VULN UPGRADE: minor: protobuf · patch: requests [examples/grpc-bridge]

[campaigner-prod]

Summary: High-severity security update — 2 packages upgraded (MINOR changes included)

Manifests changed:

• examples/grpc-bridge (pip)

Updates

Package	From	To	Type	Vulnerabilities Fixed
protobuf	5.27.0	5.29.6	minor	3 HIGH
requests	2.32.3	2.32.5	patch	2 MODERATE

---

Security Details

🚨 Critical & High Severity (3 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
protobuf	GHSA-7gcm-g887-7qv7	HIGH	protobuf affected by a JSON recursion depth bypass	5.27.0	6.33.5
protobuf	GHSA-8qvm-5x2c-j2w7	HIGH	protobuf-python has a potential Denial of Service issue	5.27.0	4.25.8
protobuf	CVE-2025-4565	HIGH	-	5.27.0	-

ℹ️ Other Vulnerabilities (2)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
requests	GHSA-9hjg-9r4m-mvj7	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.32.3	2.32.4
requests	CVE-2024-47081	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.32.3	-

⚠️ Dependencies that have Reached EOL (1)

Dependency	Unsafe Version	EOL Date	New Version	Path
requests	2.32.3	-	2.32.5	examples/grpc-bridge/client/requirements.in

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI

---

Update Mode: Vulnerability Remediation (High)

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover]

This PR has been automatically approved by the DD PR Approver bot.

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-02-13 07:01:11 UTC ℹ️ Start processing command /merge

---

2026-02-13 07:01:15 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 0s (p90).

---

2026-02-13 09:00:56 UTC ℹ️ MergeQueue: Readding this merge request to the queue because another merge request processed with yours failed. No action is needed from your side.

---

2026-02-13 11:01:13 UTC ℹ️ MergeQueue: Readding this merge request to the queue because another merge request processed with yours failed. No action is needed from your side.

---

2026-02-13 13:01:28 UTC ❌ MergeQueue: The build pipeline has timeout

The merge request has been interrupted because the build 0 took longer than expected. The current limit for the base branch 'master' is 120 minutes.