From 7c023baf589cb38dc7c3141d29919090ee530725 Mon Sep 17 00:00:00 2001 From: zaristei2 Date: Tue, 3 Feb 2026 00:03:14 -0800 Subject: [PATCH] Patch Protobuf for CVE 2026-0994 (#33619) Signed-off-by: Zachary Aristei Co-authored-by: Zachary Aristei --- requirements/build.txt | 2 +- requirements/common.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/build.txt b/requirements/build.txt index 0d3a24dd1..a239ed10a 100644 --- a/requirements/build.txt +++ b/requirements/build.txt @@ -9,5 +9,5 @@ wheel jinja2>=3.1.6 regex build -protobuf +protobuf >= 6.33.5 grpcio-tools diff --git a/requirements/common.txt b/requirements/common.txt index b4a56d6b1..4fe34456b 100644 --- a/requirements/common.txt +++ b/requirements/common.txt @@ -9,7 +9,7 @@ blake3 py-cpuinfo transformers >= 4.56.0, < 5 tokenizers >= 0.21.1 # Required for fast incremental detokenization. -protobuf # Required by LlamaTokenizer, gRPC. +protobuf >= 6.33.5 # Required by LlamaTokenizer, gRPC. CVE-2026-0994 fastapi[standard] >= 0.115.0 # Required by FastAPI's form models in the OpenAI API server's audio transcriptions endpoint. aiohttp >= 3.13.3 openai >= 1.99.1 # For Responses API with reasoning content