fix(deps): vuln protobuf (major → 7.35.1) [apps/rpc/python]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 1 package upgraded (MAJOR changes included)

Manifests changed:

• apps/rpc/python (pip)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
protobuf	4.25.8	7.35.1	major	Direct	3 HIGH

---

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

• Review the changelog/release notes for breaking changes
• Test thoroughly in a staging environment
• Update any code that depends on changed APIs
• Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (3 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
protobuf	PYSEC-2026-1805	high	protobuf affected by a JSON recursion depth bypass	4.25.8	5.29.6	-
protobuf	CVE-2026-0994	high	Denial of Service in Python Protobuf	4.25.8	-	-
protobuf	GHSA-7gcm-g887-7qv7	HIGH	protobuf affected by a JSON recursion depth bypass	4.25.8	6.33.5	-

---

Review Checklist

Extra review is recommended for this update:

• Review changes for compatibility with your code
• Check release notes for breaking changes
• Run integration tests to verify service behavior
• Test in staging environment before production
• Monitor key metrics after deployment
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e7325c55a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep protobuf compatible with grpcio-tools

grpcio-tools==1.59.0 declares protobuf>=4.21.6,<5.0dev, so pinning protobuf 7.35.1 creates an unsatisfiable dependency set. The pip install -r requirements.txt step in this example's Dockerfile will terminate with ResolutionImpossible, preventing both service images from building; upgrade grpcio-tools to a version supporting protobuf 7 or select a fixed protobuf release within its supported range.

Useful? React with 👍 / 👎.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 9ca9df9.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}