CVEs fixes (especially protobuf-java)

[yazgoo]

Hello

I see that 1.0.0 alpha fixes a lot of CVEs (especially CVE-2024-7254).
I have two questions:

• do you have an idea on when you will be able to release the non-alpha version ?
• do you plan to backport some CVEs fixes to 0.11 ? I'm thinking mainly about CVE-2024-7254 (which could be fixed while remaining on protobuf 3)

I asked this on the mailing list but did not get answers.

Thank you !

[thesamet]

Hi @yazgoo , ScalaPB is not affected by CVE-2024-7254 as it has its own code for parsing unknown fields. If you do have Java code that relies on that, you should directly depend on protobuf-java and use an affected version.

Regardless, I'll cut a release in the coming days to bump up dependencies - it's been a while.

[yazgoo]

Thanks !

[pjfanning]

@thesamet would you have time to publish a new 1 pre-release or release?

[bannopeter]

+1 for an updated release please, CVE-2024-7254 Dependabots coming due 😅

[btomala]

+1 for the update release with protobuf-java

[bannopeter]

@thesamet could you please cut a release with updated dependencies, this CVE-2022-42003 one is coming due too 🤞 🙏 Pulled in transitively from scalapb-json4s

[thesamet]

I cut a new releases for ScalaPB and scalapb-json4s