Pin Protobuf JavaLite to 3.25.8

[jonathanpeppers]

Firebase Protolite and gRPC depend on Protobuf JavaLite 3.25.x, but our NuGet mapping had independently advanced them to JavaLite 4.x. Starting in JavaLite 4.27, the artifact contains DescriptorProtos bytecode that is also embedded in Firebase Protolite, causing D8 duplicate-class failures in consuming Android apps.

This change freezes Xamarin.Protobuf.JavaLite at the compatible 3.25.8 version while retaining a frozen dependency-only 4.26.1 mapping for MediaPipe, the last compatible 4.x release before the conflicting classes appeared. It bumps every already-published package in the affected Firebase, MediaPipe, and Cronet reverse dependency graphs so their immutable NuGet metadata carries the corrected dependencies; currently unpublished consumers retain their existing versions. Generated artifact documentation and Component Governance metadata are refreshed from the completed config.

Fixes #1535

[Copilot]

Pull request overview

Pins the repository’s Protobuf JavaLite mapping to a Protobuf 3.25.x version to prevent downstream Android D8 duplicate-class failures caused by newer JavaLite artifacts overlapping with Firebase Protolite bytecode. This aligns the NuGet dependency graph for Firebase Firestore / Protolite and gRPC with their expected Protobuf 3.25.x baseline while still allowing MediaPipe’s older 4.26.1 requirement via a dependency-only mapping.

Changes:

• Pin com.google.protobuf:protobuf-javalite / Xamarin.Protobuf.JavaLite to 3.25.8 and mark it frozen.
• Bump NuGet revisions for the affected Firebase and gRPC packages.
• Add a dependency-only mapping for protobuf-javalite 4.26.1 to satisfy MediaPipe’s explicit requirement.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
docs/artifact-list-with-versions.md	Updates the published artifact/version table to reflect the new JavaLite pin and bumped package revisions.
config.json	Pins JavaLite to 3.25.8 (frozen), bumps dependent package revisions, and adds a dependency-only JavaLite 4.26.1 mapping for MediaPipe.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[jonathanpeppers]

@dalexsoto review

[dalexsoto]

The 4.26.1 freeze is fixed, but two independent blocking completeness gaps remain.

1. Propagate every changed dependency revision. The JavaLite remap changes generated NuGet dependencies for five already-published packages whose versions are unchanged in config.json: Xamarin.Firebase.InAppMessaging (config.json:4019), Xamarin.Firebase.Perf (config.json:4199), Xamarin.Google.MediaPipe.Tasks.GenAI (config.json:4316), and Cronet Embedded/Shared (config.json:5057,5073). Binderator resolves each POM dependency through the new mappings (BindingProjectDependencyVerifier.cs:31-50) and packs that result (source/AndroidXProject.cshtml:155-169), but NuGet.org already contains these exact immutable versions with the old Protolite/gRPC/JavaLite dependencies. For example, the published Perf package still requires both Protolite .6 and JavaLite 4.35.1.1, so the D8 duplicate-class graph remains. Bump those five packages, then propagate the revisions through the already-published reverse consumers: InAppMessaging Display; both LocalAgents packages; Cronet API, Common, Fallback, and HttpEngine Native Provider; Google Play Services Cronet; Google Android Recaptcha; and Firebase Auth. The currently unpublished Media3 DataSource Cronet and Ads Mobile SDK versions can be generated against the corrected chain without revision bumps.

2. Regenerate cgmanifest.json. Its Firestore, Protolite, JavaLite, and gRPC entries still report 126.0.2.3, 118.0.1.6, 4.35.1/4.35.1.1, and 1.82.0.1 (cgmanifest.json:6852-6856,7242-7246,7837-7841,8199-8203). The documented generator copies every non-dependency-only mapping from config.json into this manifest (utilities.cake:282-341), so Component Governance and the repository’s published component/license inventory remain stale. Regenerate and commit the manifest after completing the revision cascade.

[jonathanpeppers]

Addressed the requested completeness gaps: bumped every already-published package in the affected reverse dependency graphs, left only the two unpublished consumers unchanged, and regenerated both artifact documentation and cgmanifest.json. PR #1539 is now stacked on this branch so its overlapping XBD revisions retain the corrected dependency graph.

[dalexsoto]

The complete published JavaLite reverse-dependency closure now has new immutable revisions, and all 701 non-dependency mappings match the regenerated artifact and Component Governance inventories.