What the developer wrote
Authored by Martin Milata
build: bump protobuf version
What changed, and why it matters
This commit simply updates the project's protobuf dependency from an old version (3.19) to a newer one (6.32) and pins the Python package version to match. There are no code changes, no bug fixes, and no security patches visible in the diff. It is a routine build/dependency maintenance change.
No security action required. Treat as normal dependency maintenance. If reviewing for supply-chain risk, verify the protobuf 6.31/6.32 release notes separately, but that is outside the scope of this commit diff.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies three build/dependency files: pyproject.toml pins the Python protobuf package to ==6.32, shell.nix switches the Nix protobuf tooling from oldNixpkgs.protobuf3_19 to protobuf_31, and uv.lock reflects the pinned version. The comments indicate a coordination requirement that the Nix protobuf version be <= the Python package version and the Python minor version be >= the Nix version. No source code, protocol definitions, or security-relevant logic is changed.
Changed components
pyproject.toml dependency declarationshell.nix development environmentuv.lock lockfileInspect captured patch +3 / −3
diff --git a/pyproject.toml b/pyproject.toml
index c9d9b90b..77818916 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,7 @@ dependencies = [
"trezor",
"tvl",
"scons",
- "protobuf",
+ "protobuf==6.32", # minor needs to be >= than version in shell.nix
"nanopb>=0.4.3,<0.5",
"pytest>=9.0.3,<10",
"coverage==5.5",
diff --git a/shell.nix b/shell.nix
index 218c207f..5250c715 100644
--- a/shell.nix
+++ b/shell.nix
@@ -105,7 +105,7 @@ stdenvNoCC.mkDerivation ({
pkg-config
poetry
ps
- oldNixpkgs.protobuf3_19
+ protobuf_31 # version needs to be <= than the one in pyproject.toml
pyright
python3
(mkBinOnlyWrapper rustNightly)
diff --git a/uv.lock b/uv.lock
index f142f43e..4d7c624e 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2249,7 +2249,7 @@ requires-dist = [
{ name = "nanopb", specifier = ">=0.4.3,<0.5" },
{ name = "noiseprotocol", specifier = ">=0.3.1,<0.4" },
{ name = "pillow", specifier = ">=11" },
- { name = "protobuf" },
+ { name = "protobuf", specifier = "==6.32" },
{ name = "pyasn1" },
{ name = "pyelftools", specifier = ">=0.32,<0.33" },
{ name = "pylint", specifier = "~=2.11" },
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.