fix(deps): vuln protobuf (major → 7.35.1) [apps/rest-services/py]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 1 package upgraded (MAJOR changes included)

Manifests changed:

• apps/rest-services/py (pip)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
protobuf	4.24.4	7.35.1	major	Direct	6 HIGH

---

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

• Review the changelog/release notes for breaking changes
• Test thoroughly in a staging environment
• Update any code that depends on changed APIs
• Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (6 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
protobuf	GHSA-8qvm-5x2c-j2w7	HIGH	protobuf-python has a potential Denial of Service issue	4.24.4	4.25.8	-
protobuf	CVE-2025-4565	HIGH	Unbounded recursion in Python Protobuf	4.24.4	-	-
protobuf	PYSEC-2026-1806	HIGH	protobuf-python has a potential Denial of Service issue	4.24.4	4.25.8	-
protobuf	PYSEC-2026-1805	high	protobuf affected by a JSON recursion depth bypass	4.24.4	5.29.6	-
protobuf	CVE-2026-0994	high	Denial of Service in Python Protobuf	4.24.4	-	-
protobuf	GHSA-7gcm-g887-7qv7	HIGH	protobuf affected by a JSON recursion depth bypass	4.24.4	6.33.5	-

⚠️ Dependencies that have Reached EOL (1)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
protobuf	4.24.4	Oct 4, 2025	7.35.1	apps/rest-services/py/requirements.txt	-

---

Review Checklist

Extra review is recommended for this update:

• Review changes for compatibility with your code
• Check release notes for breaking changes
• Run integration tests to verify service behavior
• Test in staging environment before production
• Monitor key metrics after deployment
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2c313c106e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep protobuf within OpenTelemetry's supported range

In this requirements file, opentelemetry-proto==1.20.0 is still pinned and that package declares protobuf<5.0,>=3.19, so pinning protobuf==7.35.1 makes fresh installs of apps/rest-services/py/requirements.txt unsatisfiable with pip's resolver. Any setup following this sample's README will fail before the app can run; either use a patched <5 protobuf release or upgrade the OpenTelemetry packages together.

Useful? React with 👍 / 👎.