From df39c357af56518affb2a76c927573d35a77b88f Mon Sep 17 00:00:00 2001
From: Todd Baert <todd.baert@dynatrace.com>
Date: Mon, 21 Oct 2024 13:00:08 -0400
Subject: [PATCH] fix: protobuf-java version for CVE-2024-7254

Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
---
 providers/flagd/pom.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/providers/flagd/pom.xml b/providers/flagd/pom.xml
index 00d7c7e35..a15bf1104 100644
--- a/providers/flagd/pom.xml
+++ b/providers/flagd/pom.xml
@@ -32,6 +32,13 @@
     </developers>
 
     <dependencies>
+        <!-- temporary to fix CVE-2024-7254 (see: https://github.com/advisories/GHSA-735f-pc8j-v9w8) - remove once this is in gRPC-java -->
+        <dependency>
+            <groupId>com.google.protobuf</groupId>
+            <artifactId>protobuf-java</artifactId>
+            <version>3.25.5</version>
+        </dependency>
+
         <!-- we inherent dev.openfeature.javasdk and the test dependencies from the parent pom -->
         <dependency>
             <groupId>io.grpc</groupId>