Bump protobuf from 4.25.8 to 7.34.0rc1 in /dockerfiles/test-system by dependabot[bot] · Pull Request #59 · proteantecs/mlrun

dependabot · 2026-01-23T18:34:03Z

User description

Bumps protobuf from 4.25.8 to 7.34.0rc1.

Release notes

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

PR Type

Dependencies, Enhancement

Description

Upgrade protobuf to 7.34.0rc1
Update locked hashes for new version
Apply change for Python 3.11+ environment

Diagram Walkthrough

flowchart LR
  lockfile["locked-requirements.txt"]
  protobuf4258["protobuf 4.25.8 (pinned)"]
  protobuf734rc1["protobuf 7.34.0rc1 (pinned)"]
  hashes["Update package hashes"]

  lockfile -- "replace entry" --> protobuf734rc1
  protobuf4258 -- "remove" --> lockfile
  protobuf734rc1 -- "requires" --> hashes

File Walkthrough

Relevant files

Dependencies

locked-requirements.txt `Update protobuf pin and hashes` dockerfiles/test-system/locked-requirements.txt Replace `protobuf==4.25.8` with `7.34.0rc1`. Update associated `sha256` hashes. Keep conditional: only for Python >= 3.11.	+9/-12

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 4.25.8 to 7.34.0rc1. - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) --- updated-dependencies: - dependency-name: protobuf dependency-version: 7.34.0rc1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

pull-request-agent · 2026-01-23T18:34:33Z

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Pre-release Version The dependency is bumped to a release candidate (`protobuf==7.34.0rc1`). Confirm that downstream packages (e.g., `google-api-core`, TensorBoard, TensorFlow) are compatible with this RC and that your policy allows pinning to pre-release versions in locked requirements. protobuf==7.34.0rc1 ; python_full_version >= '3.11' \ --hash=sha256:063194f132c92892dd271e9e77fc9651c84c56a486bb6e7657b99dde8462d3a5 \ --hash=sha256:2250a68501df3e9381710e199771523056d442a1df1edeb3829d29e970224f68 \ --hash=sha256:2af017361d9ff1b52a4fe933fccf36bd5e453e3ef855dc66426ea03a006ad426 \ --hash=sha256:5ceac3c2c428bfa5752b28082849fd9003db613b6c90305ec14bad6036a2d717 \ --hash=sha256:74386406345f4d869da4a7906605a04295c1c904787992fb686ac321c9def6c3 \ --hash=sha256:7b42643d5ce4a9133084eec057d781e5e966b52bab68b9fdc6d7226384be931a \ --hash=sha256:8c3c66f15e1035919bd105293d18c694986a7496ca105a1035a455da7b7958d2 \ --hash=sha256:d88119bf98ae532c2e92168471ddf2fdb3f3d3e58bf236be0c2af375d2b1b4d1 Hash Integrity Verify the provided hashes match all expected wheels for your supported platforms and Python versions; RCs sometimes have limited artifact sets which can break cross-platform builds. --hash=sha256:063194f132c92892dd271e9e77fc9651c84c56a486bb6e7657b99dde8462d3a5 \ --hash=sha256:2250a68501df3e9381710e199771523056d442a1df1edeb3829d29e970224f68 \ --hash=sha256:2af017361d9ff1b52a4fe933fccf36bd5e453e3ef855dc66426ea03a006ad426 \ --hash=sha256:5ceac3c2c428bfa5752b28082849fd9003db613b6c90305ec14bad6036a2d717 \ --hash=sha256:74386406345f4d869da4a7906605a04295c1c904787992fb686ac321c9def6c3 \ --hash=sha256:7b42643d5ce4a9133084eec057d781e5e966b52bab68b9fdc6d7226384be931a \ --hash=sha256:8c3c66f15e1035919bd105293d18c694986a7496ca105a1035a455da7b7958d2 \ --hash=sha256:d88119bf98ae532c2e92168471ddf2fdb3f3d3e58bf236be0c2af375d2b1b4d1

pull-request-agent · 2026-01-23T18:34:52Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category Suggestion Impact

Possible issue

Avoid release candidate pin

Avoid pinning to a release candidate in a locked production-like requirements file,
as RCs can be yanked and introduce instability. Pin to the latest stable protobuf
release that matches your compatibility requirements to prevent breakages in
reproducible builds.

dockerfiles/test-system/locked-requirements.txt [3697-3705]

-protobuf==7.34.0rc1 ; python_full_version >= '3.11' \
-    --hash=sha256:063194f132c92892dd271e9e77fc9651c84c56a486bb6e7657b99dde8462d3a5 \
-    --hash=sha256:2250a68501df3e9381710e199771523056d442a1df1edeb3829d29e970224f68 \
-    --hash=sha256:2af017361d9ff1b52a4fe933fccf36bd5e453e3ef855dc66426ea03a006ad426 \
-    --hash=sha256:5ceac3c2c428bfa5752b28082849fd9003db613b6c90305ec14bad6036a2d717 \
-    --hash=sha256:74386406345f4d869da4a7906605a04295c1c904787992fb686ac321c9def6c3 \
-    --hash=sha256:7b42643d5ce4a9133084eec057d781e5e966b52bab68b9fdc6d7226384be931a \
-    --hash=sha256:8c3c66f15e1035919bd105293d18c694986a7496ca105a1035a455da7b7958d2 \
-    --hash=sha256:d88119bf98ae532c2e92168471ddf2fdb3f3d3e58bf236be0c2af375d2b1b4d1
+protobuf==4.25.8 ; python_full_version >= '3.11' \
+    --hash=sha256:077ff8badf2acf8bc474406706ad890466274191a48d0abd3bd6987107c9cde5 \
+    --hash=sha256:15a0af558aa3b13efef102ae6e4f3efac06f1eea11afb3a57db2901447d9fb59 \
+    --hash=sha256:27d498ffd1f21fb81d987a041c32d07857d1d107909f5134ba3350e1ce80a4af \
+    --hash=sha256:504435d831565f7cfac9f0714440028907f1975e4bed228e58e72ecfff58a1e0 \
+    --hash=sha256:6135cf8affe1fc6f76cced2641e4ea8d3e59518d1f24ae41ba97bcad82d397cd \
+    --hash=sha256:83e6e54e93d2b696a92cad6e6efc924f3850f82b52e1563778dfab8b355101b0 \
+    --hash=sha256:9ad7ef62d92baf5a8654fbb88dac7fa5594cfa70fd3440488a5ca3bfc6d795a7 \
+    --hash=sha256:bd551eb1fe1d7e92c1af1d75bdfa572eff1ab0e5bf1736716814cdccdb2360f9 \
+    --hash=sha256:ca809b42f4444f144f2115c4c1a747b9a404d590f18f37e9402422033e464e0f \
+    --hash=sha256:d552c53d0415449c8d17ced5c341caba0d89dbf433698e1436c8fa0aae7808a3 \
+    --hash=sha256:f4510b93a3bec6eba8fd8f1093e9d7fb0d4a24d1a81377c10c0e5bbfe9e4ed24

Suggestion importance[1-10]: 7

__

Why: Recommending against pinning to an RC in a locked requirements file is sensible for stability, and the existing_code correctly matches the new hunk lines. However, reverting to 4.25.8 may conflict with the PR's intent to move to a newer protobuf and could break compatibility, reducing certainty of impact.

Medium

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jan 23, 2026

github-actions bot added the PR title format label Jan 23, 2026

pull-request-agent bot added the Review effort 1/5 label Jan 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump protobuf from 4.25.8 to 7.34.0rc1 in /dockerfiles/test-system#59

Bump protobuf from 4.25.8 to 7.34.0rc1 in /dockerfiles/test-system#59
dependabot[bot] wants to merge 1 commit intodevelopmentfrom
dependabot/pip/dockerfiles/test-system/protobuf-7.34.0rc1

dependabot bot commented on behalf of github Jan 23, 2026 •

edited by pull-request-agent bot

Loading

Uh oh!

pull-request-agent bot commented Jan 23, 2026

Uh oh!

pull-request-agent bot commented Jan 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Jan 23, 2026 • edited by pull-request-agent bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

PR Type

Description

Diagram Walkthrough

File Walkthrough

Uh oh!

pull-request-agent bot commented Jan 23, 2026

PR Reviewer Guide 🔍

Uh oh!

pull-request-agent bot commented Jan 23, 2026

PR Code Suggestions ✨

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jan 23, 2026 •

edited by pull-request-agent bot

Loading