v20240317 contains protobuf 3.17.0 instead of 3.25.2

[chschu]

Regardless of what's specified in maven_artifacts.bzl, closure-compiler version v20240317 (and later builds) seem to contain protobuf-java version 3.17.0.

At least that's what META-INF/maven/com.google.protobuf/protobuf-java/pom.xml in https://repo1.maven.org/maven2/com/google/javascript/closure-compiler/v20240317/closure-compiler-v20240317.jar says. Local builds of the v20240317 tag or the current master contain the same information.

Version v20231112 contains protobuf-java version 3.21.12, which matches the version specified in maven_artifacts.bzl.

[brad4d]

Thanks for reporting this.
It's not clear when the next release to Maven will occur, but I've added this issue to a list that will be resolved before it happens.

[gkdn]

Since I am looking at the maven artifact, I just checked this.

pom.xml for the compiler correctly points to 3.21.12 which IIUC what matters here.

<dependency>
  <groupId>com.google.protobuf</groupId>
  <artifactId>protobuf-java</artifactId>
  <version>3.21.12</version>
</dependency>

The protobuf pom.xml in META-INF shouldn't be there; just seems like an artifact of the the way some jars are merged. However again IIUC it shouldn't have any impact.

Are you experiencing any problems?

[lauraharker]

We've pushed a new Maven release using protobuf-java 4.30.2.