Bumping to TF 2.7.1, protobuf 3.19.4, error-prone 2.10.0

pom.xml

@@ -42,7 +42,7 @@
     <junit.version>5.6.2</junit.version>
     <jmh.version>1.21</jmh.version>
     <versions-plugin.version>2.7</versions-plugin.version>
-    <errorprone.version>2.6.0</errorprone.version>
+    <errorprone.version>2.10.0</errorprone.version>
     <maven.javadoc.skip>true</maven.javadoc.skip>
     <maven.source.skip>true</maven.source.skip>
     <gpg.skip>true</gpg.skip>

tensorflow-core/pom.xml

@@ -40,8 +40,10 @@
     Match version used by TensorFlow, in
     https://github.com/tensorflow/tensorflow/blob/master/tensorflow/workspace2.bzl#L567
     (but for the currently used release, not master)
+
+    Bumped to newer version to patch a CVE only present in protobuf-java
     -->
-    <protobuf.version>3.9.2</protobuf.version>
+    <protobuf.version>3.19.2</protobuf.version>
 
     <native.classifier>${javacpp.platform}${javacpp.platform.extension}</native.classifier>
     <javacpp.build.skip>false</javacpp.build.skip>       <!-- To skip execution of build.sh: -Djavacpp.build.skip=true -->

tensorflow-core/tensorflow-core-api/WORKSPACE

@@ -18,10 +18,10 @@ http_archive(
     patch_args = ["-p1"],
     patch_cmds = ["grep -rl 'java_package' tensorflow/core | xargs sed -i.bak 's/^\(.* java_package = \"org\.tensorflow\.\)\(.*\"\)/\\1proto.\\2'/"],
     urls = [
-       "https://github.com/tensorflow/tensorflow/archive/refs/tags/v2.7.0.tar.gz",
+       "https://github.com/tensorflow/tensorflow/archive/refs/tags/v2.7.1.tar.gz",
     ],
-    sha256 = "bb124905c7fdacd81e7c842b287c169bbf377d29c74c9dacc04f96c9793747bb",
-    strip_prefix = "tensorflow-2.7.0"
+    sha256 = "abebe2cf5ca379e18071693ca5f45b88ade941b16258a21cc1f12d77d5387a21",
+    strip_prefix = "tensorflow-2.7.1"
 )
 
 # START: Upstream TensorFlow dependencies