chore(deps): update dependency google-cloud-aiplatform to v1.133.0 [security] - autoclosed#14168
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates the google-cloud-aiplatform dependency to version 1.133.0 across various requirements.txt files. The reviewer identified several critical dependency conflicts where the new AI Platform version (requiring protobuf 5.x) is incompatible with the existing versions of tensorflow (2.12.x) and apache-beam (2.55.1) used in the people-and-planet-ai projects. Upgrading these libraries to versions compatible with protobuf 5.x is necessary to prevent installation failures. Additionally, a missing newline was flagged in the generative_ai/function_calling/requirements.txt file.
| earthengine-api==1.5.9 | ||
| folium==0.19.5 | ||
| google-cloud-aiplatform==1.47.0 | ||
| google-cloud-aiplatform==1.133.0 |
There was a problem hiding this comment.
Updating google-cloud-aiplatform to 1.133.0 introduces a protobuf version conflict with tensorflow==2.12.0. TensorFlow 2.12 requires protobuf < 4.22, while AI Platform 1.133.0 (which uses protobuf 5.x as seen in other parts of this PR) requires a much newer version. This conflict will cause installation failures. TensorFlow should be updated to a version compatible with protobuf 5.x (such as 2.16 or later) to resolve this.
| pillow==10.3.0 | ||
| apache-beam[gcp]==2.55.1 | ||
| google-cloud-aiplatform==1.47.0 | ||
| google-cloud-aiplatform==1.133.0 |
There was a problem hiding this comment.
Updating google-cloud-aiplatform to 1.133.0 introduces a protobuf version conflict with apache-beam[gcp]==2.55.1. Apache Beam 2.55.1 requires protobuf < 4.26, which is incompatible with the protobuf 5.x requirement of AI Platform 1.133.0. This will lead to environment installation errors. An update to a newer version of Apache Beam that supports protobuf 5.x is required.
| earthengine-api==1.5.9 | ||
| folium==0.19.5 | ||
| google-cloud-aiplatform==1.47.0 | ||
| google-cloud-aiplatform==1.133.0 |
There was a problem hiding this comment.
Updating google-cloud-aiplatform to 1.133.0 introduces a protobuf version conflict with tensorflow==2.12.0. TensorFlow 2.12 requires protobuf < 4.22, while AI Platform 1.133.0 (which uses protobuf 5.x as seen in other parts of this PR) requires a much newer version. This conflict will cause installation failures. TensorFlow should be updated to a version compatible with protobuf 5.x (such as 2.16 or later) to resolve this.
| Flask==3.0.3 | ||
| apache-beam[gcp]==2.46.0 | ||
| google-cloud-aiplatform==1.47.0 | ||
| google-cloud-aiplatform==1.133.0 |
There was a problem hiding this comment.
Updating google-cloud-aiplatform to 1.133.0 introduces a protobuf version conflict with tensorflow==2.12.1. TensorFlow 2.12.1 requires protobuf < 4.22, while AI Platform 1.133.0 (which uses protobuf 5.x as seen in other parts of this PR) requires a much newer version. This conflict will cause installation failures. TensorFlow should be updated to a version compatible with protobuf 5.x (such as 2.16 or later) to resolve this.
| google-auth==2.38.0 | ||
| openai==1.68.2 | ||
| google-cloud-aiplatform==1.86.0 No newline at end of file | ||
| google-cloud-aiplatform==1.133.0 No newline at end of file |
This PR contains the following updates:
==1.47.0→==1.133.0==1.103.0→==1.133.0==1.69.0→==1.133.0==1.87.0→==1.133.0==1.82.0→==1.133.0==1.74.0→==1.133.0==1.86.0→==1.133.0==1.84.0→==1.133.0==1.64.0→==1.133.0==1.57.0→==1.133.0==1.62.0→==1.133.0Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming
CVE-2026-2473 / GHSA-wh2j-26j7-9728
More information
Details
Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google Cloud Platform allows an unauthenticated remote attacker to achieve cross-tenant remote code execution, model theft, and poisoning via pre-creating predictably named Cloud Storage buckets (Bucket Squatting).
This vulnerability was patched and no customer action is needed.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:ClearReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
googleapis/python-aiplatform (google-cloud-aiplatform)
v1.133.0Compare Source
Features
optimize_promptmethod (715cc5b)Bug Fixes
examples_dataframetype toPandasDataFramein Prompt Optimizer. (a2564cc)v1.132.0Compare Source
Features
Documentation
restart_job_on_worker_restartin message.google.cloud.aiplatform.v1beta1.Schedulingis changed (71747e8)timeoutin message.google.cloud.aiplatform.v1beta1.Schedulingis changed (71747e8)v1.131.0Compare Source
Features
Bug Fixes
v1.130.0Compare Source
Features
min_gpu_driver_versionis added to message.google.cloud.aiplatform.v1beta1.MachineSpec(26dfdfe)Documentation
ReplicatedVoiceConfig.mime_typecomment (26dfdfe)ReplicatedVoiceConfig.mime_typecomment (26dfdfe)v1.129.0Compare Source
⚠ BREAKING CHANGES
transfer_to_agentis removed from message.google.cloud.aiplatform.v1beta1.EventActionsbigtable_metadatafield name inFeatureOnlineStoreenableDirectBigtableAccessfield name in FeatureOnlineStore`bigtable_metadatafield name inFeatureViewFeatures
gpu_partition_sizeinmachine_specv1 api (e0bc3d8)ReplicatedVoiceConfigtoVoiceConfigto enable Gemini TTS voice replication (e0bc3d8)ReplicatedVoiceConfigtoVoiceConfigto enable Gemini TTS voice replication (e0bc3d8)SUCCESSFULLY_DEPLOYEDandFAILED_TO_DEPLOYtoDeploymentStage(e0bc3d8)SUCCESSFULLY_DEPLOYEDandFAILED_TO_DEPLOYtoDeploymentStage(e0bc3d8)Bug Fixes
transfer_to_agentis removed from message.google.cloud.aiplatform.v1beta1.EventActions(e0bc3d8)adk deploy agent_engine(9301551)from vertexai.types import TypeNamewithout needing to runfrom vertexai import typesfirst (46285bf)from vertexai.types import TypeNamewithout needing to runfrom vertexai import typesfirst (f4a6cbe)bigtable_metadatafield name inFeatureOnlineStore(e0bc3d8)bigtable_metadatafield name inFeatureView(e0bc3d8)enableDirectBigtableAccessfield name in FeatureOnlineStore` (e0bc3d8)Documentation
filterin message.google.cloud.aiplatform.v1beta1.ListSessionsRequestis changed (e0bc3d8)package_specin message.google.cloud.aiplatform.v1.ReasoningEngineSpecis changed (e0bc3d8)package_specin message.google.cloud.aiplatform.v1beta1.ReasoningEngineSpecis changed (e0bc3d8)ReasoningEngineSpecis changed (e0bc3d8)ReasoningEngineSpecis changed (e0bc3d8)Miscellaneous Chores
v1.128.0Compare Source
Features
pass_ratetoAggregatedMetricResultand calculate it for adaptive rubric metrics. (1f1f67e)build optionsin Agent Engine GCS Deployment. (28499a9)build optionsin Agent Engine source-based Deployment. (f7e718f)Bug Fixes
v1.127.0Compare Source
Features
Bug Fixes
Documentation
v1.126.1Compare Source
Bug Fixes
v1.126.0Compare Source
Features
Bug Fixes
v1.125.0Compare Source
⚠ BREAKING CHANGES
cloudtrace.googleapis.comtotelemetry.googleapis.comfor tracing API.Features
Bug Fixes
agent_info.agentincreate_evaluation_runin Vertex AI GenAI SDK evals. (d02a7da)Miscellaneous Chores
cloudtrace.googleapis.comtotelemetry.googleapis.comfor tracing API. (c81f912)v1.124.0Compare Source
⚠ BREAKING CHANGES
Features
Bug Fixes
datasetincreate_evaluation_runin Vertex AI GenAI SDK evals (741c6ad)Miscellaneous Chores
v1.123.0Compare Source
Features
appinput in AdkApp template (10ca56f)showin Vertex AI GenAI SDK evals (d62afc3)Bug Fixes
Documentation
v1.122.0Compare Source
Features
create_evaluation_setandcreate_evaluation_itemmethods to Vertex AI GenAI SDK evals (83553a9)evaluation_dfinput support tocreate_evaluation_runmethod in Vertex AI GenAI SDK evals (7a1262b)inference_configstocreate_evaluation_runmethod in Vertex AI GenAI SDK evals (5b5e6bd)labelsto EvaluationRun in Vertex AI GenAI SDK evals (67cf80b)metricstocreate_evaluation_runmethod in Vertex AI GenAI SDK evals (ce35218)showmethod for EvaluationRun for Vertex AI GenAI SDK evals (dc16065)Bug Fixes
showmethod for EvaluationRun for Vertex AI GenAI SDK evals (3ac82ea)v1.121.0Compare Source
⚠ BREAKING CHANGES
Features
ScaleToZeroSpecis added (62ea30a)class_methodsin Agent Engine config. (af8c898)Bug Fixes
Miscellaneous Chores
v1.120.0Compare Source
Features
get_evaluation_setandget_evaluation_itemmethods to Vertex AI GenAI SDK evals (7757886)showmethod for EvaluationRun class in Vertex AI GenAI SDK evals (0c932b9)Bug Fixes
Documentation
v1.119.0Compare Source
Features
get_evaluation_runmethod response in Vertex AI GenAI SDK evals (f07ecc3)v1.118.0Compare Source
⚠ BREAKING CHANGES
Features
create_evaluation_runmethod to Vertex AI GenAI SDK evals (7db9b4f)get_evaluation_runmethod to Vertex AI GenAI SDK evals (bbbadbc)Bug Fixes
Documentation
dedicated_endpoint_disabledin message.google.cloud.aiplatform.v1beta1.DeployRequestis changed (0722687)Miscellaneous Chores
v1.117.0Compare Source
Features
Documentation
v1.116.0Compare Source
Features
Bug Fixes
contextin Grounding metric (e75d91f)Documentation
v1.115.0Compare Source
⚠ BREAKING CHANGES
optimize_promptmethod no longer returns the parsed response directly. Code must be updated to access the.raw_text_responseor.parsed_responseattribute on the new return object.Features
has_template_configto MultimodalDataset. (97a6e71)Bug Fixes
Documentation
Miscellaneous Chores
v1.114.0Compare Source
Features
Bug Fixes
v1.113.0[Compa
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.