-
Notifications
You must be signed in to change notification settings - Fork 104
Description
What motivated you to submit this feature request?
protobuf version pinned is on 5.x branch. Protobuf < 6.31.1 has a HIGH CVE: https://www.cve.org/CVERecord?id=CVE-2025-4565. Moreover, this causes irresolvable dependency conflicts with other projects, requiring a modern version of the protobuf.
Describe the solution you'd like
protobuf as dependency soft-pinned to support at least 6.x branch, in addition to currently supported 5.x.
Describe alternatives you've considered
There are no alternatives. This is a maintenance issue. Sticking to old Pinecone client (5.x) is not really an option.
Additional context
This is actually a maintenance request. GRPC is recommended when using Pinecone at scale. In the code, with grpc
option, protobuf is soft-pinned to support 5.x branch only: https://github.com/pinecone-io/pinecone-python-client/blob/main/pyproject.toml#L115