.5 for code generation to maintain compatibility with protobuf-java 4.x runtime
+// See: https://github.com/grpc/grpc-java/issues/12246
+def artifactName = 'com.google.protobuf:protoc:3.25.5'
 switch (org.gradle.internal.os.OperatingSystem.current()) {
     case org.gradle.internal.os.OperatingSystem.LINUX:
-        artifactName = "com.google.protobuf:protoc:3.21.12"
+        artifactName = "com.google.protobuf:protoc:3.25.5"
         break;
     case org.gradle.internal.os.OperatingSystem.MAC_OS:
-        artifactName = "com.google.protobuf:protoc:3.14.0:osx-x86_64"
+        artifactName = "com.google.protobuf:protoc:3.25.5"
         break;
     case org.gradle.internal.os.OperatingSystem.WINDOWS:
-        artifactName = "com.google.protobuf:protoc:3.21.12"
+        artifactName = "com.google.protobuf:protoc:3.25.5"
         break;
 }