Updating Dependencies

[Lewox]

Description

Updated tink from 1.14.1 to 1.15.0
Updated protobuf-java from 3.25.3 to 3.25.5 (transitive dependency from tink, vulnerable in the current version of tink)

Addressed CVE:
CVE-2024-7254

Pull Request Etiquette

• I have checked the PRs for upcoming features/bug fixes.
• I have read the [contributing guidelines][contributing].

Changes

• Internal code
• Library interface (affecting end-user code)
• Documentation
• Other: Dependency Update (Vulnerability)

Closes Issue: NaN

[MinnDevelopment]

We don't use protobuf, so we can just wait for the transitive dependency to be updated instead.

[Lewox]

Hi, thanks for checking, would you be open to upgrading tink if they update the transitive dependency?

[Lewox]

Someone already beat me to update the dependency at tink tink-crypto/tink-java#46 but looking at the Bazel files, it should be using 4.28.0, which is still vulnerable.

[freya022]

As Minn mentioned, JDA does not use protobuf at all, so the version of either tink, or protobuf, does not matter in the slightest.

You can verify this by running a bot with the dependency excluded, I have tried it on my own bot and audio receive works.
By looking at their documentation, I would assume that it is likely used only for sending over the wire.

In addition:

• JDA does not deserialize untrusted data, as all data comes from Discord
• JDA does not expose Tink or any of its transitive dependencies, as it is declared as a runtime dependency, which makes it inaccessible for JDA users. Thus, the user using Tink or Protobuf would be made aware of these issues by themselves
• The Tink PR did fix the issue, the commit history shows them going from 3.25.3 (current release) -> 4.28.0 -> 4.28.2

And to answer your earlier question, yes, I believe Minn said that we can wait for Tink's version of protobuf to get upgraded