Skip to content

Conversation

@SpencerC
Copy link
Contributor

@SpencerC SpencerC commented Sep 5, 2025

What was changed

protobuf and grpcio updated to the latest versions.

Why?

Fixes compatibility issue with Python code generated protobuf >31.1. This change is backwards compatible per: https://protobuf.dev/support/cross-version-runtime-guarantee

Checklist

  1. Closes [Bug] Unable to import generated protocol buffer code #1080

  2. How was this tested: ran poe test per README.md.

  1. Any docs updates needed?
    I don't think so.

@SpencerC SpencerC requested a review from a team as a code owner September 5, 2025 19:44
@CLAassistant
Copy link

CLAassistant commented Sep 5, 2025

CLA assistant check
All committers have signed the CLA.

@tconley1428
Copy link
Contributor

I think we don't necessarily want to raise the dependency floor to version 6.

@SpencerC
Copy link
Contributor Author

@tconley1428 what problem does a lower dependency floor solve and do the benefits outweigh the risks? If so, what floor would you like to see? There are at least two security issues effecting older versions:
GHSA-8qvm-5x2c-j2w7
GHSA-8gq9-2x98-w8hf

Also, any code generated outside this package with more recent versions of protobuf should be forward compatible.

@tconley1428
Copy link
Contributor

We are a library, so we need to support users where they are. Some users are on older versions of protobuf, so we can't just disallow them. We should leave it as is and increase the ceiling.

@SpencerC
Copy link
Contributor Author

@tconley1428 moved the floor back to 3.20.

@tconley1428 tconley1428 merged commit 2a2b83b into temporalio:main Sep 16, 2025
16 checks passed
@SpencerC SpencerC deleted the update_protobuf branch September 16, 2025 18:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Unable to import generated protocol buffer code

3 participants