Skip to content

fix: require protobuf 6.33.5 in Bazel Workspace to address CVE-2026-0994 #17254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
parthea wants to merge 9 commits into
base: main
Choose a base branch
from
+41 −31
Draft

fix: require protobuf 6.33.5 in Bazel Workspace to address CVE-2026-0994 #17254

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
7234f2e
fix: require protobuf 6.33.5 to address CVE-2026-0994
parthea May 26, 2026
18cee87
require google-api-core >= 2.24.2 for Protobuf 6.x compatibility
parthea May 26, 2026
aca06cf
testing
parthea Jun 2, 2026
eec0070
testing
parthea Jun 2, 2026
b96e65f
testing
parthea Jun 2, 2026
a719399
testing
parthea Jun 2, 2026
ee78fcc
testing
parthea Jun 2, 2026
d27bdca
testing
parthea Jun 2, 2026
a348a85
testing
parthea Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/gapic-generator/.bazeliskrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
# See https://github.com/bazelbuild/bazelisk
USE_BAZEL_VERSION=6.5.0
USE_BAZEL_VERSION=7.7.1
3 changes: 3 additions & 0 deletions packages/gapic-generator/.bazelrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,5 @@
# New protobuf requires C++17
build --repo_env=BAZEL_CXXOPTS="-std=c++17"

# Disable SFrame generation to avoid linker errors with newer GCC/binutils
build --copt=-Wa,--gsframe=no
28 changes: 18 additions & 10 deletions packages/gapic-generator/WORKSPACE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ workspace(name = "gapic_generator_python")

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

_bazel_skylib_version = "1.4.0"
_bazel_skylib_version = "1.7.1"

_bazel_skylib_sha256 = "f24ab666394232f834f74d19e2ff142b0af17466ea0c69a3f4c276ee75f6efce"
_bazel_skylib_sha256 = "bc283cdfcd526a52c3201279cda4bc298652efa898b10b4db0837dc51652756f"

http_archive(
name = "bazel_skylib",
Expand All @@ -22,15 +22,14 @@ http_archive(
],
)

_rules_python_version = "0.26.0"
_rules_python_version = "1.1.0"

_rules_python_sha256 = "9d04041ac92a0985e344235f5d946f71ac543f1b1565f2cdbc9a2aaee8adf55b"
_rules_python_sha256 = "663989c748c8868670df5943477176a917056637ef3998a0058b8d960f215bf2"

http_archive(
name = "rules_python",
sha256 = _rules_python_sha256,
strip_prefix = "rules_python-{}".format(_rules_python_version),
url = "https://github.com/bazelbuild/rules_python/archive/{}.tar.gz".format(_rules_python_version),
url = "https://github.com/bazelbuild/rules_python/releases/download/{0}/rules_python-{0}.tar.gz".format(_rules_python_version),
)

load("@rules_python//python:repositories.bzl", "py_repositories")
Expand Down Expand Up @@ -60,9 +59,9 @@ gapic_generator_python()

gapic_generator_register_toolchains()

_grpc_version = "1.71.0"
_grpc_version = "1.78.1"

_grpc_sha256 = "9313c3f8f4dd3341597f152d506a50caf571fe40f886e24ea9078891990df285"
_grpc_sha256 = "f9b1d9fe1648024150593efa077ee0f600f9823a21e9d618b4f304e6c09c9902"

http_archive(
name = "com_github_grpc_grpc",
Expand All @@ -72,16 +71,25 @@ http_archive(
)
# instantiated in grpc_deps().

_protobuf_version = "30.2"
_protobuf_version = "33.5"

_protobuf_sha256 = "07a43d88fe5a38e434c7f94129cad56a4c43a51f99336074d0799c2f7d4e44c5"
_protobuf_sha256 = "440848dffa209beb8a04e41cc352762e44f8e91342b2a43aab6af9b30713c2f6"

http_archive(
name = "com_google_protobuf",
sha256 = _protobuf_sha256,
strip_prefix = "protobuf-%s" % _protobuf_version,
urls = ["https://github.com/protocolbuffers/protobuf/archive/v%s.tar.gz" % _protobuf_version],
)

# Define the unified version of Abseil compatible with both gRPC and Protobuf 33.5
http_archive(
name = "com_google_absl",
sha256 = "4cf377543506ef2071af274be394b9aa1ef78f65750fc3382c449c285e6cb8f1",
strip_prefix = "abseil-cpp-20240116.2",
urls = ["https://github.com/abseil/abseil-cpp/archive/refs/tags/20240116.2.tar.gz"],
)

load("@com_github_grpc_grpc//bazel:grpc_deps.bzl", "grpc_deps")

grpc_deps()
Expand Down
4 changes: 2 additions & 2 deletions packages/gapic-generator/gapic/ads-templates/setup.py.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,12 @@ else:
release_status = "Development Status :: 5 - Production/Stable"

dependencies = [
"google-api-core[grpc] >= 2.10.0, < 3.0.0",
"google-api-core[grpc] >= 2.24.2, < 3.0.0",
"google-auth >= 2.14.1, <3.0.0",
"googleapis-common-protos >= 1.53.0",
"grpcio >= 1.10.0",
"proto-plus >= 1.22.3, <2.0.0",
"protobuf >= 4.25.8, < 8.0.0",
"protobuf >= 6.33.5, < 8.0.0",
{% if api.requires_package(('google', 'iam', 'v1')) %}
"grpc-google-iam-v1",
{% endif %}
Expand Down
8 changes: 4 additions & 4 deletions packages/gapic-generator/gapic/templates/%namespace/%name_%version/%sub/__init__.py.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ else: # pragma: NO COVER

def parse_version_to_tuple(version_string: str):
"""Safely converts a semantic version string to a comparable tuple of integers.
Example: "4.25.8" -> (4, 25, 8)
Example: "6.33.5" -> (6, 33, 5)
Ignores non-numeric parts and handles common version formats.
Args:
version_string: Version string in the format "x.y.z" or "x.y.z<suffix>"
Expand Down Expand Up @@ -98,9 +98,9 @@ else: # pragma: NO COVER
return (None, "--")

_dependency_package = "google.protobuf"
_next_supported_version = "4.25.8"
_next_supported_version_tuple = (4, 25, 8)
_recommendation = " (we recommend 6.x)"
_next_supported_version = "6.33.5"
_next_supported_version_tuple = (6, 33, 5)
_recommendation = " (we recommend 7.x)"
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since the minimum supported version is 6.33.5 (which is a 6.x version), recommending 7.x is unnecessary and potentially confusing for users who are on an older 6.x version (e.g., 6.30.0). They only need to upgrade to 6.33.5 or later within the 6.x series. Recommending 6.x is more appropriate.

        _recommendation = " (we recommend 6.x)"

(_version_used, _version_used_string) = _get_version(_dependency_package)
if _version_used and _version_used < _next_supported_version_tuple:
warnings.warn(f"Package {_package_label} depends on " +
Expand Down
5 changes: 2 additions & 3 deletions packages/gapic-generator/gapic/templates/setup.py.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ else:
release_status = "Development Status :: 5 - Production/Stable"

dependencies = [
"google-api-core[grpc] >= 2.17.1, <3.0.0",
"google-api-core[grpc] >= 2.24.2, <3.0.0",
# Exclude incompatible versions of `google-auth`
# See https://github.com/googleapis/google-cloud-python/issues/12364
"google-auth >= 2.14.1, <3.0.0,!=2.24.0,!=2.25.0",
Expand All @@ -42,7 +42,7 @@ dependencies = [
"proto-plus >= 1.22.3, <2.0.0",
"proto-plus >= 1.25.0, <2.0.0; python_version >= '3.13'",
{# Explicitly exclude protobuf versions mentioned in https://cloud.google.com/support/bulletins#GCP-2022-019 #}
"protobuf >= 4.25.8, < 8.0.0",
"protobuf >= 6.33.5, < 8.0.0",
{% for package_tuple, package_info in pypi_packages.items() %}
{# Quick check to make sure `package_info.package_name` is not the package being generated so we don't circularly include this package in its own constraints file. #}
{% if api.naming.warehouse_package_name != package_info.package_name %}
Expand All @@ -55,7 +55,6 @@ dependencies = [
extras = {
{% if rest_async_io_enabled %}
"async_rest": [
"google-api-core[grpc] >= 2.21.0, < 3.0.0",
"google-auth[aiohttp] >= 2.35.0, <3.0.0"
],
{% endif %}
Expand Down
4 changes: 2 additions & 2 deletions packages/gapic-generator/gapic/templates/testing/constraints-3.10-async-rest.txt.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,11 @@
# pinning their versions to their lower bounds.
# For example, if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0",
# then this file should have google-cloud-foo==1.14.0
google-api-core==2.21.0
google-api-core==2.24.2
google-auth==2.35.0
grpcio==1.44.0
proto-plus==1.22.3
protobuf==4.25.8
protobuf==6.33.5
{% for package_tuple, package_info in pypi_packages.items() %}
{# Quick check to make sure `package_info.package_name` is not the package being generated so we don't circularly include this package in its own constraints file. #}
{% if api.naming.warehouse_package_name != package_info.package_name %}
Expand Down
4 changes: 2 additions & 2 deletions packages/gapic-generator/gapic/templates/testing/constraints-3.10.txt.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@
# pinning their versions to their lower bounds.
# For example, if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0",
# then this file should have google-cloud-foo==1.14.0
google-api-core==2.17.1
google-api-core==2.24.2
google-auth==2.14.1
grpcio==1.44.0
proto-plus==1.22.3
protobuf==4.25.8
protobuf==6.33.5
{% for package_tuple, package_info in pypi_packages.items() %}
{# Quick check to make sure `package_info.package_name` is not the package being generated so we don't circularly include this package in its own constraints file. #}
{% if api.naming.warehouse_package_name != package_info.package_name %}
Expand Down
2 changes: 1 addition & 1 deletion packages/gapic-generator/gapic/templates/testing/constraints-3.13.txt.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ google-api-core>=2
google-auth>=2
grpcio>=1
proto-plus>=1
protobuf>=6
protobuf>=7
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Setting the constraint to protobuf>=7 excludes the secure 6.33.5 version that this PR is introducing. It also forces a major version upgrade to 7.x, which may not be fully compatible or available. It should be set to protobuf>=6.33.5 to align with the minimum secure version specified in setup.py.

protobuf>=6.33.5

{% for package_tuple, package_info in pypi_packages.items() %}
{# Quick check to make sure `package_info.package_name` is not the package being generated so we don't circularly include this package in its own constraints file. #}
{% if api.naming.warehouse_package_name != package_info.package_name %}
Expand Down
2 changes: 1 addition & 1 deletion packages/gapic-generator/gapic/templates/testing/constraints-3.14.txt.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ google-api-core>=2
google-auth>=2
grpcio>=1
proto-plus>=1
protobuf>=6
protobuf>=7
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Setting the constraint to protobuf>=7 excludes the secure 6.33.5 version that this PR is introducing. It also forces a major version upgrade to 7.x, which may not be fully compatible or available. It should be set to protobuf>=6.33.5 to align with the minimum secure version specified in setup.py.

protobuf>=6.33.5

{% for package_tuple, package_info in pypi_packages.items() %}
{# Quick check to make sure `package_info.package_name` is not the package being generated so we don't circularly include this package in its own constraints file. #}
{% if api.naming.warehouse_package_name != package_info.package_name %}
Expand Down
2 changes: 1 addition & 1 deletion packages/gapic-generator/requirements.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ google-api-core
googleapis-common-protos
jinja2
MarkupSafe
protobuf>=4.25.8
protobuf>=6.33.5 # for CVE-2026-0994. See https://github.com/advisories/GHSA-7gcm-g887-7qv7 and https://protobuf.dev/support/version-support/#python
pypandoc
PyYAML
grpc-google-iam-v1
Expand Down
8 changes: 4 additions & 4 deletions packages/gapic-generator/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,14 +28,14 @@
# Ensure that the lower bounds of these dependencies match what we have in the
# templated setup.py.j2: https://github.com/googleapis/gapic-generator-python/blob/main/gapic/templates/setup.py.j2
"click >= 6.7",
"google-api-core[grpc] >= 1.34.1, <3.0.0,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*",
"googleapis-common-protos >= 1.55.0",
"grpcio >= 1.24.3",
"google-api-core[grpc] >= 2.24.2, < 3.0.0",
"googleapis-common-protos >= 1.55.0, < 2.0.0",
"grpcio >= 1.24.3, < 2.0.0",
# 2.11.0 is required which adds the `default` argument to `jinja-filters.map()`
# https://jinja.palletsprojects.com/en/3.0.x/templates/#jinja-filters.map
# https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-0
"jinja2 >= 2.11",
"protobuf >= 4.25.8, < 8.0.0",
"protobuf >= 6.33.5, < 8.0.0",
"pypandoc >= 1.4",
"PyYAML >= 5.1.1",
"grpc-google-iam-v1 >= 0.14.0, < 1.0.0",
Expand Down
Loading