Problem/Motivation

google/protobuf has a CVE for < 4.33.6: https://github.com/advisories/GHSA-p2gh-cfq4-4wjc

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3581530

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

godotislate created an issue. See original summary.

godotislate opened merge request !15209

godotislate opened merge request !15210

godotislate opened merge request !15211

godotislate opened merge request !15212

godotislate changed the visibility of the branch 3581530-update-googleprotobuf-to to hidden.

godotislate’s picture

godotislate
he/him
commented
Status: Active » Needs review

This was reported to break the 11.x subtree split, but I created MRs for main, 11.x, 11.3.x, and 10.6.x just in case.

quietone’s picture

quietone commented
Status: Needs review » Reviewed & tested by the community

All the diffs agree with my local versions of the same changes.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Version: main » 10.6.x-dev
Status: Reviewed & tested by the community » Fixed

Thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • alexpott committed 892dce84 on 10.6.x 
    chore: #3581530 Update google/protobuf to >= 4.33.6

By: godotislate
By...

  • alexpott committed ad7d9b35 on 11.3.x 
    chore: #3581530 Update google/protobuf to >= 4.33.6

By: godotislate
By...

  • alexpott committed 06864d3b on 11.x 
    chore: #3581530 Update google/protobuf to >= 4.33.6

By: godotislate
By...

  • alexpott committed 8e676e42 on main 
    chore: #3581530 Update google/protobuf to >= 4.33.6

By: godotislate
By...

godotislate closed merge request !15209

godotislate closed merge request !15210

godotislate closed merge request !15211

godotislate closed merge request !15212

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Fixed » Needs work

We also need MRs for 11.2.x and 10.5.x as they are under security support - right?

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Needs work » Fixed

End users can composer update their way out of this, this really only affects core-dev-pinned, which is deprecated: #3566600: Deprecate drupal/core-dev-pinned metapackage

Therefore I don't think we need to backport this any further.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented

Oh, I suppose it might break the subtree splitter if we do do a security release on those branches, unless @drumm solves that another way?

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.