chore(deps): [contextual-ai] Update dependency protobuf to v6.33.5 [SECURITY] #314

renovate-bot · 2026-02-01T11:07:03Z

This PR contains the following updates:

Package	Change	Age	Confidence
protobuf	`6.33.2` → `6.33.5`
protobuf	`5.29.5` → `6.33.5`
protobuf	`==4.25.8` → `==6.33.5`
protobuf	`4.25.8` → `6.33.5`
protobuf	`6.33.1` → `6.33.5`

GitHub Vulnerability Alerts

CVE-2026-0994

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

protobuf affected by a JSON recursion depth bypass

CVE-2026-0994 / GHSA-7gcm-g887-7qv7

More information

Details

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…ECURITY]

forking-renovate · 2026-02-01T11:07:05Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: projects/conversational-commerce-agent/data-ingestion/requirements.txt

Command failed: pip-compile --generate-hashes requirements.in
  ERROR: Cannot install -r requirements.in (line 6) and protobuf==6.33.5 because these package versions have conflicting dependencies.
Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 99, in resolve
    result = self._result = resolver.resolve(
                            ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 601, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 542, in resolve
    raise ResolutionImpossible(self.state.backtrack_causes)
pip._vendor.resolvelib.resolvers.exceptions.ResolutionImpossible: [RequirementInformation(requirement=SpecifierRequirement('protobuf==6.33.5'), parent=None), RequirementInformation(requirement=SpecifierRequirement('protobuf!=3.20.0,!=3.20.1,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5,<6.0.0.dev0,>=3.19.5'), parent=LinkCandidate('https://files.pythonhosted.org/packages/17/a4/c26886d57d90032c5f74c2e80aefdc38ec58551fc46bd4ce79fb2c9389fa/google_api_core-2.23.0-py3-none-any.whl (from https://pypi.org/simple/google-api-core/) (requires-python:>=3.7)'))]

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/bin/pip-compile", line 7, in <module>
    sys.exit(cli())
             ^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 1485, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 1406, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 1269, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 824, in invoke
    return callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/decorators.py", line 34, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/piptools/scripts/compile.py", line 481, in cli
    results = resolver.resolve(max_rounds=max_rounds)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/piptools/resolver.py", line 641, in resolve
    is_resolved = self._do_resolve(
                  ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/piptools/resolver.py", line 676, in _do_resolve
    resolver.resolve(
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 108, in resolve
    raise error from e
pip._internal.exceptions.DistributionNotFound: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

File name: projects/vision-ai-edge-platform/camera-client/requirements.txt

Command failed: pip-compile --generate-hashes requirements.in --upgrade-package=protobuf==6.33.5
  ERROR: Cannot install google-api-core because these package versions have conflicting dependencies.
Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/pip/_vendor/resolvelib/resolvers.py", line 316, in _backjump
    name, candidate = broken_state.mapping.popitem()
KeyError: 'dictionary is empty'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 95, in resolve
    result = self._result = resolver.resolve(
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/pip/_vendor/resolvelib/resolvers.py", line 546, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/pip/_vendor/resolvelib/resolvers.py", line 434, in resolve
    success = self._backjump(causes)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/pip/_vendor/resolvelib/resolvers.py", line 318, in _backjump
    raise ResolutionImpossible(causes)
pip._vendor.resolvelib.resolvers.ResolutionImpossible: [RequirementInformation(requirement=SpecifierRequirement('protobuf!=3.20.0,!=3.20.1,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5,<5.0.0.dev0,>=3.19.5'), parent=LinkCandidate('https://files.pythonhosted.org/packages/2d/ed/e514e0c59cdf1a469b1a1ab21b77698d0692adaa7cbc920c3a0b287e8493/google_api_core-2.19.0-py3-none-any.whl (from https://pypi.org/simple/google-api-core/) (requires-python:>=3.7)'))]

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/bin/pip-compile", line 8, in <module>
    sys.exit(cli())
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/click/core.py", line 1161, in __call__
    return self.main(*args, **kwargs)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/click/core.py", line 1082, in main
    rv = self.invoke(ctx)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/click/core.py", line 1443, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/click/core.py", line 788, in invoke
    return __callback(*args, **kwargs)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/click/decorators.py", line 33, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/piptools/scripts/compile.py", line 481, in cli
    results = resolver.resolve(max_rounds=max_rounds)
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/piptools/resolver.py", line 641, in resolve
    is_resolved = self._do_resolve(
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/piptools/resolver.py", line 676, in _do_resolve
    resolver.resolve(
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.8.20/lib/python3.8/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 104, in resolve
    raise error from e
pip._internal.exceptions.DistributionNotFound: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

File name: projects/dataflow-gcs-to-alloydb/requirements.txt

Command failed: pip-compile --generate-hashes --output-file=requirements.txt requirements.in --upgrade-package=protobuf==6.33.5
  ERROR: Cannot install apache-beam and apache-beam[gcp]==2.70.0 because these package versions have conflicting dependencies.
Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 99, in resolve
    result = self._result = resolver.resolve(
                            ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 601, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 542, in resolve
    raise ResolutionImpossible(self.state.backtrack_causes)
pip._vendor.resolvelib.resolvers.exceptions.ResolutionImpossible: [RequirementInformation(requirement=SpecifierRequirement('protobuf!=4.0.*,!=4.21.*,!=4.22.0,!=4.23.*,!=4.24.*,<7.0.0.dev0,>=3.20.3'), parent=LinkCandidate('https://files.pythonhosted.org/packages/37/28/5344e51657e28699f0170f3d65894b2a20874b6a88859ddbfbeb5c62e937/apache_beam-2.70.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (from https://pypi.org/simple/apache-beam/) (requires-python:>=3.10)')), RequirementInformation(requirement=SpecifierRequirement('protobuf!=4.0.*,!=4.21.*,!=4.22.0,!=4.23.*,!=4.24.*,<7.0.0.dev0,>=3.20.3'), parent=ExtrasCandidate(base=LinkCandidate('https://files.pythonhosted.org/packages/37/28/5344e51657e28699f0170f3d65894b2a20874b6a88859ddbfbeb5c62e937/apache_beam-2.70.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (from https://pypi.org/simple/apache-beam/) (requires-python:>=3.10)'), extras=frozenset({'gcp'}))), RequirementInformation(requirement=SpecifierRequirement('protobuf!=3.20.0,!=3.20.1,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5,<6.0.0.dev0,>=3.19.5'), parent=LinkCandidate('https://files.pythonhosted.org/packages/17/a4/c26886d57d90032c5f74c2e80aefdc38ec58551fc46bd4ce79fb2c9389fa/google_api_core-2.23.0-py3-none-any.whl (from https://pypi.org/simple/google-api-core/) (requires-python:>=3.7)'))]

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/bin/pip-compile", line 7, in <module>
    sys.exit(cli())
             ^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 1485, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 1406, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 1269, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 824, in invoke
    return callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/decorators.py", line 34, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/piptools/scripts/compile.py", line 481, in cli
    results = resolver.resolve(max_rounds=max_rounds)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/piptools/resolver.py", line 641, in resolve
    is_resolved = self._do_resolve(
                  ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/piptools/resolver.py", line 676, in _do_resolve
    resolver.resolve(
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 108, in resolve
    raise error from e
pip._internal.exceptions.DistributionNotFound: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

File name: projects/dataflow-gcs-to-alloydb/requirements-dev.txt

Command failed: pip-compile --generate-hashes --output-file=requirements-dev.txt requirements-dev.in --upgrade-package=protobuf==6.33.5
  ERROR: Cannot install apache-beam and apache-beam[gcp]==2.70.0 because these package versions have conflicting dependencies.
Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 99, in resolve
    result = self._result = resolver.resolve(
                            ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 601, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 542, in resolve
    raise ResolutionImpossible(self.state.backtrack_causes)
pip._vendor.resolvelib.resolvers.exceptions.ResolutionImpossible: [RequirementInformation(requirement=SpecifierRequirement('protobuf!=4.0.*,!=4.21.*,!=4.22.0,!=4.23.*,!=4.24.*,<7.0.0.dev0,>=3.20.3'), parent=LinkCandidate('https://files.pythonhosted.org/packages/37/28/5344e51657e28699f0170f3d65894b2a20874b6a88859ddbfbeb5c62e937/apache_beam-2.70.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (from https://pypi.org/simple/apache-beam/) (requires-python:>=3.10)')), RequirementInformation(requirement=SpecifierRequirement('protobuf!=4.0.*,!=4.21.*,!=4.22.0,!=4.23.*,!=4.24.*,<7.0.0.dev0,>=3.20.3'), parent=ExtrasCandidate(base=LinkCandidate('https://files.pythonhosted.org/packages/37/28/5344e51657e28699f0170f3d65894b2a20874b6a88859ddbfbeb5c62e937/apache_beam-2.70.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (from https://pypi.org/simple/apache-beam/) (requires-python:>=3.10)'), extras=frozenset({'gcp'}))), RequirementInformation(requirement=SpecifierRequirement('protobuf!=3.20.0,!=3.20.1,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5,<6.0.0.dev0,>=3.19.5'), parent=LinkCandidate('https://files.pythonhosted.org/packages/17/a4/c26886d57d90032c5f74c2e80aefdc38ec58551fc46bd4ce79fb2c9389fa/google_api_core-2.23.0-py3-none-any.whl (from https://pypi.org/simple/google-api-core/) (requires-python:>=3.7)'))]

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/bin/pip-compile", line 7, in <module>
    sys.exit(cli())
             ^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 1485, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 1406, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 1269, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/core.py", line 824, in invoke
    return callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/click/decorators.py", line 34, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/piptools/scripts/compile.py", line 481, in cli
    results = resolver.resolve(max_rounds=max_rounds)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/piptools/resolver.py", line 641, in resolve
    is_resolved = self._do_resolve(
                  ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/piptools/resolver.py", line 676, in _do_resolve
    resolver.resolve(
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.12.12/lib/python3.12/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 108, in resolve
    raise error from e
pip._internal.exceptions.DistributionNotFound: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

File name: projects/conversational-commerce-agent/conversational-agent-examples/assets/apparel-search-cf/requirements.txt

Command failed: pip-compile --generate-hashes requirements.in --upgrade-package=protobuf==6.33.5
  ERROR: Cannot install -r requirements.in (line 2) because these package versions have conflicting dependencies.
Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 99, in resolve
    result = self._result = resolver.resolve(
                            ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 601, in resolve
    state = resolution.resolve(requirements, max_rounds=max_rounds)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_vendor/resolvelib/resolvers/resolution.py", line 542, in resolve
    raise ResolutionImpossible(self.state.backtrack_causes)
pip._vendor.resolvelib.resolvers.exceptions.ResolutionImpossible: [RequirementInformation(requirement=SpecifierRequirement('protobuf!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5,<6.0.0dev,>=3.20.2'), parent=LinkCandidate('https://files.pythonhosted.org/packages/a9/8f/743ceac8fa8989acd08fa02bce9fa15ab841bce3fffbb10b6a96a4f7a90e/google_cloud_retail-1.24.0-py2.py3-none-any.whl (from https://pypi.org/simple/google-cloud-retail/) (requires-python:>=3.7)'))]

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/bin/pip-compile", line 7, in <module>
    sys.exit(cli())
             ^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 1485, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 1406, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 1269, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/core.py", line 824, in invoke
    return callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/click/decorators.py", line 34, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/piptools/scripts/compile.py", line 481, in cli
    results = resolver.resolve(max_rounds=max_rounds)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/piptools/resolver.py", line 641, in resolve
    is_resolved = self._do_resolve(
                  ^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/piptools/resolver.py", line 676, in _do_resolve
    resolver.resolve(
  File "/opt/containerbase/tools/pip-tools/7.5.2/3.11.14/lib/python3.11/site-packages/pip/_internal/resolution/resolvelib/resolver.py", line 108, in resolve
    raise error from e
pip._internal.exceptions.DistributionNotFound: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts

chore(deps): [contextual-ai] Update dependency protobuf to v6.33.5 [S…

ec41ee0

…ECURITY]

forking-renovate bot added p0 SECURITY labels Feb 1, 2026

renovate-bot requested review from michael-chi and mservidio as code owners February 1, 2026 11:07

renovate-bot added the SECURITY label Feb 1, 2026

renovate-bot added the p0 label Feb 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): [contextual-ai] Update dependency protobuf to v6.33.5 [SECURITY] #314

chore(deps): [contextual-ai] Update dependency protobuf to v6.33.5 [SECURITY] #314

Uh oh!

renovate-bot commented Feb 1, 2026

Uh oh!

forking-renovate bot commented Feb 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): [contextual-ai] Update dependency protobuf to v6.33.5 [SECURITY] #314

Are you sure you want to change the base?

chore(deps): [contextual-ai] Update dependency protobuf to v6.33.5 [SECURITY] #314

Uh oh!

Conversation

renovate-bot commented Feb 1, 2026

GitHub Vulnerability Alerts

CVE-2026-0994

protobuf affected by a JSON recursion depth bypass

Details

Severity

References

Configuration

Uh oh!

forking-renovate bot commented Feb 1, 2026

⚠️ Artifact update problem

File name: projects/conversational-commerce-agent/data-ingestion/requirements.txt

File name: projects/vision-ai-edge-platform/camera-client/requirements.txt

File name: projects/dataflow-gcs-to-alloydb/requirements.txt

File name: projects/dataflow-gcs-to-alloydb/requirements-dev.txt

File name: projects/conversational-commerce-agent/conversational-agent-examples/assets/apparel-search-cf/requirements.txt

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant