Update protobuf to 5.29.5 to address security vulnerability#525
Merged
rohanshah18 merged 1 commit intomainfrom Oct 31, 2025
Merged
Update protobuf to 5.29.5 to address security vulnerability#525rohanshah18 merged 1 commit intomainfrom
rohanshah18 merged 1 commit intomainfrom
Conversation
austin-denoble
approved these changes
Oct 13, 2025
Contributor
austin-denoble
left a comment
austin-denoble
left a comment
There was a problem hiding this comment.
Seems reasonable to me, thanks for following up on this.
I'll defer to @jhamon for any Python specifics around this.
Contributor
Author
|
Admin api tests are failing but they are safe to ignore because of some internal changes to org which resulted in max_pods = 20 instead 0. |
jhamon
pushed a commit
that referenced
this pull request
Nov 4, 2025
## Problem The Pinecone Python client is currently using protobuf version `^5.29`, which includes vulnerable versions that are affected by [GHSA-8qvm-5x2c-j2w7](GHSA-8qvm-5x2c-j2w7). This vulnerability involves uncontrolled recursion in Protobuf's pure-Python backend, which could lead to Denial of Service (DoS) attacks. ## Solution Updated the protobuf dependency constraint from `^5.29` to `^5.29.5` to ensure we're using the patched version that addresses this security vulnerability. The changes include: - Updated `pyproject.toml`: Changed protobuf version constraint from `^5.29` to `^5.29.5` - Updated `testing-dependency-grpc.yaml`: Updated protobuf version from `5.29.1` to `5.29.5` in all three dependency testing matrix configurations - Verified that `poetry.lock` already contains protobuf 5.29.5, so no additional lock file updates were needed This is a patch version update, so no breaking changes are expected. The protobuf dependency is optional and only installed when the `grpc` extra is requested. **Note:** This is a security patch release to address the immediate vulnerability for existing users. A future release will include a comprehensive update to protobuf 6.x, which may include breaking changes and will require more extensive testing and migration planning. ## Type of Change - [X] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] This change requires a documentation update - [ ] Infrastructure change (CI configs, etc) - [ ] Non-code change (docs, etc) - [ ] None of the above: (explain here) ## Test Plan - Verified protobuf 5.29.5 is already installed and working - Updated CI/CD pipeline to test with the new version - No breaking changes expected as this is a patch version update
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Pinecone Python client is currently using protobuf version
^5.29, which includes vulnerable versions that are affected by GHSA-8qvm-5x2c-j2w7. This vulnerability involves uncontrolled recursion in Protobuf's pure-Python backend, which could lead to Denial of Service (DoS) attacks.Solution
Updated the protobuf dependency constraint from
^5.29to^5.29.5to ensure we're using the patched version that addresses this security vulnerability. The changes include:pyproject.toml: Changed protobuf version constraint from^5.29to^5.29.5testing-dependency-grpc.yaml: Updated protobuf version from5.29.1to5.29.5in all three dependency testing matrix configurationspoetry.lockalready contains protobuf 5.29.5, so no additional lock file updates were neededThis is a patch version update, so no breaking changes are expected. The protobuf dependency is optional and only installed when the
grpcextra is requested.Note: This is a security patch release to address the immediate vulnerability for existing users. A future release will include a comprehensive update to protobuf 6.x, which may include breaking changes and will require more extensive testing and migration planning.
Type of Change
Test Plan