This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar.git
The following commit(s) were added to refs/heads/master by this push:
new 163b900ccea [fix][sec] Upgrade Python protobuf version to 6.33.5 to
address CVE-2026-0994 (#25250)
163b900ccea is described below
commit 163b900cceab4c7ac0a1a4f91087387689d6dc17
Author: Lari Hotari <[email protected]>
AuthorDate: Tue Feb 17 15:46:10 2026 +0200
[fix][sec] Upgrade Python protobuf version to 6.33.5 to address
CVE-2026-0994 (#25250)
---
bin/proto/MLDataFormats_pb2.py | 2 +-
docker/pulsar/Dockerfile | 4 ++--
docker/pulsar/Dockerfile.wolfi | 4 ++--
pulsar-functions/instance/src/main/python/Function_pb2.py | 2 +-
.../instance/src/main/python/InstanceCommunication_pb2.py | 2 +-
.../instance/src/main/python/InstanceCommunication_pb2_grpc.py | 2 +-
src/update_python_protobuf_stubs.sh | 2 +-
7 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/bin/proto/MLDataFormats_pb2.py b/bin/proto/MLDataFormats_pb2.py
index 90421b3a1f3..6092eb3a57a 100644
--- a/bin/proto/MLDataFormats_pb2.py
+++ b/bin/proto/MLDataFormats_pb2.py
@@ -2,7 +2,7 @@
# Generated by the protocol buffer compiler. DO NOT EDIT!
# NO CHECKED-IN PROTOBUF GENCODE
# source: MLDataFormats.proto
-# Protobuf Python Version: 6.31.0
+# Protobuf Python Version: 6.31.1
"""Generated protocol buffer code."""
from google.protobuf import descriptor as _descriptor
from google.protobuf import descriptor_pool as _descriptor_pool
diff --git a/docker/pulsar/Dockerfile b/docker/pulsar/Dockerfile
index 6494168f38e..9a9738d2212 100644
--- a/docker/pulsar/Dockerfile
+++ b/docker/pulsar/Dockerfile
@@ -111,8 +111,8 @@ RUN apk upgrade --no-cache
ARG PULSAR_CLIENT_PYTHON_VERSION
RUN pip3 install --break-system-packages --no-cache-dir \
--only-binary \
- grpcio==1.73.1 \
- protobuf==6.31.1 \
+ grpcio==1.78.0 \
+ protobuf==6.33.5 \
pulsar-client[all]==${PULSAR_CLIENT_PYTHON_VERSION} \
kazoo
diff --git a/docker/pulsar/Dockerfile.wolfi b/docker/pulsar/Dockerfile.wolfi
index 16e1e33cc43..300c468b55e 100644
--- a/docker/pulsar/Dockerfile.wolfi
+++ b/docker/pulsar/Dockerfile.wolfi
@@ -97,8 +97,8 @@ RUN apk add --no-cache \
ARG PULSAR_CLIENT_PYTHON_VERSION
RUN pip3 install --break-system-packages --no-cache-dir \
--only-binary \
- grpcio==1.73.1 \
- protobuf==6.31.1 \
+ grpcio==1.78.0 \
+ protobuf==6.33.5 \
pulsar-client[all]==${PULSAR_CLIENT_PYTHON_VERSION} \
kazoo \
pyyaml
diff --git a/pulsar-functions/instance/src/main/python/Function_pb2.py
b/pulsar-functions/instance/src/main/python/Function_pb2.py
index c2e0122b692..2b1c7c5daf8 100644
--- a/pulsar-functions/instance/src/main/python/Function_pb2.py
+++ b/pulsar-functions/instance/src/main/python/Function_pb2.py
@@ -2,7 +2,7 @@
# Generated by the protocol buffer compiler. DO NOT EDIT!
# NO CHECKED-IN PROTOBUF GENCODE
# source: Function.proto
-# Protobuf Python Version: 6.31.0
+# Protobuf Python Version: 6.31.1
"""Generated protocol buffer code."""
from google.protobuf import descriptor as _descriptor
from google.protobuf import descriptor_pool as _descriptor_pool
diff --git
a/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2.py
b/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2.py
index e967a2e5ab4..29e5c02de06 100644
--- a/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2.py
+++ b/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2.py
@@ -2,7 +2,7 @@
# Generated by the protocol buffer compiler. DO NOT EDIT!
# NO CHECKED-IN PROTOBUF GENCODE
# source: InstanceCommunication.proto
-# Protobuf Python Version: 6.31.0
+# Protobuf Python Version: 6.31.1
"""Generated protocol buffer code."""
from google.protobuf import descriptor as _descriptor
from google.protobuf import descriptor_pool as _descriptor_pool
diff --git
a/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2_grpc.py
b/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2_grpc.py
index b6135f36e8b..942fc7d447e 100644
---
a/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2_grpc.py
+++
b/pulsar-functions/instance/src/main/python/InstanceCommunication_pb2_grpc.py
@@ -6,7 +6,7 @@ import warnings
import InstanceCommunication_pb2 as InstanceCommunication__pb2
from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
-GRPC_GENERATED_VERSION = '1.73.1'
+GRPC_GENERATED_VERSION = '1.78.0'
GRPC_VERSION = grpc.__version__
diff --git a/src/update_python_protobuf_stubs.sh
b/src/update_python_protobuf_stubs.sh
index 45190c2cd2f..d60e6d5e72f 100755
--- a/src/update_python_protobuf_stubs.sh
+++ b/src/update_python_protobuf_stubs.sh
@@ -20,7 +20,7 @@
# This script generates Python gRPC and Protobuf stubs from the .proto files
# Set the version of PYTHON_GRPCIO_VERSION to the version which matches the
version of grpcio in the Dockerfile
-PYTHON_GRPCIO_VERSION=${PYTHON_GRPCIO_VERSION:-"1.73.1"}
+PYTHON_GRPCIO_VERSION=${PYTHON_GRPCIO_VERSION:-"1.78.0"}
set -euo pipefail
