From c74af12e4ec427b7aee3c8e4560986e6eb4ef4e4 Mon Sep 17 00:00:00 2001
From: Tarun Annapareddy <tannapareddy@google.com>
Date: Wed, 4 Feb 2026 00:23:01 +0000
Subject: [PATCH] Bump protobuf dependency to fix CVE-2024-7254

Signed-off-by: Tarun Annapareddy <tannapareddy@google.com>
---
 pom.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index a1cb671ae..485abc8c4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -27,10 +27,10 @@
         <auto-value.version>1.6.3</auto-value.version>
         <awaitility.version>3.1.6</awaitility.version>
         <checkstyle.version>8.18</checkstyle.version>
-        <grpc.version>1.62.2</grpc.version>
-        <guava.version>32.1.3-android</guava.version><!-- Keep the Guava version in sync with grpc-java -->
+        <grpc.version>1.78.0</grpc.version>
+        <guava.version>33.5.0-android</guava.version><!-- Keep the Guava version in sync with grpc-java -->
         <junit.version>4.13.2</junit.version>
-        <protobuf.version>3.25.1</protobuf.version><!-- Keep the Protobuf version in sync with grpc-java -->
+        <protobuf.version>3.25.8</protobuf.version><!-- Keep the Protobuf version in sync with grpc-java -->
         <rest-assured.version>3.1.0</rest-assured.version>
         <slf4j.version>1.7.26</slf4j.version>
         <testcontainers.version>1.17.1</testcontainers.version>