Commit 47757ff
authored
Update protobuf to 5.29.5 to address security vulnerability (#525)
## Problem
The Pinecone Python client is currently using protobuf version `^5.29`,
which includes vulnerable versions that are affected by
[GHSA-8qvm-5x2c-j2w7](GHSA-8qvm-5x2c-j2w7).
This vulnerability involves uncontrolled recursion in Protobuf's
pure-Python backend, which could lead to Denial of Service (DoS)
attacks.
## Solution
Updated the protobuf dependency constraint from `^5.29` to `^5.29.5` to
ensure we're using the patched version that addresses this security
vulnerability. The changes include:
- Updated `pyproject.toml`: Changed protobuf version constraint from
`^5.29` to `^5.29.5`
- Updated `testing-dependency-grpc.yaml`: Updated protobuf version from
`5.29.1` to `5.29.5` in all three dependency testing matrix
configurations
- Verified that `poetry.lock` already contains protobuf 5.29.5, so no
additional lock file updates were needed
This is a patch version update, so no breaking changes are expected. The
protobuf dependency is optional and only installed when the `grpc` extra
is requested.
**Note:** This is a security patch release to address the immediate
vulnerability for existing users. A future release will include a
comprehensive update to protobuf 6.x, which may include breaking changes
and will require more extensive testing and migration planning.
## Type of Change
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] This change requires a documentation update
- [ ] Infrastructure change (CI configs, etc)
- [ ] Non-code change (docs, etc)
- [ ] None of the above: (explain here)
## Test Plan
- Verified protobuf 5.29.5 is already installed and working
- Updated CI/CD pipeline to test with the new version
- No breaking changes expected as this is a patch version update1 parent 7f96c60 commit 47757ff
File tree
3 files changed
+158
-34
lines changed- .github/workflows
3 files changed
+158
-34
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
47 | | - | |
| 47 | + | |
48 | 48 | | |
49 | 49 | | |
50 | 50 | | |
| |||
83 | 83 | | |
84 | 84 | | |
85 | 85 | | |
86 | | - | |
| 86 | + | |
87 | 87 | | |
88 | 88 | | |
89 | 89 | | |
| |||
121 | 121 | | |
122 | 122 | | |
123 | 123 | | |
124 | | - | |
| 124 | + | |
125 | 125 | | |
126 | 126 | | |
127 | 127 | | |
| |||
0 commit comments