Skip to content

Commit 47757ff

Browse files
authored
Update protobuf to 5.29.5 to address security vulnerability (#525)
## Problem The Pinecone Python client is currently using protobuf version `^5.29`, which includes vulnerable versions that are affected by [GHSA-8qvm-5x2c-j2w7](GHSA-8qvm-5x2c-j2w7). This vulnerability involves uncontrolled recursion in Protobuf's pure-Python backend, which could lead to Denial of Service (DoS) attacks. ## Solution Updated the protobuf dependency constraint from `^5.29` to `^5.29.5` to ensure we're using the patched version that addresses this security vulnerability. The changes include: - Updated `pyproject.toml`: Changed protobuf version constraint from `^5.29` to `^5.29.5` - Updated `testing-dependency-grpc.yaml`: Updated protobuf version from `5.29.1` to `5.29.5` in all three dependency testing matrix configurations - Verified that `poetry.lock` already contains protobuf 5.29.5, so no additional lock file updates were needed This is a patch version update, so no breaking changes are expected. The protobuf dependency is optional and only installed when the `grpc` extra is requested. **Note:** This is a security patch release to address the immediate vulnerability for existing users. A future release will include a comprehensive update to protobuf 6.x, which may include breaking changes and will require more extensive testing and migration planning. ## Type of Change - [X] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] This change requires a documentation update - [ ] Infrastructure change (CI configs, etc) - [ ] Non-code change (docs, etc) - [ ] None of the above: (explain here) ## Test Plan - Verified protobuf 5.29.5 is already installed and working - Updated CI/CD pipeline to test with the new version - No breaking changes expected as this is a patch version update
1 parent 7f96c60 commit 47757ff

File tree

3 files changed

+158
-34
lines changed

3 files changed

+158
-34
lines changed

.github/workflows/testing-dependency-grpc.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
# - 4.1.0
4545
- 4.3.3
4646
protobuf_version:
47-
- 5.29.1
47+
- 5.29.5
4848
protoc-gen-openapiv2:
4949
- 0.0.1
5050
googleapis_common_protos_version:
@@ -83,7 +83,7 @@ jobs:
8383
# - 3.1.3
8484
- 4.3.3
8585
protobuf_version:
86-
- 5.29.1
86+
- 5.29.5
8787
protoc-gen-openapiv2:
8888
- 0.0.1
8989
googleapis_common_protos_version:
@@ -121,7 +121,7 @@ jobs:
121121
# - 3.1.3
122122
- 4.3.3
123123
protobuf_version:
124-
- 5.29.1
124+
- 5.29.5
125125
protoc-gen-openapiv2:
126126
- 0.0.1
127127
googleapis_common_protos_version:

0 commit comments

Comments
 (0)