Skip to content

fix(deps): remove protobuf<7 upper bound - #1241

Closed
mykytanetipa wants to merge 1 commit into
a2aproject:mainfrom
mykytanetipa:fix/1234-allow-protobuf-7
Closed

mykytanetipa wants to merge 1 commit into
a2aproject:mainfrom
mykytanetipa:fix/1234-allow-protobuf-7

Conversation

@mykytanetipa

Copy link
Copy Markdown
Collaborator

Removes the "protobuf<7" upper bound and resolves uv.lock with protobuf 7.36.1, which addresses the vulnerability reported in protobuf 6.33.6.

The deprecated FieldDescriptor.label usage that blocked protobuf 7 support was already handled by the _field_is_repeated shim (#1158).

Fixes #1234

@mykytanetipa
mykytanetipa requested a review from a team as a code owner September 15, 2026 11:11
Removes the `protobuf<7` (and `types-protobuf<7`) upper bounds so the SDK
can resolve protobuf 7.36.1, which addresses the vulnerability reported in
protobuf 6.33.6. The deprecated `FieldDescriptor.label` usage that blocked
protobuf 7 was already handled by the `_field_is_repeated` shim (a2aproject#1158).

Fixes a2aproject#1234
@mykytanetipa
mykytanetipa force-pushed the fix/1234-allow-protobuf-7 branch from 5de0f49 to 7d3e4e8 Compare September 15, 2026 11:22
@mykytanetipa
mykytanetipa marked this pull request as draft September 16, 2026 08:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: python-protobuf:6.33.6 vulnerability

1 participant