protobuf-java: force version

mjquinn-google · mjquinn-google · commit cc01a12d37ff · 2023-03-16T08:39:42.000-07:00
diff --git a/buildSrc/src/main/groovy/dwh-migration-dumper.java-common-conventions.gradle b/buildSrc/src/main/groovy/dwh-migration-dumper.java-common-conventions.gradle
@@ -35,6 +35,7 @@ configurations {
         exclude group: 'commons-logging'	// Replaced by jcl-over-slf4j
         resolutionStrategy {
             force 'com.google.code.gson:gson:2.8.9' // 2.8.7 has a security issue
+            force 'com.google.protobuf:protobuf-java:3.19.6' // first non-vulnerable > 3.17.x
         }
     }
 }
@@ -73,8 +74,10 @@ dependencies {
         implementation "com.swrve:rate-limited-logger:2.0.0"
 
         // TODO: when we can upgrade google-cloud-bigquery to v2+ (involves
-        // addressing breaking changes), remove the forced 2.8.9 version
-        // for gson in resolutionStrategy above
+        // addressing breaking changes), remove the following forced versions
+        // from resolutionStrategy above:
+        // - gson
+        // - protobuf-java
         implementation "com.google.cloud:google-cloud-bigquery:1.137.2"
 
         runtimeOnly "ch.qos.logback:logback-classic:$logbackVersion"

Original file line number	Diff line number	Diff line change
`@@ -35,6 +35,7 @@ configurations {`
`35`	`35`	`exclude group: 'commons-logging' // Replaced by jcl-over-slf4j`
`36`	`36`	`resolutionStrategy {`
`37`	`37`	`force 'com.google.code.gson:gson:2.8.9' // 2.8.7 has a security issue`
	`38`	`+ force 'com.google.protobuf:protobuf-java:3.19.6' // first non-vulnerable > 3.17.x`
`38`	`39`	`}`
`39`	`40`	`}`
`40`	`41`	`}`
`@@ -73,8 +74,10 @@ dependencies {`
`73`	`74`	`implementation "com.swrve:rate-limited-logger:2.0.0"`
`74`	`75`
`75`	`76`	`// TODO: when we can upgrade google-cloud-bigquery to v2+ (involves`
`76`		`- // addressing breaking changes), remove the forced 2.8.9 version`
`77`		`- // for gson in resolutionStrategy above`
	`77`	`+ // addressing breaking changes), remove the following forced versions`
	`78`	`+ // from resolutionStrategy above:`
	`79`	`+ // - gson`
	`80`	`+ // - protobuf-java`
`78`	`81`	`implementation "com.google.cloud:google-cloud-bigquery:1.137.2"`
`79`	`82`
`80`	`83`	`runtimeOnly "ch.qos.logback:logback-classic:$logbackVersion"`