Tasks Core/Vision 1.0.0 Any.Builder concrete-return calls versus declared protobuf-javalite dependency
We inspected these official Maven artifacts without modifying them:
| Artifact | Bytes | SHA-256 |
|---|---|---|
com.google.mediapipe:tasks-core:1.0.0 AAR |
22,510,915 | 609c6fcfe59f58c9739194f65ae5882281c327710e1a616aa7f533a4d9238ca3 |
com.google.mediapipe:tasks-vision:1.0.0 AAR |
495,413 | 53d45569649ff7e9d84457f070481dbb779ddd057671d4adcd9abcb77ff172c6 |
com.google.protobuf:protobuf-javalite:4.26.1 JAR |
713,994 | ae83d2b063988c4565462845269472ddc817117506b6e467a2c3222c96636829 |
com.google.protobuf:protobuf-javalite:4.36.1 JAR, isolated candidate only |
1,022,979 | 91d3dba2521322103230c509d41a017da3a5e6766610adcb10c5bb127cbb26c5 |
Tasks Core's published 1.0.0 POM declares protobuf-javalite 4.26.1. Seven actual bytecode instructions in these MediaPipe classes invoke com/google/protobuf/Any$Builder.build:()Lcom/google/protobuf/Any;:
CalculatorProto$CalculatorGraphConfig$Builder.setGraphOptions(int, Any.Builder)— offset 13.CalculatorProto$CalculatorGraphConfig$Builder.addGraphOptions(Any.Builder)— offset 12.CalculatorProto$CalculatorGraphConfig$Builder.addGraphOptions(int, Any.Builder)— offset 13.CalculatorProto$CalculatorGraphConfig$Node$Builder.setNodeOptions(int, Any.Builder)— offset 13.CalculatorProto$CalculatorGraphConfig$Node$Builder.addNodeOptions(Any.Builder)— offset 12.CalculatorProto$CalculatorGraphConfig$Node$Builder.addNodeOptions(int, Any.Builder)— offset 13.HolisticLandmarker$HolisticLandmarkerOptions.convertToAnyProto()— offset 277.
The CalculatorProto classes are in com.google.mediapipe.proto; HolisticLandmarker is in com.google.mediapipe.tasks.vision.holisticlandmarker. Both examined Lite JARs lack this exact Any-returning descriptor; their inherited build descriptors return GeneratedMessageLite or MessageLite. The official full-Java Any.Builder API declares the concrete Any return. This suggests an API-flavor mismatch, but we do not know the actual MediaPipe generator or compile classpath and have not inferred it as fact. We have not substituted the full runtime, patched vendor classes, or waived compatibility checks.
What is the maintainer-supported correction for these exact artifacts that retains an Android Lite runtime with current applicable protobuf security fixes: please identify the intended protoc/generated-source revision and compile-time Any API flavor, explain the seven concrete-return calls under the declared Lite dependency, and provide the exact supported corrected Maven coordinate(s)/version(s), official source/release/fix linkage and compatible protobuf runtime version—or explicitly confirm that no supported corrected artifact is presently available?
Source: google-ai-edge/mediapipe