upgrade opentelemetry-exporter-zipkin-proto-http protobuf dependency

[shiranbi]

It would be very helpful if the zipkin proto exporter python dependencies would be upgraded
The opentelemetry-proto dependency was already upgraded to "protobuf>=3.19, < 5.0"
but the zipkin exporter is on ~=3.12
making it impossible to upgrade other libraries which require protobuf >= 4.0

[litan1106]

+1

[iwedaz]

Also #3074

[sergioave]

It would be necessary to update the protobuf version to be compatible with the rest of the opentelemetry packages that have already been updated and require protobuf version > 5.0 and < 6.0 as a dependency.

[andrewkoltsov]

    opentelemetry-exporter-zipkin-proto-http 1.28.0 depends on protobuf~=3.12
    opentelemetry-proto 1.28.0 depends on protobuf<6.0 and >=5.0

last version when it was aligned is 1.27.0

[jkingsman]

This is especially relevant as https://nvd.nist.gov/vuln/detail/CVE-2025-4565 just dropped, which is marked High (regardless of actual exploitability in this lib's context) and thus comes with upgrade-or-remove requirements for organizations with strict security standards.

If there's simple housekeeping involved in the upgrade, I'd be happy to help how I can!

[mihailyanchev]

Is there any workaround this or an open PR?