From bda4345da3104a803b0db67f39e7a93b3bfb662d Mon Sep 17 00:00:00 2001 From: Scala Steward Date: Sat, 20 Jun 2026 15:59:33 +0000 Subject: [PATCH] Update protobuf-java to 4.35.1 Signed-off-by: Scala Steward --- project/Dependencies.scala | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/project/Dependencies.scala b/project/Dependencies.scala index a9cb414a..0dd6afd4 100644 --- a/project/Dependencies.scala +++ b/project/Dependencies.scala @@ -33,7 +33,7 @@ object Dependencies { lazy val jacksonDatabind = "com.fasterxml.jackson.core" % "jackson-databind" % "2.15.2" // XXX Version bundled with Spark is vulnerable to CVE-2022-3171 - lazy val protobuf = "com.google.protobuf" % "protobuf-java" % "3.25.9" + lazy val protobuf = "com.google.protobuf" % "protobuf-java" % "4.35.1" // XXX Bundled version is vulnerable to CVE-2023-34455 lazy val snappyJava = "org.xerial.snappy" % "snappy-java" % "1.1.10.8" }