chore(deps): bump protobuf from 6.32 to 6.33.5
What the developer wrote
Authored by dependabot[bot]
chore(deps): bump protobuf from 6.32 to 6.33.5
Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.32 to 6.33.5.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)
---
updated-dependencies:
- dependency-name: protobuf
dependency-version: 6.33.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated dependency update by Dependabot, bumping the pinned Python protobuf package from version 6.32 to 6.33.5. The change only edits two version pins in project configuration files and contains no code changes. There is no indication in the commit that this fixes or introduces a security issue.
No immediate security action is required. Review the upstream protobuf 6.33.5 release notes for any security fixes or breaking changes before merging, as is standard practice for dependency updates.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates the direct production dependency ‘protobuf’ from 6.32 to 6.33.5 in pyproject.toml and uv.lock. It is a patch-level/minor-level version bump generated by Dependabot with no functional code modifications. No security advisory, CVE, or vulnerability description is referenced in the commit message or diff.
Changed components
pyproject.tomluv.lockInspect captured patch +2 / −2
diff --git a/pyproject.toml b/pyproject.toml
index 3c0e3a20..30c10cd6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,7 +8,7 @@ dependencies = [
"trezor",
"tvl",
"scons",
- "protobuf==6.32", # minor needs to be >= than version in shell.nix
+ "protobuf==6.33.5", # minor needs to be >= than version in shell.nix
"nanopb>=0.4.3,<0.5",
"pytest>=9.0.3,<10",
"coverage==7.13.5",
diff --git a/uv.lock b/uv.lock
index b3667adf..bb2430b4 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2351,7 +2351,7 @@ requires-dist = [
{ name = "nanopb", specifier = ">=0.4.3,<0.5" },
{ name = "noiseprotocol", specifier = ">=0.3.1,<0.4" },
{ name = "pillow", specifier = ">=11" },
- { name = "protobuf", specifier = "==6.32" },
+ { name = "protobuf", specifier = "==6.33.5" },
{ name = "pyasn1" },
{ name = "pyelftools", specifier = ">=0.32,<0.33" },
{ name = "pylint", specifier = "~=2.11" },
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.