Adopt google.golang.org/protobuf

[tlimoncelli]

This project imports github.com/golang/protobuf which is obsolete. Are there plans to switch to google.golang.org/protobuf ?

[firenessmax]

i have problem with the same import, my organization uses a dependency vulnerability check and give me some issues.

[Deleplace]

We should reopen and address this in some way

[jinglundong]

https://github.com/golang/appengine/releases/tag/v2.0.4 includes https://github.com/golang/appengine/pull/314, which should have this fixed. Haven't verified it yet.

[aimuz]

Any progress on this issue?

[jinglundong]

https://github.com/golang/appengine/releases/tag/v2.0.4 should have this fixed. Could you share more details in case I missed anything?

[aimuz]

Ideally you should switch github.com/golang/protobuf to google.golang.org/protobuf

There is also code that is relying on this library github.com/golang/protobuf

https://github.com/golang/appengine/blob/a080531dcab843de8cd8a4156b7fa1e14ebd68da/user/user.go#L12

https://github.com/golang/appengine/blob/a080531dcab843de8cd8a4156b7fa1e14ebd68da/mail/mail.go#L27

[jinglundong]

ACK. I will try to share an update early next week. Sorry for not being able to stay on top of this issue.

[jkroepke]

@jinglundong do you have an update? Since the oauth2 package depends on appengine, the import of the deprecated package is spread across the half go universe (https://github.com/golang/oauth2/blob/master/go.mod)

[trakhimenok]

Can we get some update on when we can expect not to download & compile 2 versions of the same thing?

[trakhimenok]

Is anyone assigned to this?