What the developer wrote
Authored by andreasgriffin
upgrade protobuf
What changed, and why it matters
This commit relaxes the version requirement for the 'protobuf' Python library in the project's dependency files. It changes the requirement from 'exactly 4.23.3 or compatible updates' to 'any version 4.23.3 or newer'. This is a routine dependency management change. There is no direct evidence in the commit that it fixes a specific security vulnerability, but keeping dependencies updated can help avoid known bugs or vulnerabilities in older versions.
Treat as routine dependency maintenance. Review the changelog for protobuf versions now permitted by the relaxed constraint to identify any security fixes included. If this change was made in response to a known vulnerability, obtain the advisory or CVE from the project maintainers before assigning higher risk.
Security signals we found
Dependency version constraint relaxed to allow newer protobuf versions
No source code changes or vulnerability-specific patch evidence
No CVE, advisory, or security-related references in commit or supplied materials
Evidence from the diff
The commit modifies pyproject.toml to change the protobuf dependency constraint from ‘^4.23.3’ (which allows 4.x but not 5.x) to ‘>=4.23.3’ (which allows any newer version including 5.x). The poetry.lock file is updated accordingly, with only the content-hash changing. No source code changes are present. The commit message simply says ‘upgrade protobuf’ with no further context.
Changed components
pyproject.toml dependency specificationpoetry.lock lockfileprotobuf Python library dependencyInspect captured patch +2 / −2
diff --git a/poetry.lock b/poetry.lock
index a11e72c..f7f47dc 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1311,4 +1311,4 @@ qt = ["pyside2"]
[metadata]
lock-version = "2.1"
python-versions = "^3.9,<3.13"
-content-hash = "278dc524a94cc0c503225e4a20f353bd09fa3deaab956e9d559c3795a304ad65"
+content-hash = "cfdbc60bf068f88587fe801325c19dfada1e868dbb0cdd65c5b7a7353dc0ca6a"
diff --git a/pyproject.toml b/pyproject.toml
index 034ae79..3137310 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -28,7 +28,7 @@ cbor2 = ">=5.4.6,<5.8"
pyserial = "^3.5"
semver = "^3.0.1"
noiseprotocol = "^0.3.1"
-protobuf = "^4.23.3"
+protobuf = ">=4.23.3"
[tool.poetry.extras]
qt = ["pyside2"]
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.