From 5045d5c9831a3a4a423a409ccea521d299a43a9a Mon Sep 17 00:00:00 2001 From: Seiji Eicher <58963096+eicherseiji@users.noreply.github.com> Date: Wed, 11 Feb 2026 02:25:04 -0800 Subject: [PATCH] Patch protobuf for CVE-2026-0994 (#34253) Signed-off-by: Seiji Eicher Co-authored-by: Kevin H. Luu --- requirements/build.txt | 2 +- requirements/common.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/build.txt b/requirements/build.txt index 994635309..6c6c9fc8a 100644 --- a/requirements/build.txt +++ b/requirements/build.txt @@ -9,5 +9,5 @@ wheel jinja2>=3.1.6 regex build -protobuf +protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33.2.*, !=6.33.3.*, !=6.33.4.* grpcio-tools==1.78.0 # Required for grpc entrypoints diff --git a/requirements/common.txt b/requirements/common.txt index f8402410b..297447cf2 100644 --- a/requirements/common.txt +++ b/requirements/common.txt @@ -9,7 +9,7 @@ blake3 py-cpuinfo transformers >= 4.56.0, < 5 tokenizers >= 0.21.1 # Required for fast incremental detokenization. -protobuf # Required by LlamaTokenizer, gRPC. +protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33.2.*, !=6.33.3.*, !=6.33.4.* # Required by LlamaTokenizer, gRPC. CVE-2026-0994 fastapi[standard] >= 0.115.0 # Required by FastAPI's form models in the OpenAI API server's audio transcriptions endpoint. aiohttp >= 3.13.3 openai >= 1.99.1 # For Responses API with reasoning content