Fix CVE-2021-22569

[pxLi]

Signed-off-by: Peixin Li pxli@nyu.edu

pre-merge CI is blocked by vulnerability scan GHSA-wrvw-hg22-4m67

try update protobuf-java version to suggested version

[pxLi]

build

[pxLi]

Spark runtime use 2.5.0 version, so we use the specific version till now.

NVIDIA blackduck scan does not allow vulnerability of direct dependencies, so I bumped the version here to unblock the pre-merge CI if test could pass.

The real fix will be #4408 which will remove several direct dependencies including protobuf-java

[tgravescs]

so I'm not sure I like changing this right before the 22.02 release. #4408 is scheduled for 22.04.
It builds and tests run so maybe its ok but we going from a 2.x to a 3.x and I think we should look at compatibility or what exactly we are using this for. #4551

[pxLi]

so I'm not sure I like changing this right before the 22.02 release. #4408 is scheduled for 22.04. It builds and tests run so maybe its ok but we going from a 2.x to a 3.x and I think we should look at compatibility or what exactly we are using this for. #4551

yeah, this should just be a temp fix to unblock CI. We should go for some mature fix