Bump protobuf to 3.25.5 (#6343)

daymxn · rlazo · web-flow · commit 065c732669e3 · 2024-10-10T13:25:54.000-05:00
Per [b/371058443](https://b.corp.google.com/issues/371058443), This bumps our protobuf deps to `3.25.5` to address [CVE 2024-7254](GHSA-735f-pc8j-v9w8). All relevant libraries should have a changelog attached, unless I missed any. This PR also fixes the following: - [b/371223043](https://b.corp.google.com/issues/371223043) -> Migrate protobuf deps to version catalog Fixes #6336 --------- Co-authored-by: Rodrigo Lazo <rlazo@users.noreply.github.com>
diff --git a/build.gradle b/build.gradle
@@ -54,9 +54,6 @@ ext {
     robolectricVersion = libs.versions.robolectric.get()
     androidxTestCoreVersion = libs.versions.androidx.test.core.get()
     androidxTestJUnitVersion = libs.versions.androidx.test.junit.get()
-    protocVersion = libs.versions.protoc.get()
-    javaliteVersion = libs.versions.javalite.get()
-    protobufJavaUtilVersion = libs.versions.protobufjavautil.get()
 }
 
 apply plugin: com.google.firebase.gradle.plugins.PublishingPlugin
diff --git a/encoders/firebase-encoders-proto/CHANGELOG.md b/encoders/firebase-encoders-proto/CHANGELOG.md
@@ -1,3 +1,4 @@
 # Unreleased
-
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
diff --git a/encoders/firebase-encoders-proto/firebase-encoders-proto.gradle b/encoders/firebase-encoders-proto/firebase-encoders-proto.gradle
@@ -32,7 +32,7 @@ java {
 
 protobuf {
     protoc {
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
 }
 
@@ -47,7 +47,7 @@ dependencies {
     testAnnotationProcessor project(':encoders:firebase-encoders-processor')
 
     testImplementation 'com.google.guava:guava:31.0-jre'
-    testImplementation "com.google.protobuf:protobuf-java-util:$protobufJavaUtilVersion"
+    testImplementation libs.protobuf.java.util
     testImplementation "com.google.truth:truth:$googleTruthVersion"
     testImplementation 'com.google.truth.extensions:truth-proto-extension:1.0'
     testImplementation 'junit:junit:4.13.1'
diff --git a/encoders/protoc-gen-firebase-encoders/protoc-gen-firebase-encoders.gradle b/encoders/protoc-gen-firebase-encoders/protoc-gen-firebase-encoders.gradle
@@ -22,7 +22,7 @@ plugins {
 
 protobuf {
     protoc {
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
 }
 
diff --git a/encoders/protoc-gen-firebase-encoders/tests/tests.gradle b/encoders/protoc-gen-firebase-encoders/tests/tests.gradle
@@ -26,7 +26,7 @@ dependencies {
 
 protobuf {
     protoc {
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     plugins {
         firebaseEncoders {
@@ -51,7 +51,7 @@ dependencies {
 
     testImplementation project(":encoders:firebase-encoders")
     testImplementation project(":encoders:firebase-encoders-proto")
-    testImplementation "com.google.protobuf:protobuf-java:3.21.9"
+    testImplementation libs.protobuf.java
     testImplementation "com.google.truth:truth:1.0.1"
     testImplementation 'junit:junit:4.13.1'
 }
diff --git a/firebase-config/CHANGELOG.md b/firebase-config/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Unreleased
-
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 # 22.0.0
 * [changed] Bump internal dependencies
diff --git a/firebase-crashlytics-ndk/firebase-crashlytics-ndk.gradle b/firebase-crashlytics-ndk/firebase-crashlytics-ndk.gradle
@@ -124,7 +124,7 @@ dependencies {
 
     androidTestImplementation "androidx.test:core:$androidxTestCoreVersion"
     androidTestImplementation 'androidx.test:runner:1.4.0'
-    androidTestImplementation "com.google.protobuf:protobuf-javalite:$javaliteVersion"
+    androidTestImplementation libs.protobuf.java.lite
     androidTestImplementation 'com.linkedin.dexmaker:dexmaker:2.28.1'
     androidTestImplementation 'com.linkedin.dexmaker:dexmaker-mockito:2.28.1'
     androidTestImplementation 'org.mockito:mockito-core:3.4.3'
diff --git a/firebase-crashlytics/CHANGELOG.md b/firebase-crashlytics/CHANGELOG.md
@@ -1,4 +1,7 @@
 # Unreleased
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
+
 
 # 19.2.0
 * [fixed] Improved data consistency for rapid user actions.
diff --git a/firebase-crashlytics/firebase-crashlytics.gradle b/firebase-crashlytics/firebase-crashlytics.gradle
@@ -104,7 +104,7 @@ dependencies {
     androidTestImplementation(libs.androidx.test.runner)
     androidTestImplementation(libs.androidx.test.junit)
     androidTestImplementation("com.google.firebase:firebase-encoders-json:18.0.1")
-    androidTestImplementation("com.google.protobuf:protobuf-java:3.21.11")
+    androidTestImplementation(libs.protobuf.java)
     androidTestImplementation(libs.truth)
     androidTestImplementation("com.linkedin.dexmaker:dexmaker:2.28.3")
     androidTestImplementation(libs.mockito.dexmaker)
diff --git a/firebase-dataconnect/CHANGELOG.md b/firebase-dataconnect/CHANGELOG.md
@@ -1,4 +1,6 @@
 # Unreleased
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 # 16.0.0-beta01
 * [feature] Initial release of the Data Connect SDK (public preview). Learn how to
@@ -19,3 +21,4 @@
   ([#6299](https://github.com/firebase/firebase-android-sdk/pull/6299))
 * [changed] Added `equals` and `hashCode` methods to `GeneratedConnector`.
   ([#6177](https://github.com/firebase/firebase-android-sdk/pull/6177))
+
diff --git a/firebase-firestore/CHANGELOG.md b/firebase-firestore/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Unreleased
-
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 # 25.1.0
 * [feature] Add support for the VectorValue type. [#6154](//github.com/firebase/firebase-android-sdk/pull/6154)
diff --git a/firebase-firestore/firebase-firestore.gradle b/firebase-firestore/firebase-firestore.gradle
@@ -36,7 +36,7 @@ protobuf {
     // Configure the protoc executable
     protoc {
         // Download from repositories
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     plugins {
         grpc {
@@ -164,7 +164,7 @@ dependencies {
     testImplementation 'org.mockito:mockito-core:2.25.0'
     testImplementation "org.robolectric:robolectric:$robolectricVersion"
 
-    testCompileOnly "com.google.protobuf:protobuf-java:$protocVersion"
+    testCompileOnly libs.protobuf.java
 
     androidTestImplementation "androidx.annotation:annotation:1.1.0"
     androidTestImplementation 'androidx.test:rules:1.5.0'
diff --git a/firebase-firestore/ktx/ktx.gradle b/firebase-firestore/ktx/ktx.gradle
@@ -71,5 +71,5 @@ dependencies {
     testImplementation 'org.mockito:mockito-core:2.25.0'
     testImplementation "org.robolectric:robolectric:$robolectricVersion"
 
-    testCompileOnly "com.google.protobuf:protobuf-java:$protocVersion"
+    testCompileOnly libs.protobuf.java
 }
diff --git a/firebase-inappmessaging-display/CHANGELOG.md b/firebase-inappmessaging-display/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Unreleased
-
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 # 21.0.0
 * [fixed] Fixed bad token exception while showing FIAM
diff --git a/firebase-inappmessaging/CHANGELOG.md b/firebase-inappmessaging/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Unreleased
-
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 # 21.0.0
 * [fixed] Fixed bad token exception while showing FIAM
diff --git a/firebase-inappmessaging/firebase-inappmessaging.gradle b/firebase-inappmessaging/firebase-inappmessaging.gradle
@@ -32,7 +32,7 @@ protobuf {
     // Configure the protoc executable
     protoc {
         // Download from repositories
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     plugins {
         grpc {
diff --git a/firebase-messaging/CHANGELOG.md b/firebase-messaging/CHANGELOG.md
@@ -1,4 +1,7 @@
 # Unreleased
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
+
 
 # 24.0.2
 * [changed] Included message priority when logging to Firelog.
diff --git a/firebase-messaging/firebase-messaging.gradle b/firebase-messaging/firebase-messaging.gradle
@@ -25,7 +25,7 @@ protobuf {
         protobuild project(path: ':encoders:protoc-gen-firebase-encoders', configuration: 'shadow')
 }
     protoc {
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     plugins {
         firebaseEncoders {
diff --git a/firebase-ml-modeldownloader/CHANGELOG.md b/firebase-ml-modeldownloader/CHANGELOG.md
@@ -1,4 +1,6 @@
 # Unreleased
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 
 # 25.0.0
diff --git a/firebase-ml-modeldownloader/firebase-ml-modeldownloader.gradle b/firebase-ml-modeldownloader/firebase-ml-modeldownloader.gradle
@@ -34,7 +34,7 @@ protobuf {
     // Configure the protoc executable
     protoc {
         // Download from repositories
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     generateProtoTasks {
         all().each { task ->
@@ -121,7 +121,7 @@ dependencies {
     testImplementation 'androidx.test:runner:1.5.1'
     testImplementation "androidx.test.ext:junit:$androidxTestJUnitVersion"
     testImplementation 'com.github.tomakehurst:wiremock-standalone:2.26.3'
-    testImplementation "com.google.protobuf:protobuf-java-util:$protobufJavaUtilVersion"
+    testImplementation libs.protobuf.java.util
     testImplementation "com.google.truth:truth:$googleTruthVersion"
     testImplementation 'com.google.truth.extensions:truth-proto-extension:1.0'
     testImplementation 'junit:junit:4.13-beta-2'
diff --git a/firebase-perf/CHANGELOG.md b/firebase-perf/CHANGELOG.md
@@ -1,5 +1,6 @@
 # Unreleased
-
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 # 21.0.1
 * [fixed] Fixed an `ExceptionInInitializerError` where the `url.openStream()` causes a crash if
diff --git a/firebase-perf/firebase-perf.gradle b/firebase-perf/firebase-perf.gradle
@@ -36,7 +36,7 @@ firebaseLibrary {
 
 protobuf {
     protoc {
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     generateProtoTasks {
         all().each { task ->
@@ -104,7 +104,7 @@ dependencies {
     implementation "androidx.annotation:annotation:1.1.0"
     implementation "androidx.lifecycle:lifecycle-process:2.3.1"
     implementation "com.google.android.gms:play-services-tasks:18.0.1"
-    implementation "com.google.protobuf:protobuf-javalite:$javaliteVersion"
+    implementation libs.protobuf.java.lite
     implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlinVersion"
     implementation 'androidx.annotation:annotation:1.7.0'
     implementation 'androidx.appcompat:appcompat:1.2.0'
@@ -130,7 +130,7 @@ dependencies {
          exclude group: 'com.google.firebase', module: 'firebase-common'
          exclude group: 'com.google.firebase', module: 'firebase-components'
      }
-    testCompileOnly "com.google.protobuf:protobuf-java:3.21.9"
+    testCompileOnly libs.protobuf.java
     testImplementation "androidx.test:core:$androidxTestCoreVersion"
     testImplementation "com.google.truth:truth:$googleTruthVersion"
     testImplementation "org.robolectric:robolectric:$robolectricVersion"
diff --git a/firebase-perf/ktx/ktx.gradle b/firebase-perf/ktx/ktx.gradle
@@ -59,5 +59,5 @@ dependencies {
     testImplementation 'org.mockito:mockito-core:2.25.0'
     testImplementation "org.robolectric:robolectric:$robolectricVersion"
 
-    testCompileOnly "com.google.protobuf:protobuf-java:3.21.9"
+    testCompileOnly libs.protobuf.java
 }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
@@ -9,14 +9,14 @@ coroutines = "1.7.3"
 dagger = "2.43.2"
 grpc = "1.62.2"
 grpcKotlin = "1.4.1"
-javalite = "3.21.11"
+javalite = "3.25.5"
 kotlin = "1.8.22"
 mockk = "1.13.11"
 serialization-plugin = "1.8.22"
-protoc = "3.21.11"
+protoc = "3.25.5"
 truth = "1.4.2"
 robolectric = "4.12"
-protobufjavautil = "3.21.11"
+protobufjavautil = "3.25.5"
 kotest = "5.9.0" # Do not use 5.9.1 because it reverts the fix for https://github.com/kotest/kotest/issues/3981
 quickcheck = "0.6"
 serialization = "1.5.1"
diff --git a/protolite-well-known-types/protolite-well-known-types.gradle b/protolite-well-known-types/protolite-well-known-types.gradle
@@ -26,7 +26,7 @@ firebaseLibrary {
 
 protobuf {
     protoc {
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = "com.google.protobuf:protoc:3.21.11"
     }
     generateProtoTasks {
         all().each { task ->
@@ -68,5 +68,5 @@ dependencies {
         exclude group: "com.google.protobuf", module: "protobuf-java"
     }
 
-    implementation "com.google.protobuf:protobuf-javalite:$javaliteVersion"
+    implementation "com.google.protobuf:protobuf-javalite:3.21.11"
 }
diff --git a/transport/transport-backend-cct/CHANGELOG.md b/transport/transport-backend-cct/CHANGELOG.md
@@ -1,4 +1,6 @@
 # Unreleased
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 
 # 3.3.0
diff --git a/transport/transport-backend-cct/transport-backend-cct.gradle b/transport/transport-backend-cct/transport-backend-cct.gradle
@@ -29,7 +29,7 @@ protobuf {
     // Configure the protoc executable
     protoc {
         // Download from repositories
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     generateProtoTasks {
         all().each { task ->
@@ -71,7 +71,7 @@ dependencies {
 
     testImplementation "androidx.test:core:$androidxTestCoreVersion"
     testImplementation 'com.github.tomakehurst:wiremock:3.0.1'
-    testImplementation "com.google.protobuf:protobuf-java-util:$protobufJavaUtilVersion"
+    testImplementation libs.protobuf.java.util
     testImplementation "com.google.truth:truth:$googleTruthVersion"
     testImplementation 'com.google.truth.extensions:truth-proto-extension:1.0'
     testImplementation 'junit:junit:4.13.1'
diff --git a/transport/transport-runtime/CHANGELOG.md b/transport/transport-runtime/CHANGELOG.md
@@ -1,4 +1,6 @@
 # Unreleased
+* [changed] Updated protobuf dependency to `3.25.5` to fix
+  [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8).
 
 
 # 3.3.0
diff --git a/transport/transport-runtime/transport-runtime.gradle b/transport/transport-runtime/transport-runtime.gradle
@@ -26,7 +26,7 @@ dependencies {
 
 protobuf {
     protoc {
-        artifact = "com.google.protobuf:protoc:$protocVersion"
+        artifact = libs.protoc.get().toString()
     }
     plugins {
         firebaseEncoders {

Original file line number	Diff line number	Diff line change
`@@ -54,9 +54,6 @@ ext {`
`54`	`54`	`robolectricVersion = libs.versions.robolectric.get()`
`55`	`55`	`androidxTestCoreVersion = libs.versions.androidx.test.core.get()`
`56`	`56`	`androidxTestJUnitVersion = libs.versions.androidx.test.junit.get()`
`57`		`- protocVersion = libs.versions.protoc.get()`
`58`		`- javaliteVersion = libs.versions.javalite.get()`
`59`		`- protobufJavaUtilVersion = libs.versions.protobufjavautil.get()`
`60`	`57`	`}`
`61`	`58`
`62`	`59`	`apply plugin: com.google.firebase.gradle.plugins.PublishingPlugin`
Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ java {`
`32`	`32`
`33`	`33`	`protobuf {`
`34`	`34`	`protoc {`
`35`		`- artifact = "com.google.protobuf:protoc:$protocVersion"`
	`35`	`+ artifact = libs.protoc.get().toString()`
`36`	`36`	`}`
`37`	`37`	`}`
`38`	`38`
`@@ -47,7 +47,7 @@ dependencies {`
`47`	`47`	`testAnnotationProcessor project(':encoders:firebase-encoders-processor')`
`48`	`48`
`49`	`49`	`testImplementation 'com.google.guava:guava:31.0-jre'`
`50`		`- testImplementation "com.google.protobuf:protobuf-java-util:$protobufJavaUtilVersion"`
	`50`	`+ testImplementation libs.protobuf.java.util`
`51`	`51`	`testImplementation "com.google.truth:truth:$googleTruthVersion"`
`52`	`52`	`testImplementation 'com.google.truth.extensions:truth-proto-extension:1.0'`
`53`	`53`	`testImplementation 'junit:junit:4.13.1'`
Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ plugins {`
`22`	`22`
`23`	`23`	`protobuf {`
`24`	`24`	`protoc {`
`25`		`- artifact = "com.google.protobuf:protoc:$protocVersion"`
	`25`	`+ artifact = libs.protoc.get().toString()`
`26`	`26`	`}`
`27`	`27`	`}`
`28`	`28`