Skip to content

Conversation

@cicoyle
Copy link
Contributor

@cicoyle cicoyle commented Jan 3, 2025

Updates the dapr-sdk-autogen & dapr-sdk-actors pkgs to explicitly include secure versions of the following dependencies:

  • protobuf-java
  • okio
  • kotlin-stdlib

These dependencies were transitive, but were not properly included with secure versions, so I explicitly set them.

I also had to address the deprecation of GeneratedMessageV3 in the newer version of protobuf-java

@cicoyle cicoyle requested review from a team as code owners January 3, 2025 21:52
Signed-off-by: Cassandra Coyle <[email protected]>
Signed-off-by: Cassandra Coyle <[email protected]>
Signed-off-by: Cassandra Coyle <[email protected]>
@cicoyle cicoyle marked this pull request as draft January 3, 2025 22:56
@cicoyle cicoyle marked this pull request as ready for review January 6, 2025 18:47
@artursouza artursouza merged commit 88ec8c9 into dapr:release-1.13 Jan 6, 2025
8 checks passed
cicoyle added a commit to cicoyle/java-sdk that referenced this pull request Jan 6, 2025
…pr#1187)

* up versions to be secure and fix issues due to deprecation

Signed-off-by: Cassandra Coyle <[email protected]>

* see if this fixes it

Signed-off-by: Cassandra Coyle <[email protected]>

* check if protoc is in ci

Signed-off-by: Cassandra Coyle <[email protected]>

* see if changes from this PR (dapr#1182) fix it

Signed-off-by: Cassandra Coyle <[email protected]>

* 3.25.5 version protobuf-java

Signed-off-by: Cassandra Coyle <[email protected]>

* rm explicit versions and fix deprecation dependency to new one

Signed-off-by: Cassandra Coyle <[email protected]>

* merge in release branch and lower protoc versions to match

Signed-off-by: Cassandra Coyle <[email protected]>

* force upped version

Signed-off-by: Cassandra Coyle <[email protected]>

* use protobuf.version 3.25.5 (secure)

Signed-off-by: Cassandra Coyle <[email protected]>

* use correct protobuf for sdk tests

Signed-off-by: Cassandra Coyle <[email protected]>

---------

Signed-off-by: Cassandra Coyle <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants