CVE-2024-7254 on org.scala-sbt:zinc-persist-core-assembly:1.10.2

[gabrieljones]

Sonatype just flagged org.scala-sbt:zinc-persist-core-assembly:1.10.2 with

https://nvd.nist.gov/vuln/detail/CVE-2024-7254
https://www.cve.org/CVERecord?id=CVE-2024-7254

Looks like the protobuf lib is shaded into this artifact.

[eed3si9n]

@gabrieljones Thanks for letting us know!

[Friendseeker]

Thanks for letting us know. Just made a PR to bump protobuf version.

Btw which website did you use to see the sonatype flags? I went on https://ossindex.sonatype.org/component/pkg:maven/org.scala-sbt/[email protected] and saw no flags.

I am thinking if there's some bots we can setup to auto post an issue when some zinc artifact is flagged.