Bump com.google.protobuf:protobuf-java from 3.12.2 to 4.32.0
Open
Number: #4
Type: Pull Request
State: Open
Type: Pull Request
State: Open
Author:
dependabot[bot]
Association: None
Comments: 0
Association: None
Comments: 0
Created:
September 06, 2025 at 12:06 PM UTC
(about 2 months ago)
(about 2 months ago)
Updated:
September 06, 2025 at 12:06 PM UTC
(about 2 months ago)
(about 2 months ago)
Labels:
dependencies java
dependencies java
Description:
Bumps com.google.protobuf:protobuf-java from 3.12.2 to 4.32.0.
Release notes
Sourced from com.google.protobuf:protobuf-java's releases.
Protocol Buffers v3.20.3
Java
- Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder.
- Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class.
- Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations.
- Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance.
- Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field.
- This release addresses a Security Advisory for Java users
Protocol Buffers v3.20.2
C++
- Reduce memory consumption of MessageSet parsing
- This release addresses a Security Advisory for C++ and Python users
Protocol Buffers v3.20.1
PHP
- Fix building packaged PHP extension (#9727)
- Fixed composer.json to only advertise compatibility with PHP 7.0+. (#9819)
Ruby
- Disable the aarch64 build on macOS until it can be fixed. (#9816)
Other
- Fix versioning issues in 3.20.0
Protocol Buffers v3.19.6
Java
- Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder.
- Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class.
- Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations.
- Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance.
- Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field.
- This release addresses a Security Advisory for Java users
Protocol Buffers v3.19.5
C++
... (truncated)
Commits
- See full diff in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Pull Request Statistics
Commits:
1
1
Files Changed:
1
1
Additions:
+1
+1
Deletions:
-1
-1
Package Dependencies
Package:
com.google.protobuf:protobuf-java
Ecosystem:
maven
maven
Version Change:
3.12.2 → 4.32.0
Update Type:
Major
Major
Security Advisories
protobuf-java has a potential Denial of Service issue
GHSA-h4h5-3hr4-j3g2
CVE-2022-3171
MODERATE
## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances ...
protobuf-cpp and protobuf-python have potential Denial of Service issue
GHSA-8gq9-2x98-w8hf
CVE-2022-1941
HIGH
### Summary
A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted ...
Technical Details
| ID: | 7052164 |
| UUID: | 2804770957 |
| Node ID: | PR_kwDOPq6hVM6nLWiN |
| Host: | GitHub |
| Repository: | shoucheng3/kubernetes-client__java_CVE-2020-8570_client-java-parent-9_0_2_fixed |
| Merge State: | Unknown |