Azure / Azure/azure-functions-python-worker

Protobuf and gRPC Version Updates for Python 3.9 - 3.12

Open
#1,838 0 comments 0 reactions 0 assignees View on GitHub
announcement area:python-functions
Dominant language
Python
Stars
357
Forks
116
Avg merge
32m
Merged PRs (30d)
1

Description

## Summary

Due to a critical security vulnerability ([CVE-2026-0994](https://nvd.nist.gov/vuln/detail/CVE-2026-0994)) discovered in `protobuf` versions prior to 5.29.6, we are updating the `protobuf` and `grpcio` dependencies in the Python Worker. This update will be rolled out with host version **4.1052** and may cause breaking changes for some Python function apps.

## What's Changing

The following dependency versions are being updated in the Azure Functions Python Worker:

- **protobuf**: `~=4.25.3` → `~=5.29.6`
- **grpcio**: `~=1.59.0` → `~=1.70.0`

## Who Is Affected

This change may affect you if:

- Your Python function app uses `protobuf` or `grpcio` directly in your code or dependencies
- Your app runs on **Python 3.9, 3.10, 3.11, or 3.12**
- You have pinned specific versions of `protobuf` or `grpcio` in your `requirements.txt` that are incompatible with the new versions

## Rollout Timeline

- **Host Version**: 4.1052
- **Expected Completion**: August 2026

## Potential Impact

After this update is deployed, function apps that depend on older versions of `protobuf` or `grpcio` may experience:

- Runtime errors or import failures
- Type incompatibilities if using protobuf-generated code compiled with older versions
- Breaking changes in gRPC functionality due to API changes between major versions

```
RuntimeError: The grpc package installed is at version 1.37.1, but the generated code in
FunctionRpc_pb2_grpc.py depends on grpcio>=1.70.0.
```

## Mitigation Options

### Option 1: Update Your Dependencies

Update your `requirements.txt` to use compatible versions:

```txt
protobuf~=5.29.6
grpcio~=1.70.0
```

### Option 2: Use Isolated Worker Dependencies

If you need to continue using older versions of `protobuf` or `grpcio`, you can set the `PYTHON_ISOLATE_WORKER_DEPENDENCIES` application setting to `1` to prioritize your app's pinned versions.

### Option 3: Migrate to Python >= 3.13

Migrate your existing function apps to run on Python 3.13 or Python 3.14.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.