Merge pull request #663 from kagenti/fix/pin-protobuf-below-7

Cap protobuf<7 in file_organizer and image_service (supersedes #507, #510)

Author: pdettori

a2a/file_organizer/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "cryptography>=48.0.0,<49", # Indirect; prevents CVE-2026-26007
     "mcp>=1.28.1",              # Indirect; prevents CVE-2025-66416
     "orjson>=3.11.6",           # Indirect; prevents CVE-2025-67221
-    "protobuf>=6.33.5",         # Indirect; prevents CVE-2026-0994
+    "protobuf>=6.33.5,<7",      # Indirect; prevents CVE-2026-0994. Cap <7: opentelemetry-proto requires protobuf<7.0 (proto7 downgrades OTel and breaks startup)
     "pyasn1>=0.6.4",            # Indirect; prevents CVE-2026-30922
     "pyjwt>=2.13.0",            # Indirect; prevents CVE-2026-32597
 ]

a2a/file_organizer/uv.lock

@@ -23,7 +23,7 @@ dependencies = [
     "aiohttp>=3.14.0",          # Indirect; prevents CVE-2026-34525, CVE-2026-34516, CVE-2026-34515, CVE-2026-22815
     "mcp>=1.28.1",              # Indirect; prevents CVE-2025-66416
     "orjson>=3.11.6",           # Indirect; prevents CVE-2025-67221
-    "protobuf>=6.33.5",         # Indirect; prevents CVE-2026-0994
+    "protobuf>=6.33.5,<7",      # Indirect; prevents CVE-2026-0994. Cap <7: opentelemetry-proto requires protobuf<7.0 (proto7 downgrades OTel and breaks startup)
     "pyasn1>=0.6.4",            # Indirect; prevents CVE-2026-30922
     "cryptography>=48.0.0,<49", # Indirect; prevents CVE-2026-26007
     "pyjwt>=2.13.0",            # Indirect; prevents CVE-2026-32597