Request to update protobuf dependency (>=4.25.8) – PR #2391 inactive

[FrancoCV]

Hi👋,

I'm working on a production app that requires protobuf >= 4.25.8, but the current version of tf2onnx requires <4.0, which causes dependency conflicts:

Because tf2onnx (1.16.1) depends on protobuf (>=3.20,<4.0) and our app requires protobuf (>=4.25.8), version solving fails.

I noticed that PR #2391 attempts to update this but has been inactive for over 3 months and the CI logs have expired.

Would you be open to reviewing that PR and reviving it?

Thanks so much!

[vanfalen]

Same thing here. It seems that protobuf <=4.25.8 has been flagged for this CVE with high severity: https://github.com/advisories/GHSA-8qvm-5x2c-j2w7

[strentom]

@FrancoCV hello, is there any update?

[tlippold-meta]

Any updates?