-
Notifications
You must be signed in to change notification settings - Fork 60
Open
Description
I'd like to use otel/build-protobuf
to build opentelemetry-proto. I noticed the libprotoc
bundled inside the image is more than two years old (3.21.6
). I think this comes from the outdated gRPC version, which is also more than two years old.
This is a problem in Java because due to protocolbuffers/protobuf#19540 I'm forced to use an outdated Protobuf runtime JAR, which comes with its own set of problems:
WARNING: Vulnerable protobuf generated type in use: io.opentelemetry.proto.profiles.v1development.ProfilesDictionary
As of 2022/09/29 (release 21.7) makeExtensionsImmutable should not be called from protobuf gencode.
If you are seeing this message, your gencode is vulnerable to a denial of service attack. You should
regenerate your code using protobuf 25.6 or later
I know I could just use another image, or protoc
directly, but I'd like to raise the discussion in the meantime. Is there any blocker?
Metadata
Metadata
Assignees
Labels
No labels