Upgrade `protobuf-java` to 3.22.2

[jrhee17]

Is your feature request related to a problem?

No

Describe the solution you'd like

Upgrade protobuf from 3.21.7 to 3.22.2 to keep up-to-date with the ecosystem.

Describe alternatives you've considered

n/a

Additional context

• Note that 3.22.2 contains a fix for Java fixes for 22.x protocolbuffers/protobuf#12035 concerning java8 compatibility
• Also a related pull request on our side: Update protobuf-java to resolve CVEs line/armeria#4820

[sergiitk]

To clarify - the problem is solved from your side by updating the version of protobuf, right?

From our side - we're currently working on updating the protobuf. We don't know yet if this'd be an easy upgrade, so I can't provide you with a timeline. Ideally it'll be out as a patch-release of 1.54.

[ejona86]

Some others recently brought up the protobuf upgrade, so I made #10041 . But as I mention on it, I think we will hold off for a little bit before merging it to let the ecosystem catch up. Java seems fine, but some of the other languages are having trouble.

[jrhee17]

To clarify - the problem is solved from your side by updating the version of protobuf, right?

Right, but since we also use grpc-java as well as protobuf we generally try to align these dependencies.

But as I mention on it, I think we will hold off for a little bit before merging it to let the ecosystem catch up. Java seems fine, but some of the other languages are having trouble.

I see, understood and thanks 👍

[ejona86]

22.3 is out, so we'll target that instead: #10045 . That PR should actually be ready the moment it makes sense to merge.

[ejona86]

Note: users are free to upgrade the version of protobuf in their own dependency tree. The main thing is don't downgrade. Gradle won't do that, and for Maven users we strongly recommend Maven Enforcer's requireUpperBoundDeps.

[ejona86]

#10045 is merged. Let's consider this closed, even if C++ is still a TODO, you wouldn't be able to notice.