Latest version of google.golang.org/protobuf (v1.33.0) is no longer compatible with the latest version of github.com/golang/protobuf (v1.5.3) #1596

vadimsht · 2024-03-05T20:32:56Z

What version of protobuf and what language are you using?
google.golang.org/protobuf (v1.33.0)
github.com/golang/protobuf (v1.5.3)

What did you do?
Trying to compile a package that imports github.com/golang/protobuf/protoc-gen-go/descriptor results in

# github.com/golang/protobuf/protoc-gen-go/descriptor
../../../../../../../golang/modcache/github.com/golang/protobuf@v1.5.3/protoc-gen-go/descriptor/descriptor.pb.go:106:61: undefined: descriptorpb.Default_FileOptions_PhpGenericServices

What did you expect to see?

No build errors :)

What did you see instead?

Build errors :)

This seems to be a combination of protocolbuffers/protobuf-go@99e193e#diff-ae68ca51f2811349cc1f596970cc40bb7fa15fd893bea35e199f3cbd7ca2b486L2247 that removed Default_FileOptions_PhpGenericServices and https://github.com/golang/protobuf/blob/master/protoc-gen-go/descriptor/descriptor.pb.go#L106 that still references it.

The text was updated successfully, but these errors were encountered:

vadimsht · 2024-03-05T20:35:31Z

This blocks picking up a fix for https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/m/oLMrdq_GBQAJ in code bases that still uses deprecated Go package. While the "correct" solution is to stop using the deprecated package, it is not really possible to do fast. And running vulnerable code is not nice... Please consider releasing a new compatible github.com/golang/protobuf version.

rootulp · 2024-03-05T21:04:12Z

+1 I encountered this on celestiaorg/celestia-app#3155. See this error.

neild · 2024-03-05T21:47:36Z

Gah, apologies, I didn't expect that.

I think we have to make an updated version of github.com/golang/protobuf that updates descriptor.pb.go, thanks to a backwards-incompatible change in descriptor.proto.

A recent change to the upstream descriptor.proto, appearing in google.golang.org/protobuf@v1.33.0, removed the long-deprecated FileOptions.php_generic_services field. This backwards-incompatible change results in an incompatibility between the github.com/golang/protobuf and google.golang.org/protobuf modules. Bump the google.golang.org/protobuf version in go.mod, regenerate descriptors. For #1596

A recent change to the upstream descriptor.proto, appearing in google.golang.org/protobuf@v1.33.0, removed the long-deprecated FileOptions.php_generic_services field. This backwards-incompatible change results in an incompatibility between the github.com/golang/protobuf and google.golang.org/protobuf modules. Bump the google.golang.org/protobuf version in go.mod, regenerate descriptors. Increase the minimum Go version requirement to go1.17 (the minimum supported by v1.33.0). For #1596

A recent change to the upstream descriptor.proto, appearing in google.golang.org/protobuf@v1.33.0, removed the long-deprecated FileOptions.php_generic_services field. This backwards-incompatible change results in an incompatibility between the github.com/golang/protobuf and google.golang.org/protobuf modules. Bump the google.golang.org/protobuf version in go.mod, regenerate descriptors. Increase the minimum Go version requirement to go1.17 (the minimum supported by v1.33.0). Run gofmt to update formatting to go1.22 standards. For #1596

jerrybean · 2024-03-06T09:23:27Z

Does google.golang.org/protobuf need a newer version than v1.33.0? I saw github.com/golang/protobuf (v1.5.4) already.

rootulp · 2024-03-06T14:37:23Z

Seems resolved via #1597 because https://github.com/golang/protobuf/releases/tag/v1.5.4 works for me.

neild · 2024-03-06T16:01:46Z

Sorry for the inconvenience! github.com/golang/protobuf v1.5.4 should be compatible with google.golang.org/protobuf v1.33.0.

The problem, for reference, is that:

descriptor.proto (part of the upstream protobuf project) dropped the FileOptions.php_generic_services field.
google.golang.org/protobuf includes the generated package for descriptor.proto.
google.golang.org/protobuf v1.33.0 updates descriptor.proto, resulting in the const descriptorpb.Default_FileOptions_PhpGenericServices being removed.
github.com/golang/protobuf, for historical reasons, includes a stub version of descriptor.proto that forwards all its symbols to the canonical one in google.golang.org/protobuf.
github.com/golang/protobuf v1.5.3 is now incompatible with google.golang.org/protobuf v1.33.0, because it references a symbol that doesn't exist.

This is fixed in v1.5.4 by regenerating the forwarding package.

In retrospect, a better fix might have been in google.golang.org/protobuf: We could have added a declaration for Default_FileOptions_PhpGenericServices to that package for backwards compatibility. If we'd detected the problem in time, we could have done that in the v1.33.0 release and maintained compatibility with v1.5.3.

We should have a test that ensures this doesn't happen again in the future.

golang/protobuf#1596 fixed by bump google.golang.org/protobuf from 1.32.0 to 1.33.0 and bump github.com/golang/protobuf from 1.5.3 to 1.5.4

...to address these snyk-found vulns: ``` ✗ Medium severity vulnerability found in google.golang.org/protobuf/internal/encoding/json Description: Infinite loop Info: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUFINTERNALENCODINGJSON-6393704 Introduced through: google.golang.org/api/option@0.149.0, github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd, google.golang.org/api/cloudresourcemanager/v1@0.149.0, google.golang.org/api/compute/v1@0.149.0, google.golang.org/api/dns/v1@0.149.0, google.golang.org/api/serviceusage/v1@0.149.0, github.com/openshift/generic-admission-server/pkg/cmd@#8dcc3c9b298f, github.com/openshift/installer/pkg/destroy/gcp@#f168b97656bd From: google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 From: github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd > google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 From: google.golang.org/api/cloudresourcemanager/v1@0.149.0 > google.golang.org/api/transport/http@0.149.0 > google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 and 5 more... Fixed in: 1.33.0 ✗ Medium severity vulnerability found in google.golang.org/protobuf/encoding/protojson Description: Infinite loop Info: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUFENCODINGPROTOJSON-6393703 Introduced through: google.golang.org/api/cloudresourcemanager/v1@0.149.0, google.golang.org/api/compute/v1@0.149.0, google.golang.org/api/dns/v1@0.149.0, google.golang.org/api/serviceusage/v1@0.149.0, github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd, github.com/openshift/installer/pkg/destroy/gcp@#f168b97656bd, google.golang.org/api/option@0.149.0, github.com/openshift/generic-admission-server/pkg/cmd@#8dcc3c9b298f From: google.golang.org/api/cloudresourcemanager/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 From: google.golang.org/api/compute/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 From: google.golang.org/api/dns/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 and 28 more... Fixed in: 1.33.0 ``` Note that in this branch we also had to bump google.golang.org/golang/protobuf to v1.5.4 due to golang/protobuf#1596. Why this wasn't necessary in the other branches... no idea. :shakes-fist-at-golang-deps: Manual cherry-pick of openshift#2239 / f7cf469 which was a Manual cherry-pick of openshift#2231 / 2efba4b

2uasimojo · 2024-03-13T21:37:35Z

So this is weird. I upgraded google.golang.org/protobuf to 1.33.0 in my master branch (openshift/hive#2231) where github.com/golang/protobuf was still at 1.5.3. Worked fine.

Applied that same change to a recent release branch (openshift/hive#2239). Worked fine.

Applied that same change to an earlier release branch (openshift/hive#2240) and ran into this problem.

All three branches started with github.com/golang/protobuf at 1.5.3. But only that third one broke.

...to address these snyk-found vulns: ``` ✗ Medium severity vulnerability found in google.golang.org/protobuf/internal/encoding/json Description: Infinite loop Info: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUFINTERNALENCODINGJSON-6393704 Introduced through: google.golang.org/api/option@0.149.0, github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd, google.golang.org/api/cloudresourcemanager/v1@0.149.0, google.golang.org/api/compute/v1@0.149.0, google.golang.org/api/dns/v1@0.149.0, google.golang.org/api/serviceusage/v1@0.149.0, github.com/openshift/generic-admission-server/pkg/cmd@#8dcc3c9b298f, github.com/openshift/installer/pkg/destroy/gcp@#f168b97656bd From: google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 From: github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd > google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 From: google.golang.org/api/cloudresourcemanager/v1@0.149.0 > google.golang.org/api/transport/http@0.149.0 > google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 and 5 more... Fixed in: 1.33.0 ✗ Medium severity vulnerability found in google.golang.org/protobuf/encoding/protojson Description: Infinite loop Info: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUFENCODINGPROTOJSON-6393703 Introduced through: google.golang.org/api/cloudresourcemanager/v1@0.149.0, google.golang.org/api/compute/v1@0.149.0, google.golang.org/api/dns/v1@0.149.0, google.golang.org/api/serviceusage/v1@0.149.0, github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd, github.com/openshift/installer/pkg/destroy/gcp@#f168b97656bd, google.golang.org/api/option@0.149.0, github.com/openshift/generic-admission-server/pkg/cmd@#8dcc3c9b298f From: google.golang.org/api/cloudresourcemanager/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 From: google.golang.org/api/compute/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 From: google.golang.org/api/dns/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 and 28 more... Fixed in: 1.33.0 ``` Note that in this branch we also had to bump google.golang.org/golang/protobuf to v1.5.4 due to golang/protobuf#1596. Why this wasn't necessary in the other branches... no idea. :shakes-fist-at-golang-deps: Manual cherry-pick of openshift#2240 / 0e128fe which was a Manual cherry-pick of openshift#2239 / f7cf469 which was a Manual cherry-pick of openshift#2231 / 2efba4b

...to address these snyk-found vulns: ``` ✗ Medium severity vulnerability found in google.golang.org/protobuf/internal/encoding/json Description: Infinite loop Info: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUFINTERNALENCODINGJSON-6393704 Introduced through: google.golang.org/api/option@0.149.0, github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd, google.golang.org/api/cloudresourcemanager/v1@0.149.0, google.golang.org/api/compute/v1@0.149.0, google.golang.org/api/dns/v1@0.149.0, google.golang.org/api/serviceusage/v1@0.149.0, github.com/openshift/generic-admission-server/pkg/cmd@#8dcc3c9b298f, github.com/openshift/installer/pkg/destroy/gcp@#f168b97656bd From: google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 From: github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd > google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 From: google.golang.org/api/cloudresourcemanager/v1@0.149.0 > google.golang.org/api/transport/http@0.149.0 > google.golang.org/api/option@0.149.0 > google.golang.org/grpc@1.61.0 > google.golang.org/grpc/internal/transport@1.61.0 > google.golang.org/grpc/internal/pretty@1.61.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 > google.golang.org/protobuf/internal/encoding/json@1.32.0 and 5 more... Fixed in: 1.33.0 ✗ Medium severity vulnerability found in google.golang.org/protobuf/encoding/protojson Description: Infinite loop Info: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUFENCODINGPROTOJSON-6393703 Introduced through: google.golang.org/api/cloudresourcemanager/v1@0.149.0, google.golang.org/api/compute/v1@0.149.0, google.golang.org/api/dns/v1@0.149.0, google.golang.org/api/serviceusage/v1@0.149.0, github.com/openshift/installer/pkg/asset/machines/gcp@#f168b97656bd, github.com/openshift/installer/pkg/destroy/gcp@#f168b97656bd, google.golang.org/api/option@0.149.0, github.com/openshift/generic-admission-server/pkg/cmd@#8dcc3c9b298f From: google.golang.org/api/cloudresourcemanager/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 From: google.golang.org/api/compute/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 From: google.golang.org/api/dns/v1@0.149.0 > google.golang.org/api/internal/gensupport@0.149.0 > github.com/googleapis/gax-go/v2/apierror@2.12.0 > google.golang.org/protobuf/encoding/protojson@1.32.0 and 28 more... Fixed in: 1.33.0 ``` Note that in this branch we also had to bump google.golang.org/golang/protobuf to v1.5.4 due to golang/protobuf#1596. Why this wasn't necessary in the other branches... no idea. :shakes-fist-at-golang-deps: Manual cherry-pick of openshift#2241 / d8c9a5d which was a Manual cherry-pick of openshift#2240 / 0e128fe which was a Manual cherry-pick of openshift#2239 / f7cf469 which was a Manual cherry-pick of openshift#2231 / 2efba4b

Man I dont even know. Why does golang.google.org/protobuf even depend on github.com/golang/protobuf if the latter is deprecated and explicitly states to use the former...? golang/protobuf#1596 ## Test plan go build & CI

…bilty, see golang/protobuf#1596 (comment) upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.44.0 to address CVE-2023-45142 even though prometheus-adapter isn't using it directly and isn't exposing any traces.

…bilty, see golang/protobuf#1596 (comment) upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.49.0 to address CVE-2023-45142 even though prometheus-adapter isn't using it directly and isn't exposing any traces.

…r compatibilty, see golang/protobuf#1596 (comment) OCPBUGS-22630: upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.49.0 to address CVE-2023-45142 even though prometheus-adapter isn't using it directly and isn't exposing any traces.

commit 10c7f03 updated google.golang.org/protobuf to v1.33.0, which addresses CVE-2024-24786, however a follow-up post on the Golang security list issued a warning that the v1.33.0 update introduced a breaking change, causing compatibility with github.com/golang/protobuf to be broken; > A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown > option is set (as well as when unmarshaling into any message which contains a > google.protobuf.Any). There is no UnmarshalUnknown option. > > In addition, version 1.33.0 of google.golang.org/protobuf inadvertently > introduced an incompatibility with the older github.com/golang/protobuf > module. (golang/protobuf#1596) Users of the older > module should update to github.com/golang/protobuf@v1.5.4. Containerd itself does not appear to be using this code, but consumers may be, so update the github.com/golang/protobuf to restore compatibility. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

commit 10c7f03 updated google.golang.org/protobuf to v1.33.0, which addresses CVE-2024-24786, however a follow-up post on the Golang security list issued a warning that the v1.33.0 update introduced a breaking change, causing compatibility with github.com/golang/protobuf to be broken; > A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown > option is set (as well as when unmarshaling into any message which contains a > google.protobuf.Any). There is no UnmarshalUnknown option. > > In addition, version 1.33.0 of google.golang.org/protobuf inadvertently > introduced an incompatibility with the older github.com/golang/protobuf > module. (golang/protobuf#1596) Users of the older > module should update to github.com/golang/protobuf@v1.5.4. Containerd itself does not appear to be using this code, but consumers may be, so update the github.com/golang/protobuf to restore compatibility. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 45e425c) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

commit 10c7f03 updated google.golang.org/protobuf to v1.33.0, which addresses CVE-2024-24786, however a follow-up post on the Golang security list issued a warning that the v1.33.0 update introduced a breaking change, causing compatibility with github.com/golang/protobuf to be broken; > A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown > option is set (as well as when unmarshaling into any message which contains a > google.protobuf.Any). There is no UnmarshalUnknown option. > > In addition, version 1.33.0 of google.golang.org/protobuf inadvertently > introduced an incompatibility with the older github.com/golang/protobuf > module. (golang/protobuf#1596) Users of the older > module should update to github.com/golang/protobuf@v1.5.4. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 45e425c) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

…bilty, see golang/protobuf#1596 (comment) upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.49.0 to address CVE-2023-45142 even though prometheus-adapter isn't using it directly and isn't exposing any traces.

…r compatibilty, see golang/protobuf#1596 (comment) OCPBUGS-22630: upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.45.0 to address CVE-2023-45142 even though prometheus-adapter isn't using it directly and isn't exposing any traces.

…bilty, see golang/protobuf#1596 (comment) deps: upgrade go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.45.0 to address CVE-2023-45142 even though prometheus-adapter isn't using it directly and isn't exposing any traces.

…f v1.5.4 full diffs: - protocolbuffers/protobuf-go@v1.31.0...v1.33.0 - golang/protobuf@v1.5.3...v1.5.4 From the Go security announcement list; > Version v1.33.0 of the google.golang.org/protobuf module fixes a bug in > the google.golang.org/protobuf/encoding/protojson package which could cause > the Unmarshal function to enter an infinite loop when handling some invalid > inputs. > > This condition could only occur when unmarshaling into a message which contains > a google.protobuf.Any value, or when the UnmarshalOptions.UnmarshalUnknown > option is set. Unmarshal now correctly returns an error when handling these > inputs. > > This is CVE-2024-24786. In a follow-up post; > A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown > option is set (as well as when unmarshaling into any message which contains a > google.protobuf.Any). There is no UnmarshalUnknown option. > > In addition, version 1.33.0 of google.golang.org/protobuf inadvertently > introduced an incompatibility with the older github.com/golang/protobuf > module. (golang/protobuf#1596) Users of the older > module should update to github.com/golang/protobuf@v1.5.4. govulncheck results in our code: govulncheck ./... Scanning your code and 1221 packages across 204 dependent modules for known vulnerabilities... === Symbol Results === Vulnerability #1: GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf More info: https://pkg.go.dev/vuln/GO-2024-2611 Module: google.golang.org/protobuf Found in: google.golang.org/protobuf@v1.31.0 Fixed in: google.golang.org/protobuf@v1.33.0 Example traces found: #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal Your code is affected by 1 vulnerability from 1 module. This scan found no other vulnerabilities in packages you import or modules you require. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 1ca89d7) Signed-off-by: Austin Vazquez <macedonv@amazon.com>

Bump golang.org/protobuf to v1.33.0 for CVE-2024-24786 fix. Notice that, in some cases, github.com/golang/protobuf had to be bumped to v1.5.4 because of golang/protobuf#1596.

commit 10c7f03 updated google.golang.org/protobuf to v1.33.0, which addresses CVE-2024-24786, however a follow-up post on the Golang security list issued a warning that the v1.33.0 update introduced a breaking change, causing compatibility with github.com/golang/protobuf to be broken; > A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown > option is set (as well as when unmarshaling into any message which contains a > google.protobuf.Any). There is no UnmarshalUnknown option. > > In addition, version 1.33.0 of google.golang.org/protobuf inadvertently > introduced an incompatibility with the older github.com/golang/protobuf > module. (golang/protobuf#1596) Users of the older > module should update to github.com/golang/protobuf@v1.5.4. Containerd itself does not appear to be using this code, but consumers may be, so update the github.com/golang/protobuf to restore compatibility. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

deep-explorer · 2024-09-06T15:50:36Z

I installed google.golang.org/protobuf v1.34.2 but it doesn't support descriptor.
And alternatively, I tried to install github.com/golang/protobuf module but can't install this one as well.

could not import google.golang.org/protobuf/protoc-gen-go/descriptor (no required module provides package "google.golang.org/protobuf/protoc-gen-go/descriptor")compilerBrokenImport

puellanivis · 2024-09-08T08:33:28Z

If you look in the github.com/golang/protobuf/protoc-gen-go/descriptor package, you can see what the correct module for the descriptor package is (as the package primarily just type aliases, and const/var copies everything over): google.golang.org/protobuf/types/descriptorpb (The package has been moved to a more consistent path to join the other general protobufs.)

rootulp mentioned this issue Mar 5, 2024

chore(deps): upgrade protobuf celestiaorg/celestia-app#3155

Merged

neild mentioned this issue Mar 5, 2024

all: update descriptor.proto to latest version #1597

Merged

neild closed this as completed Mar 6, 2024

roger2hk mentioned this issue Mar 7, 2024

Bump go-version-input from 1.21.6 to 1.21.8 in govulncheck and bump google.golang.org/protobuf from 1.32.0 to 1.33.0 and bump github.com/golang/protobuf from 1.5.3 to 1.5.4 google/trillian#3393

Merged

2 tasks

ghstahl added a commit to fluffy-bunny/fluffycore-rage-identity that referenced this issue Mar 7, 2024

downstream build break due to

7af9966

golang/protobuf#1596 fixed by bump google.golang.org/protobuf from 1.32.0 to 1.33.0 and bump github.com/golang/protobuf from 1.5.3 to 1.5.4

deepthi mentioned this issue Mar 8, 2024

Upgrade golang/protobuf dependency vitessio/vitess#15425

Closed

derekbit mentioned this issue Mar 9, 2024

Support setting spdk_tgt log level and flags longhorn/longhorn-manager#2606

Merged

jhump mentioned this issue Mar 12, 2024

Update to latest protobuf-go connectrpc/connect-go#707

Merged

2uasimojo mentioned this issue Mar 13, 2024

[mce-2.4] upgrade google.golang.org/protobuf to 1.33.0 openshift/hive#2240

Merged

2uasimojo mentioned this issue Mar 13, 2024

[mce-2.3] upgrade google.golang.org/protobuf to 1.33.0 openshift/hive#2241

Merged

2uasimojo mentioned this issue Mar 13, 2024

[mce-2.2] upgrade google.golang.org/protobuf to 1.33.0 openshift/hive#2242

Merged

Strum355 mentioned this issue Mar 13, 2024

chore: bump golang/protobuf to 1.5.4 because of nonsense sourcegraph/sourcegraph-public-snapshot#61127

Merged

machine424 mentioned this issue Mar 14, 2024

deps: upgrade github.com/golang/protobuf to v1.5.4 for better compati… kubernetes-sigs/prometheus-adapter#649

Merged

thaJeztah mentioned this issue Mar 18, 2024

vendor: github.com/golang/protobuf v1.5.4 containerd/containerd#9967

Merged

This was referenced Mar 20, 2024

chore(deps): bump google.golang.org/protobuf from 1.28.1 to 1.33.0 micro/go-micro#2696

Closed

fix(sec): CVE-2024-24786 micro/go-micro#2699

Merged

TheSpiritXIII mentioned this issue Mar 25, 2024

fix(deps): patch Docker and Protobuf dependencies GoogleCloudPlatform/prometheus#149

Merged

tuxcanfly mentioned this issue Mar 27, 2024

build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 rollkit/celestia-da#87

Closed

zbuchheit mentioned this issue Apr 2, 2024

Update github.com/golang/protobuf to version v1.5.4 pulumi/pulumi-terraform-bridge#1831

Closed

machine424 mentioned this issue Apr 15, 2024

OCPBUGS-32214,OCPBUGS-32215: upgrade deps openshift/k8s-prometheus-adapter#102

Merged

cbartoszDell mentioned this issue Apr 18, 2024

chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 dell/cosi#193

Merged

elboulangero mentioned this issue Apr 26, 2024

Master fails to build with undefined: grpc.ClientConnInterface etix/mirrorbits#172

Closed

r4f4 mentioned this issue May 9, 2024

OCPBUGS-30516: bump golang-protobuf for CVE fix openshift/installer#8379

Merged

yxun mentioned this issue May 23, 2024

OSSM-6039 update deps maistra/ratelimit#3

Closed

jooola mentioned this issue May 31, 2024

deps: update module github.com/prometheus/client_golang to v1.19.1 hetznercloud/hcloud-go#438

Merged

1 task

mandre mentioned this issue Aug 14, 2024

OCPBUGS-30438: Bump protobuf dependency openshift/csi-driver-manila-operator#237

Merged

slobad123 mentioned this issue Oct 31, 2024

go install error: descriptorpb.Default_FileOptions_PhpGenericServices pseudomuto/protoc-gen-doc#544

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Latest version of google.golang.org/protobuf (v1.33.0) is no longer compatible with the latest version of github.com/golang/protobuf (v1.5.3) #1596

Latest version of google.golang.org/protobuf (v1.33.0) is no longer compatible with the latest version of github.com/golang/protobuf (v1.5.3) #1596

vadimsht commented Mar 5, 2024

vadimsht commented Mar 5, 2024

rootulp commented Mar 5, 2024

neild commented Mar 5, 2024

jerrybean commented Mar 6, 2024

rootulp commented Mar 6, 2024

neild commented Mar 6, 2024

2uasimojo commented Mar 13, 2024

deep-explorer commented Sep 6, 2024

puellanivis commented Sep 8, 2024

Latest version of google.golang.org/protobuf (v1.33.0) is no longer compatible with the latest version of github.com/golang/protobuf (v1.5.3) #1596

Latest version of google.golang.org/protobuf (v1.33.0) is no longer compatible with the latest version of github.com/golang/protobuf (v1.5.3) #1596

Comments

vadimsht commented Mar 5, 2024

vadimsht commented Mar 5, 2024

rootulp commented Mar 5, 2024

neild commented Mar 5, 2024

jerrybean commented Mar 6, 2024

rootulp commented Mar 6, 2024

neild commented Mar 6, 2024

2uasimojo commented Mar 13, 2024

deep-explorer commented Sep 6, 2024

puellanivis commented Sep 8, 2024