protobuf-javalite 3.22.0 is affected by CVE-2024-7254 #1001

gradle/libs.versions.toml on main pins:

protobufJavalite = "3.22.0"

3.22.0 is affected by GHSA-735f-pc8j-v9w8 / CVE-2024-7254, fixed in 3.25.5. The parser recurses without bound on deeply nested groups and unknown fields, which throws StackOverflowError. CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability only.

The runtime pin is still 3.22.0. #686 bumped the protobuf Gradle plugin in the root build.gradle, not the library.

Two reasons this seems worth bumping:

1. It is reachable from network input. RTCEngine.onMessage calls LivekitModels.DataPacket.parseFrom straight on the data channel bytes, so a remote participant controls what the parser sees.

2. It propagates. The published POM for io.livekit:livekit-android:2.28.0 declares protobuf-javalite 3.22.0 at runtime scope, so it lands on the runtime classpath of every app that depends on the SDK and gets flagged by their dependency scanners.

Side note: .github/dependabot.yml declares a weekly gradle ecosystem update, but I cannot find any Dependabot PRs on the repo, so it may be disabled at the org level. That would explain the pin going unnoticed.

#1002 bumps protobufJavalite to 3.25.9, the latest on that line. It moves the runtime pin only, leaving protobuf at 3.22.0 since that one selects protoc and the protobuf-java jar the build unzips descriptor.proto out of, neither of which reaches a consumer classpath.