Firebase-ios-sdk: FR: Update nanopb because of security finding

[karlkaminski]

Feature proposal

• Firebase Component: Core

In our project we use whitesources to find security issues in the code.
We got an security finding in the nanopb library in the newest firebase 6.21.0
https://nvd.nist.gov/vuln/detail/CVE-2020-5235

Could you please update to a nanopb version that fixed this security issue?

Thank you

[paulb777]

@karlkaminski Thanks for the report. Our nanopb migration is currently pending migrating the Firestore gRPC dependency from a nanopb-dependent version. See #4312.

Once that happens, we'll move the Firebase nanopb version forward.

[tereznikov]

@paulb777 What is approximate estimation for merging #4312?
We also use WhiteSource and saw the issue with the nanopb.

[paulb777]

@tereznikov We don't make commitments about future releases, but will work on the nanopb update in the next month or two."

[paulb777]

Now that #4312 has landed, I'm going to pick up the nanopb update project again and try to get it into the next release.