Skip to content

Commit 3c351f1

Browse files
committed
Downgrade to protobuf v25.5
It turns out `protobuf` v26.6 isn't compatibile with ScalaPB 0.9.8 used by Scala 2.11: ```txt Caused by: java.lang.UnsupportedOperationException: As of 2022/09/29 (release 21.7) makeExtensionsImmutable should not be called from protobuf gencode. If you are seeing this message, your gencode is vulnerable to a denial of service attack. You should regenerate your code using protobuf 25.6 or later. Use the latest version that meets your needs. However, if you understand the risks and wish to continue with vulnerable gencode, you can set the system property `-Dcom.google.protobuf.use_unsafe_pre22_gencode` on the command line. See security vulnerability: GHSA-h4h5-3hr4-j3g2 ``` As mentioned in bazelbuild#1710, we should consider dropping Scala 2.11 support at this point, since there's no ScalaPB release for it that supports later versions of `protobuf`. That, and we could remove some of the special case code added in the following changes, amongst other 2.11 support details: - bazelbuild#1631 - bazelbuild#1648 - bazelbuild#1687 - bazelbuild#1688
1 parent 71971b1 commit 3c351f1

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

scala/deps.bzl

+3-3
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ def rules_scala_dependencies():
4343
maybe(
4444
http_archive,
4545
name = "com_google_protobuf",
46-
sha256 = "ecfeb9f673e63321b4871c1cee6b5adeb0ef711d08a0c5bb1945271767df65bf",
47-
strip_prefix = "protobuf-25.6",
48-
url = "https://github.com/protocolbuffers/protobuf/archive/refs/tags/v25.6.tar.gz",
46+
sha256 = "3cf7d5b17c4ff04fe9f038104e9d0cae6da09b8ce271c13e44f8ac69f51e4e0f",
47+
strip_prefix = "protobuf-25.5",
48+
url = "https://github.com/protocolbuffers/protobuf/archive/refs/tags/v25.5.tar.gz",
4949
)
5050

5151
maybe(

0 commit comments

Comments
 (0)