Cap protobuf<7 in file_organizer and image_service (supersedes #507, #510)#663
Open
pdettori wants to merge 1 commit into
Open
Cap protobuf<7 in file_organizer and image_service (supersedes #507, #510)#663pdettori wants to merge 1 commit into
pdettori wants to merge 1 commit into
Conversation
protobuf 7.x is incompatible with every released opentelemetry: the opentelemetry-proto package requires protobuf>=5.0,<7.0. Bumping to protobuf>=7 (Dependabot #507/#510) forces uv to walk the entire OpenTelemetry stack back to a 2022-era release (1.11.1), which is incompatible with the retained modern otel-api/sdk and crashes the agent at startup (test-startup: exit 2, server never binds). There is no security benefit: the existing protobuf>=6.33.5 pin already resolves 6.33.6, which mitigates CVE-2026-0994. Cap protobuf<7 (still >=6.33.5) in both services and re-lock. This also prevents Dependabot from recreating the major-bump PRs, since they can no longer satisfy the constraint. Supersedes #507 and #510. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
This was referenced Jul 8, 2026
esnible
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supersedes Dependabot #507 (
a2a/file_organizer) and #510 (a2a/image_service), which both bumpprotobuf6.33.6 → 7.35.0 and failtest-startup.Root cause
protobuf7.x is incompatible with every released OpenTelemetry —opentelemetry-protorequiresprotobuf>=5.0,<7.0. To satisfyprotobuf>=7, uv walks the whole OTel stack back to a 2022-era release (opentelemetry-*1.11.1), which is incompatible with the retained modernopentelemetry-api/sdk+ instrumentation and crashes the agent at startup (exit 2, Uvicorn never binds).There's no security benefit: the existing
protobuf>=6.33.5pin already resolves 6.33.6, which mitigates CVE-2026-0994.Fix
protobuf>=6.33.5,<7in both services + re-lock.opentelemetry-protostays at 1.43.0 (no downgrade).<7cap prevents Dependabot from recreating the major-bump PRs, since they can no longer satisfy the constraint.Closes #507. Closes #510.
Assisted-By: Claude Code