Skip to content

fix: protobuf<6.32 for s390x builds to pass #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
Jun 16, 2026
+10 −7
Merged

fix: protobuf<6.32 for s390x builds to pass #133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a485a15
fix: protobuf<6.32 for s390x builds to pass
dryszka Jun 16, 2026
8c81c54
remove duplicate reqs
dryszka Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Dockerfile.konflux.pipelines-components
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ WORKDIR /app

USER root

ENV PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python

COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

Expand Down
5 changes: 3 additions & 2 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,9 @@ license = "Apache-2.0"
readme = "README.md"
requires-python = ">=3.11"
dependencies = [
"kfp>=2.16.1,<2.17",
"kfp-kubernetes>=2.16.1,<2.17",
"kfp>=2.16.1",
"kfp-kubernetes>=2.16.1",
"protobuf<6.32"
]

[project.optional-dependencies]
Expand Down
10 changes: 5 additions & 5 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,11 +52,11 @@ oauthlib==3.3.1 \
--hash=sha256:1bf73c8e0aead3761794f6e5b15228bee706cda020facd0df347c145843adf40
proto-plus==1.28.0 \
--hash=sha256:8d5189479a0eb3a1215aa9821c72bf4419b6d430718035d8dc548cbc85541288
protobuf==6.33.6 \
--hash=sha256:3aba0a6c9264e9f2e3e8cd3b3cdbbf0bbbea6dd62ec377342ce0f4f600f50a2a \
--hash=sha256:895b160b3a10eb8f3b6eabfed447d896c780ed00dcffa5f52d7bb24825bc1dff \
--hash=sha256:c6e1ea700f5e031c9669bd535a87f694f09b74e8b83885ab2759ae2bd2cbbd94 \
--hash=sha256:df80a6563854e01cd6672f462b18d7ffff7f23caca920a972a93ba14cd20af1e
protobuf==6.31.1 \
--hash=sha256:70d33f7dab888a6a41feb47d670fa1e70310e5142acb2e2284aa697932a78d44 \
--hash=sha256:de5ee2e1edaecb6ba391e9dc4f613072b3a655d82e3a20e70323c1ffb78b36dc \
--hash=sha256:ec92169112b71242b25b5a38b96e9536523783c675fbd2acbed1d599439ea674 \
--hash=sha256:f53a7d0fd79e44bb14cd95782cad2e0542a1915af35bfa09af9a86d12e465756
Comment on lines +55 to +59

@coderabbitai coderabbitai Bot Jun 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

For GHSA-7gcm-g887-7qv7 affecting python protobuf, what is the first patched version in the 6.x line, and does it remain compatible with kfp==2.16.1 / kfp-kubernetes==2.16.1?

💡 Result:

The first patched version of the python protobuf package in the 6.x line for vulnerability GHSA-7gcm-g887-7qv7 (also tracked as CVE-2026-0994) is 6.33.5 [1][2]. Regarding compatibility, kfp==2.16.1 and kfp-kubernetes==2.16.1 explicitly require protobuf to be in the range >=6.31.1 and <7.0 [3][4][5]. Since 6.33.5 falls within this defined constraint range (6.31.1 <= 6.33.5 < 7.0), it is compatible with kfp==2.16.1 and kfp-kubernetes==2.16.1 [3][4][5].

Citations:

🌐 Web query:

protobuf 6.33.5 SHA256 hashes PyPI package

💡 Result:

The SHA256 hashes for the protobuf 6.33.5 package on PyPI are documented in various dependency lockfiles [1][2][3]. The following hashes correspond to the distribution files for this version: Source distribution: - protobuf-6.33.5.tar.gz: 6ddcac2a081f8b7b9642c09406bc6a4290128fce5f471cddd165960bb9119e5c [2][3] Wheel distributions: - protobuf-6.33.5-py3-none-any.whl: 69915a973dd0f60f31a08b8318b73eab2bd6a392c79184b3612226b0a3f8ec02 [2][3] - protobuf-6.33.5-cp310-abi3-win32.whl: d71b040839446bac0f4d162e758bea99c8251161dae9d0983a3b88dee345153b [2][3] - protobuf-6.33.5-cp310-abi3-win_amd64.whl: 3093804752167bcab3998bec9f1048baae6e29505adaf1afd14a37bddede533c [2][3] - protobuf-6.33.5-cp39-abi3-macosx_10_9_universal2.whl: a5cb85982d95d906df1e2210e58f8e4f1e3cdc088e52c921a041f9c9a0386de5 [2][3] - protobuf-6.33.5-cp39-abi3-manylinux2014_aarch64.whl: 9b71e0281f36f179d00cbcb119cb19dec4d14a81393e5ea220f64b286173e190 [2][3] - protobuf-6.33.5-cp39-abi3-manylinux2014_s390x.whl: 8afa18e1d6d20af15b417e728e9f60f3aa108ee76f23c3b2c07a2c3b546d3afd [2][3] - protobuf-6.33.5-cp39-abi3-manylinux2014_x86_64.whl: cbf16ba3350fb7b889fca858fb215967792dc125b35c7976ca4818bee3521cf0 [2][3] - protobuf-6.33.5-cp39-cp39-win32.whl: a3157e62729aafb8df6da2c03aa5c0937c7266c626ce11a278b6eb7963c4e37c [2][3] - protobuf-6.33.5-cp39-cp39-win_amd64.whl: 8f04fa32763dcdb4973d537d6b54e615cc61108c7cb38fe59310c3192d29510a [2][3]

Citations:

🏁 Script executed:

#!/bin/bash
# Verify protobuf 6.33.5 hashes from official PyPI JSON API
curl -s "https://pypi.org/pypi/protobuf/6.33.5/json" | jq -r '.releases."6.33.5" | .[] | "\(.filename): \(.hashes.sha256)"' 2>/dev/null | head -20

Repository: opendatahub-io/pipelines-components

Length of output: 61

Upgrade protobuf to 6.33.5 to fix GHSA-7gcm-g887-7qv7 (CVE-2026-0994).

Line 55 pins protobuf==6.31.1, affected by JSON recursion-depth bypass (CWE-674). Upgrade to 6.33.5, which is compatible with kfp==2.16.1 and kfp-kubernetes==2.16.1 (constraints: >=6.31.1, <7.0).

Updated dependency with hashes 
-protobuf==6.31.1 \
-    --hash=sha256:70d33f7dab888a6a41feb47d670fa1e70310e5142acb2e2284aa697932a78d44 \
-    --hash=sha256:de5ee2e1edaecb6ba391e9dc4f613072b3a655d82e3a20e70323c1ffb78b36dc \
-    --hash=sha256:ec92169112b71242b25b5a38b96e9536523783c675fbd2acbed1d599439ea674 \
-    --hash=sha256:f53a7d0fd79e44bb14cd95782cad2e0542a1915af35bfa09af9a86d12e465756
+protobuf==6.33.5 \
+    --hash=sha256:69915a973dd0f60f31a08b8318b73eab2bd6a392c79184b3612226b0a3f8ec02 \
+    --hash=sha256:cbf16ba3350fb7b889fca858fb215967792dc125b35c7976ca4818bee3521cf0 \
+    --hash=sha256:8afa18e1d6d20af15b417e728e9f60f3aa108ee76f23c3b2c07a2c3b546d3afd \
+    --hash=sha256:9b71e0281f36f179d00cbcb119cb19dec4d14a81393e5ea220f64b286173e190

Regenerate hashes via pip install --require-hashes protobuf==6.33.5 or verify against official PyPI records.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
protobuf==6.31.1 \
--hash=sha256:70d33f7dab888a6a41feb47d670fa1e70310e5142acb2e2284aa697932a78d44 \
--hash=sha256:de5ee2e1edaecb6ba391e9dc4f613072b3a655d82e3a20e70323c1ffb78b36dc \
--hash=sha256:ec92169112b71242b25b5a38b96e9536523783c675fbd2acbed1d599439ea674 \
--hash=sha256:f53a7d0fd79e44bb14cd95782cad2e0542a1915af35bfa09af9a86d12e465756
protobuf==6.33.5 \
--hash=sha256:69915a973dd0f60f31a08b8318b73eab2bd6a392c79184b3612226b0a3f8ec02 \
--hash=sha256:cbf16ba3350fb7b889fca858fb215967792dc125b35c7976ca4818bee3521cf0 \
--hash=sha256:8afa18e1d6d20af15b417e728e9f60f3aa108ee76f23c3b2c07a2c3b546d3afd \
--hash=sha256:9b71e0281f36f179d00cbcb119cb19dec4d14a81393e5ea220f64b286173e190
🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 55-55: protobuf 6.31.1: protobuf affected by a JSON recursion depth bypass

(GHSA-7gcm-g887-7qv7)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@requirements.txt` around lines 55 - 59, Update the protobuf package pinning
in requirements.txt from version 6.31.1 to 6.33.5 to address the security
vulnerability GHSA-7gcm-g887-7qv7. Replace the current version number and all
four associated SHA256 hashes (the lines starting with --hash=sha256:) with the
updated hashes for protobuf 6.33.5. You can regenerate these hashes by running
pip install --require-hashes protobuf==6.33.5 or by verifying the official PyPI
records for version 6.33.5.

Sources: Coding guidelines, Linters/SAST tools

pyasn1==0.6.3 \
--hash=sha256:51194c7b4281edb039247c23e11f5280b4c9713ec246fda1fa9b5d960b860e51
pyasn1-modules==0.4.2 \
Expand Down
Loading