v8.0.1

Security

🔒 Fixed Protobuf Denial-of-Service Vulnerability (CVE-2025-4565)

Updated protobuf dependency to address a denial-of-service vulnerability when parsing deeply nested recursive structures in a Pure-Python backend.

Affected users: Only users of the grpc extras (pip install pinecone[grpc]) and PineconeGRPC client will be affected by the change. Users of the default REST client (Pinecone) are not affected.

Changes:

• Upgraded protobuf from 5.x to 6.33.0+
• Upgraded googleapis-common-protos from 1.66.0 to 1.72.0+ for compatibility
• Regenerated gRPC code with protobuf v33.0

Impact:

• Breaking Change: Minimum protobuf version is now 6.33.0 (was 5.29.5)
• Users with pinned protobuf versions <6.33.0 will need to upgrade
• No API or functionality changes for end users
• All existing code continues to work with the new protobuf version

References:

• CVE-2025-4565