From 90b07943bb0b9358806628a10cc360e367e5fded Mon Sep 17 00:00:00 2001 From: Vishal Bala Date: Thu, 10 Sep 2026 13:25:49 +0200 Subject: [PATCH 1/2] deps: drop the protobuf upper bound `protobuf>=5.28.0,<6.0.0` was declared in the `vertexai` extra and copied into `all`, with no comment explaining either bound. It was tighter than the dependency it existed to serve: google-cloud-aiplatform accepts `protobuf>=3.20.2,<7.0.0` on both its current 1.x and 2.x lines, so RedisVL was excluding two major lines the vendor is happy with. RedisVL itself imports no protobuf symbol -- `grep -rn 'protobuf' redisvl/` returns nothing -- so there was no API surface here to protect. The only effect was to constrain resolution for every `redisvl[all]` and `redisvl[vertexai]` user, which conflicts with current grpcio, opentelemetry and google-genai stacks. Keep the floor and let google-cloud-aiplatform express its own ceiling, which is the constraint that tracks reality without needing maintenance here. Resolution is unchanged today: protobuf still locks at 5.29.6, because google-cloud-aiplatform's own bound is what selects it. The lockfile diff is the two `requires-dist` specifiers and nothing else. Relocked with uv 0.12.3 to match UV_VERSION in the workflows; a different uv version rewrites unrelated environment markers throughout the file. --- pyproject.toml | 10 ++++++++-- uv.lock | 4 ++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 3c6fb88e..2c59632a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -65,7 +65,13 @@ langcache = ["langcache>=0.11.0"] # importing. New text embeddings should use the `google-genai` extra below. vertexai = [ "google-cloud-aiplatform>=1.26,<2.0.0", - "protobuf>=5.28.0,<6.0.0", + # Deliberately uncapped. RedisVL imports no protobuf symbol anywhere, so it + # has no API surface to protect; google-cloud-aiplatform declares its own + # bound and is the package that actually needs one. Pinning it here only + # narrowed resolution for downstream users, and did so more tightly than the + # vendor asks. Leave the floor, which predates this note, and let the + # dependency that uses protobuf express its own ceiling. + "protobuf>=5.28.0", ] # Modern Google backend (Vertex AI + Gemini Developer API) for GoogleGenAIVectorizer. google-genai = ["google-genai>=1.0.0"] @@ -87,7 +93,7 @@ all = [ "sentence-transformers>=5.2.0,<6", "langcache>=0.11.0", "google-cloud-aiplatform>=1.26,<2.0.0", - "protobuf>=5.28.0,<6.0.0", + "protobuf>=5.28.0", "google-genai>=1.0.0", "boto3>=1.36.0,<2", "urllib3<2.8.0", diff --git a/uv.lock b/uv.lock index fee99270..2c013a33 100644 --- a/uv.lock +++ b/uv.lock @@ -4975,8 +4975,8 @@ requires-dist = [ { name = "openai", marker = "extra == 'openai'", specifier = ">=1.1.0" }, { name = "pillow", marker = "extra == 'all'", specifier = ">=11.3.0" }, { name = "pillow", marker = "extra == 'pillow'", specifier = ">=11.3.0" }, - { name = "protobuf", marker = "extra == 'all'", specifier = ">=5.28.0,<6.0.0" }, - { name = "protobuf", marker = "extra == 'vertexai'", specifier = ">=5.28.0,<6.0.0" }, + { name = "protobuf", marker = "extra == 'all'", specifier = ">=5.28.0" }, + { name = "protobuf", marker = "extra == 'vertexai'", specifier = ">=5.28.0" }, { name = "pydantic", specifier = ">=2,<3" }, { name = "pydantic-settings", marker = "extra == 'mcp'", specifier = ">=2.0,<3" }, { name = "python-ulid", specifier = ">=3.0.0" }, From 30c668204eed2f0cae3e2dc9242919cc3bd91bb0 Mon Sep 17 00:00:00 2001 From: Vishal Bala Date: Thu, 10 Sep 2026 13:51:03 +0200 Subject: [PATCH 2/2] deps: trim the protobuf comment to one fact --- pyproject.toml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 2c59632a..3f576949 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -65,12 +65,8 @@ langcache = ["langcache>=0.11.0"] # importing. New text embeddings should use the `google-genai` extra below. vertexai = [ "google-cloud-aiplatform>=1.26,<2.0.0", - # Deliberately uncapped. RedisVL imports no protobuf symbol anywhere, so it - # has no API surface to protect; google-cloud-aiplatform declares its own - # bound and is the package that actually needs one. Pinning it here only - # narrowed resolution for downstream users, and did so more tightly than the - # vendor asks. Leave the floor, which predates this note, and let the - # dependency that uses protobuf express its own ceiling. + # Uncapped on purpose: nothing here imports protobuf, so the bound belongs + # to google-cloud-aiplatform, which declares its own. "protobuf>=5.28.0", ] # Modern Google backend (Vertex AI + Gemini Developer API) for GoogleGenAIVectorizer.