From 874cba016db3ef3c64df9d2ccf0b2b4a32d5d0f8 Mon Sep 17 00:00:00 2001
From: Matt Whitehead <matthew.whitehead@kaleido.io>
Date: Mon, 23 Sep 2024 11:58:47 +0100
Subject: [PATCH] Update protobuf to 32.25.5 to resolve CVE-2024-7254 (#7664)

Signed-off-by: Matthew Whitehead <matthew.whitehead@kaleido.io>
---
 gradle/verification-metadata.xml | 36 ++++++++++++++++++++++++++++++++
 gradle/versions.gradle           |  2 ++
 2 files changed, 38 insertions(+)

diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 3778a2d60ad..7f6a58b66e7 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -1023,6 +1023,11 @@
             <sha256 value="c19eba1f4897afe5d5926d68e19f2c2986752e459cfa9c5925e57290d9217add" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.google.protobuf" name="protobuf-bom" version="3.23.0">
+         <artifact name="protobuf-bom-3.23.0.pom">
+            <sha256 value="4e4ce6aeeed9b97ce86a7a61b33a33cfaa818f25fd5c8b67093b90b52af5ea4f" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.google.protobuf" name="protobuf-bom" version="3.23.4">
          <artifact name="protobuf-bom-3.23.4.pom">
             <sha256 value="aba9410f5ed7278126b8c046fbc74e7d0b2ba3cd18ac7a59d3bf0ffab0774f78" origin="Generated by Gradle"/>
@@ -1033,6 +1038,11 @@
             <sha256 value="b46e3f26fe0f473ff33077ee1245f88d4b8db35cc79f554cd0fd937766a45e58" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.google.protobuf" name="protobuf-bom" version="3.25.5">
+         <artifact name="protobuf-bom-3.25.5.pom">
+            <sha256 value="080e2984173238b50e064c226afffbb1b0233520295c790a7fd3d6ae4593f063" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.google.protobuf" name="protobuf-java" version="3.19.6">
          <artifact name="protobuf-java-3.19.6.jar">
             <sha256 value="6a9a2dff91dcf71f85be71ae971f6164b5a631dcd34bff08f0618535ca44ad02" origin="Generated by Gradle"/>
@@ -1049,6 +1059,14 @@
             <sha256 value="7ef79a4915167d42f785c1b16b60e48af15df3dd017289fa1e10e494e9eee3e3" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.google.protobuf" name="protobuf-java" version="3.23.0">
+         <artifact name="protobuf-java-3.23.0.jar">
+            <sha256 value="5aef5807afe5da8201612e5577690057466cebea063f239cb95504c9df649991" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="protobuf-java-3.23.0.pom">
+            <sha256 value="5ae12a87b64aa3abf5728bc956daec81d93de88fe8616c60f7f2b0eaea115208" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.google.protobuf" name="protobuf-java" version="3.23.4">
          <artifact name="protobuf-java-3.23.4.pom">
             <sha256 value="6deebe93fe6a35bab8fe926d6e617997a938ab0123175d0bd80edca6421ed20c" origin="Generated by Gradle"/>
@@ -1062,6 +1080,14 @@
             <sha256 value="c1efac1ae00f0bbab656428e196b63698c914d0dd22be120710beffc481cb547" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.google.protobuf" name="protobuf-java" version="3.25.5">
+         <artifact name="protobuf-java-3.25.5.jar">
+            <sha256 value="8540247fad9e06baefa8fb45eb313802d019f485f14300e0f9d6b556ed88e753" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="protobuf-java-3.25.5.pom">
+            <sha256 value="e752032157a7a39be9be3786684075452a46cd586b2865abd33e707568a4c8af" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.google.protobuf" name="protobuf-java-util" version="3.25.3">
          <artifact name="protobuf-java-util-3.25.3.jar">
             <sha256 value="b813c8d6d554cb71c1e82d171d7f80730ae74222a185c863cbedf05072c88155" origin="Generated by Gradle"/>
@@ -1080,6 +1106,11 @@
             <sha256 value="1b0229a3bbfef37b025d0d8d7ab369393e7128dabb809023681d1ecccf789020" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.google.protobuf" name="protobuf-parent" version="3.23.0">
+         <artifact name="protobuf-parent-3.23.0.pom">
+            <sha256 value="e979a0c47b473bbcd6b3586f12a8892b7914b28ea06211db53c4a1a3ce6cf7d8" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.google.protobuf" name="protobuf-parent" version="3.23.4">
          <artifact name="protobuf-parent-3.23.4.pom">
             <sha256 value="43804e420ca2d5d9a4505707d5d301da0b28c28f946b12cc727378f3c8affb39" origin="Generated by Gradle"/>
@@ -1090,6 +1121,11 @@
             <sha256 value="bc2744608cea3a7a2d4cd0b74e1c3f88138c64ce5aa61b9d7f0afd846882be7a" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.google.protobuf" name="protobuf-parent" version="3.25.5">
+         <artifact name="protobuf-parent-3.25.5.pom">
+            <sha256 value="64cc0e3ad6e85f5aec8f9dcf9341d1379e9525364ff53e23e16d8d5824673ef7" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.google.re2j" name="re2j" version="1.7">
          <artifact name="re2j-1.7.jar">
             <sha256 value="4f657af51ab8bb0909bcc3eb40862d26125af8cbcf92aaaba595fed77f947bc0" origin="Generated by Gradle"/>
diff --git a/gradle/versions.gradle b/gradle/versions.gradle
index b7a286e69a3..634c29b1e13 100644
--- a/gradle/versions.gradle
+++ b/gradle/versions.gradle
@@ -25,6 +25,8 @@ dependencyManagement {
 
     dependency 'com.github.ben-manes.caffeine:caffeine:3.1.8'
 
+    dependency 'com.google.protobuf:protobuf-java:3.25.5'
+
     dependency 'com.github.oshi:oshi-core:6.6.3'
 
     dependency 'com.google.auto.service:auto-service:1.1.1'