Bump protobuf to 6.31.1+ to address CVE-2025-4565

[jhamon]

Summary

Bumps protobuf dependency from >=5.29.5,<6.0.0 to >=6.31.1,<7.0.0 to address CVE-2025-4565.

CVE Details: The vulnerability affects protobuf's Pure-Python backend when parsing untrusted Protocol Buffers data containing deeply nested recursive groups, recursive messages, or a series of SGROUP tags. This can cause a RecursionError leading to denial of service.

Risk Area: Our _struct_to_dict function in pinecone/grpc/utils.py handles recursive protobuf Structs for metadata parsing, making it vulnerable to this attack vector.

Changes

• Updated protobuf constraint in pyproject.toml from >=5.29.5,<6.0.0 to >=6.31.1,<7.0.0
• Added regression tests in tests/unit_grpc/test_deeply_nested_metadata.py to prevent future issues
  • Test deeply nested dictionaries (50 levels)
  • Test deeply nested lists
  • Test mixed nested structures
• Fixed ruff target-version configuration issue discovered during validation
• Removed unused import in scripts/count_tokens.py

Testing

All validation tests passed successfully:

• ✅ gRPC Unit Tests: All 227 tests passed
• ✅ Regression Tests: All 3 new CVE tests passed (no RecursionError)
• ✅ Performance Tests: All 29 benchmarks passed with no performance degradation
• ✅ Type Checking: mypy validation passed on all 191 source files
• ✅ Linting: ruff checks passed
• ✅ Full Unit Suite: All 418 tests passed (4 skipped)

References

• CVE-2025-4565 Details
• Protobuf Fix Commit

---

Note

Medium Risk
Dependency upgrade to protobuf v6 plus regenerated gRPC stubs may introduce subtle runtime/type-annotation incompatibilities in protobuf/gRPC handling; new tests reduce risk but don’t fully cover all message parsing paths.

Overview
Updates the gRPC dependency set to address CVE-2025-4565 by bumping protobuf to >=6.33.0,<7.0.0 (and googleapis-common-protos to >=1.72.0), and aligning CI dependency-matrix runs and buf codegen plugins to the newer protobuf toolchain.

Regenerates checked-in protobuf stubs (db_data_2025_10_pb2.py/.pyi) for the new protobuf runtime and adds unit regression tests covering deeply nested dict/list metadata roundtrips via dict_to_proto_struct and _struct_to_dict to prevent RecursionError/DoS regressions. Also fixes Ruff config by setting target-version to py310 and updates the lockfile accordingly.

^{Written by Cursor Bugbot for commit 083cae2. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Test masks silent data loss in nested lists

Medium Severity

The test_nested_lists_in_metadata test passes despite _struct_to_dict silently corrupting the data. The input {"list": [[[[{"key": "value"}]]]]} round-trips to {"list": [[]]} because the nested-list handler in _struct_to_dict only supports primitive types (number_value, string_value, bool_value) and silently drops list_value, struct_value, and null_value items. The assertion assert result is not None doesn't verify data integrity, giving a false sense that nested lists are correctly handled. Unlike test_mixed_nested_structures, which validates actual values, this test needs a data-integrity assertion to be a meaningful regression test.

 

[jhamon]

CI Status Update

All gRPC dependency tests are now passing! ✅

Fixed Issues:

1. Updated googleapis-common-protos from 1.66.0 to 1.72.0 (1.66.0 had protobuf<6.0.0 constraint)
2. Updated minimum protobuf version from 6.31.1 to 6.33.0 to match the generated code version
3. Updated all dependency test matrices to use protobuf 6.33.0

Test Results:

• ✅ All 17 gRPC dependency tests passing
• ✅ All gRPC unit tests passing (py3.10, 3.11, 3.12, 3.13)
• ✅ All REST dependency tests passing
• ✅ All unit tests passing
• ✅ Type checking and linting passing

Note on Integration Test Failures:
The 2 integration test failures (rest 3.10 shard 6/10 and grpc 3.10) appear to be flaky tests related to data consistency/timing, not the protobuf upgrade. Both show assertion failures on find_by_id queries where expected vectors are not returned, which is a known eventual consistency issue in integration tests.