#6364·mediapipe

Tasks Core/Vision 1.0.0 Any.Builder concrete-return calls versus declared protobuf-javalite dependency

Author: AnwiisInnovationCreated Sep 8, 2026Updated Sep 14, 2026
Labelstype:build/installplatform:android

We inspected these official Maven artifacts without modifying them:

Artifact Bytes SHA-256
com.google.mediapipe:tasks-core:1.0.0 AAR 22,510,915 609c6fcfe59f58c9739194f65ae5882281c327710e1a616aa7f533a4d9238ca3
com.google.mediapipe:tasks-vision:1.0.0 AAR 495,413 53d45569649ff7e9d84457f070481dbb779ddd057671d4adcd9abcb77ff172c6
com.google.protobuf:protobuf-javalite:4.26.1 JAR 713,994 ae83d2b063988c4565462845269472ddc817117506b6e467a2c3222c96636829
com.google.protobuf:protobuf-javalite:4.36.1 JAR, isolated candidate only 1,022,979 91d3dba2521322103230c509d41a017da3a5e6766610adcb10c5bb127cbb26c5

Tasks Core's published 1.0.0 POM declares protobuf-javalite 4.26.1. Seven actual bytecode instructions in these MediaPipe classes invoke com/google/protobuf/Any$Builder.build:()Lcom/google/protobuf/Any;:

  1. CalculatorProto$CalculatorGraphConfig$Builder.setGraphOptions(int, Any.Builder) — offset 13.
  2. CalculatorProto$CalculatorGraphConfig$Builder.addGraphOptions(Any.Builder) — offset 12.
  3. CalculatorProto$CalculatorGraphConfig$Builder.addGraphOptions(int, Any.Builder) — offset 13.
  4. CalculatorProto$CalculatorGraphConfig$Node$Builder.setNodeOptions(int, Any.Builder) — offset 13.
  5. CalculatorProto$CalculatorGraphConfig$Node$Builder.addNodeOptions(Any.Builder) — offset 12.
  6. CalculatorProto$CalculatorGraphConfig$Node$Builder.addNodeOptions(int, Any.Builder) — offset 13.
  7. HolisticLandmarker$HolisticLandmarkerOptions.convertToAnyProto() — offset 277.

The CalculatorProto classes are in com.google.mediapipe.proto; HolisticLandmarker is in com.google.mediapipe.tasks.vision.holisticlandmarker. Both examined Lite JARs lack this exact Any-returning descriptor; their inherited build descriptors return GeneratedMessageLite or MessageLite. The official full-Java Any.Builder API declares the concrete Any return. This suggests an API-flavor mismatch, but we do not know the actual MediaPipe generator or compile classpath and have not inferred it as fact. We have not substituted the full runtime, patched vendor classes, or waived compatibility checks.

What is the maintainer-supported correction for these exact artifacts that retains an Android Lite runtime with current applicable protobuf security fixes: please identify the intended protoc/generated-source revision and compile-time Any API flavor, explain the seven concrete-return calls under the declared Lite dependency, and provide the exact supported corrected Maven coordinate(s)/version(s), official source/release/fix linkage and compatible protobuf runtime version—or explicitly confirm that no supported corrected artifact is presently available?

Source: google-ai-edge/mediapipe