protobuf-java vulnerability

[mbeaudry-coveo]

I am using version 2.6.0 of amazon-kinesis-client which which depends on version 3.21.12 of protobuf-java which has a security issue:

I see that in your default branch, you have bumped protobuf-java to 4.27.0 (which doesn't have the security issue). Do you intend to create a release of amazon-kinesis-client with this change soon?

If not, how safe is it for us to exclude the dependency on protobuf-java? How is it used by amazon-kinesis-client?

[chris-tuncap]

👀 We are also trying to resolve this vulnerability in amazon-kinesis-client. Any releases coming soon?

[etspaceman]

Seems there was an upgrade of Protobuf in the 3.0.0 version. Unfortunately, I discovered this because upgrading to the 3.0.0 KCL produces a new error for Protobuf when the KPL is also in use in the same project. I believe this is because the KPL is on 3.25.5

[etspaceman]

Created an issue on the KPL here as well.