Google protobuf vulnerability

[gregallen]

Please could you upgrade to 3.25.5?

CVE-2024-7254

[caesaryuan]

Support of 3.25.x will end on 31 Mar 2026, it would be great to upgrade to 4.x soon.

[cushon]

Fixed in https://github.com/google/error-prone/releases/tag/v2.33.0

[cushon]

I have also provided a 2.35.1 release that uses protobuf 3.25.5, for anyone who needs a fix for CVE-2024-7254 but can't update to protobuf 4.x.

Future releases of Error Prone will switch back to protobuf 4.x.

https://github.com/google/error-prone/releases/tag/v2.35.1