Skip to content

chore(deps): update module google.golang.org/protobuf to v1.33.0 [security] - #16

Merged
yuzichen12123 merged 1 commit into
alauda-v0.34.0from
renovate/go-google.golang.org-protobuf-vulnerability
Jul 23, 2025
Merged

chore(deps): update module google.golang.org/protobuf to v1.33.0 [security]#16
yuzichen12123 merged 1 commit into
alauda-v0.34.0from
renovate/go-google.golang.org-protobuf-vulnerability

Conversation

@alaudaa-renovate

@alaudaa-renovate alaudaa-renovate Bot commented Jul 23, 2025 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
google.golang.org/protobuf v1.28.0 -> v1.33.0 age confidence
google.golang.org/protobuf v1.31.0 -> v1.33.0 age confidence

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

CGA-2vgr-6mqh-4r48 / CGA-v9cm-f6x8-5vj7 / CVE-2024-24786 / GHSA-8r3f-844c-mc37 / GO-2024-2611

More information

Details

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON

CGA-2vgr-6mqh-4r48 / CGA-v9cm-f6x8-5vj7 / CVE-2024-24786 / GHSA-8r3f-844c-mc37 / GO-2024-2611

More information

Details

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

protocolbuffers/protobuf-go (google.golang.org/protobuf)

v1.33.0

Compare Source

This release contains one security fix:

  • encoding/protojson: Unmarshal could enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set. Unmarshal now correctly returns an error when handling these inputs. This is CVE-2024-24786.

v1.32.0

Compare Source

Full Changelog: protocolbuffers/protobuf-go@v1.31.0...v1.32.0

This release contains commit protocolbuffers/protobuf-go@bfcd647, which fixes a denial of service vulnerability by preventing a stack overflow through a default maximum recursion limit. See https://github.com/golang/protobuf/issues/1583 and https://github.com/golang/protobuf/issues/1584 for details.

v1.31.0

Compare Source

Notable changes

New Features

  • CL/489316: types/dynamicpb: add NewTypes
    • Add a function to construct a dynamic type registry from a protoregistry.Files
  • CL/489615: encoding: add MarshalAppend to protojson and prototext

Minor performance improvements

  • CL/491596: encoding/protodelim: If UnmarshalFrom gets a bufio.Reader, try to reuse its buffer instead of creating a new one
  • CL/500695: proto: store the size of tag to avoid multiple calculations

Bug fixes

  • CL/497935: internal/order: fix sorting of synthetic oneofs to be deterministic
  • CL/505555: encoding/protodelim: fix handling of io.EOF

v1.30.0

Compare Source

Announcement
In the previous two releases, v1.29.0 and v1.29.1, we associated the tags with the wrong commits and thus the tags do not reference any commit in this repository. This tag, v1.30.0, refers to an existing commit again. Sorry for the inconvenience.

Notable changes

New Features

  • CL/449576: protoadapt: helper functions to convert v1 or v2 message to either v1 or v2 message.

v1.29.1

Compare Source

Notable changes

Bug fixes

  • CL/475995: internal/encoding/text: fix parsing of incomplete numbers

v1.29.0

Compare Source

Overview

This version introduces a new package protodelim to marshal and unmarshal size-delimited messages.
It also brings the implementation up to date with the latest protobuf features.

Notable changes

New Features

  • CL/419254: encoding: add protodelim package
  • CL/450775: reflect/protoreflect: add Value.Equal method
  • CL/462315: cmd/protoc-gen-go: make deprecated messages more descriptive
  • CL/473015: encoding/prototext: allow whitespace and comments between minus sign and number in negative numeric literal

Alignment with protobuf

  • CL/426054: types/descriptorpb: update *.pb.go to use latest protoc release, 21.5
  • CL/425554: encoding/protojson: fix parsing of google.protobuf.Timestamp
  • CL/461238: protobuf: remove the check for reserved field numbers
  • CL/469255: types/descriptorpb: regenerate using latest protobuf v22.0 release
  • CL/472696: cmd/protoc-gen-go: support protobuf retention feature

Documentation improvements:

  • CL/464275: proto: document Equal behavior of invalid messages
  • CL/466375: all: update links to Protocol Buffer documentation

Minor performance improvements

  • CL/460215: types/known/structpb: preallocate map in AsMap
  • CL/465115: internal/strs: avoid unnecessary allocations in Builder

Breaking changes

  • CL/461238: protobuf: remove the check for reserved field numbers
    • protowire.(Number).IsValid() no longer returns false for reserved fields because reserved fields are considered semantically valid by the protobuf spec.

v1.28.1

Compare Source

This release contains protoc-gen-go binaries for arm64.

Notable changes since v1.28.0:

  • CL/418677: internal/impl: improve MessageInfo.New performance
  • CL/411377: proto: short-circuit Equal when inputs are identical
  • CL/419714: all: Add prebuild binaries for arm64

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@alaudaa-renovate

alaudaa-renovate Bot commented Jul 23, 2025 •
edited
Loading

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: tools/go.sum
Command failed: go mod tidy
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/gofrs/flock tested by
	github.com/gofrs/flock.test imports
	gopkg.in/check.v1 loaded from gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f,
	but go 1.16 would select v1.0.0-20201130134442-10cb98267c6c
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_model/go imports
	github.com/golang/protobuf/ptypes/timestamp loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/prometheus/common/expfmt imports
	github.com/golang/protobuf/ptypes loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/internal/testprotos/proto2_proto loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/internal/testprotos/proto3_proto loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/protoc-gen-go/descriptor loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/ptypes/any loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/prometheus/common/expfmt imports
	github.com/golang/protobuf/ptypes imports
	github.com/golang/protobuf/ptypes/duration loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/securego/gosec/v2 tested by
	github.com/securego/gosec/v2.test imports
	github.com/onsi/ginkgo/v2 imports
	github.com/onsi/ginkgo/v2/ginkgo imports
	github.com/onsi/ginkgo/v2/ginkgo/build imports
	github.com/onsi/ginkgo/v2/ginkgo/internal imports
	github.com/google/pprof/profile loaded from github.com/google/pprof@v0.0.0-20210407192527-94a9f03dee38,
	but go 1.16 would select v0.0.0-20210720184732-4bb14d4b1be1

To upgrade to the versions selected by go 1.16:
	go mod tidy -go=1.16 && go mod tidy -go=1.17
If reproducibility with go 1.16 is not needed:
	go mod tidy -compat=1.17
For other options, see:
	https://golang.org/doc/modules/pruning
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/gofrs/flock tested by
	github.com/gofrs/flock.test imports
	gopkg.in/check.v1 loaded from gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f,
	but go 1.16 would select v1.0.0-20201130134442-10cb98267c6c
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_model/go imports
	github.com/golang/protobuf/ptypes/timestamp loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/prometheus/common/expfmt imports
	github.com/golang/protobuf/ptypes loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/internal/testprotos/proto2_proto loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/internal/testprotos/proto3_proto loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/protoc-gen-go/descriptor loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/golang/protobuf/proto tested by
	github.com/golang/protobuf/proto.test imports
	github.com/golang/protobuf/ptypes/any loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/yeya24/promlinter imports
	github.com/prometheus/client_golang/prometheus imports
	github.com/prometheus/common/expfmt imports
	github.com/golang/protobuf/ptypes imports
	github.com/golang/protobuf/ptypes/duration loaded from github.com/golang/protobuf@v1.5.2,
	but go 1.16 would select v1.5.3
go: github.com/tektoncd/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/securego/gosec/v2 tested by
	github.com/securego/gosec/v2.test imports
	github.com/onsi/ginkgo/v2 imports
	github.com/onsi/ginkgo/v2/ginkgo imports
	github.com/onsi/ginkgo/v2/ginkgo/build imports
	github.com/onsi/ginkgo/v2/ginkgo/internal imports
	github.com/google/pprof/profile loaded from github.com/google/pprof@v0.0.0-20210407192527-94a9f03dee38,
	but go 1.16 would select v0.0.0-20210720184732-4bb14d4b1be1

@alaudaa-renovate
alaudaa-renovate Bot force-pushed the renovate/go-google.golang.org-protobuf-vulnerability branch 2 times, most recently from 2e87aeb to c193488 Compare July 23, 2025 13:49
@alaudaa-renovate
alaudaa-renovate Bot force-pushed the renovate/go-google.golang.org-protobuf-vulnerability branch from c193488 to 298c424 Compare July 23, 2025 14:49
@yuzichen12123
yuzichen12123 merged commit d0bc3cf into alauda-v0.34.0 Jul 23, 2025
1 of 2 checks passed
@yuzichen12123
yuzichen12123 deleted the renovate/go-google.golang.org-protobuf-vulnerability branch July 23, 2025 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@yuzichen12123 yuzichen12123

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yuzichen12123