[shivaspeaks]

Per https://github.com/protocolbuffers/protobuf/releases

okshiva@okshiva-mac2 grpc-java % curl -sL https://github.com/protocolbuffers/protobuf/releases/download/v35.1/protobuf-35.1.tar.gz | shasum -a 256

f0b6838e7522a8da96126d487068c959bc624926368f3024ac8fd03abd0a1ac4

[shivaspeaks]

Note:
While upgrading Protobuf to 35.1, two secondary Bazel dependencies (rules_proto and rules_android) had to be addressed to keep the CI green. Here is the context:

1. Added rules_proto to repositories.bzl and MODULE.bazel.
   The googleapis dependency requires rules_proto to build. During the CI job (--enable_bzlmod=false), the build failed during the analysis phase because googleapis could no longer implicitly fetch rules_proto via Protobuf.

2. Upgraded to rules_android v0.7.3
   Previous version of rules_android (v0.7.2) explicitly hardcoded "com.google.protobuf:protobuf-java:4.33.4" in its internal maven artifacts. During the Android CI job, Bazel used our newly upgraded 35.1 compiler to generate internal Android resource files (gencode 4.35.1). However, because rules_android's internal tools (like ResourceProcessorBusyBox) were locked to the 4.33.4 runtime, it triggered a ProtobufRuntimeVersionException (poison pill).

[ejona86]

When merging, the "two secondary Bazel dependencies" note needs to be included in the commit message. That is relevant for the history of why the changes in the commit were done; it shouldn't be limited to the review.