[Snyk] Security upgrade aiohttp from 3.8.6 to 3.12.14

.github/workflows/e2e-test.yml

@@ -8,6 +8,7 @@ on:
     paths:
       - '.github/workflows/e2e-test.yml'
       - '.github/resources/**'
+      - 'api/**'
       - 'go.mod'
       - 'go.sum'
       - 'backend/**'

.github/workflows/kfp-kubernetes-execution-tests.yml

@@ -75,7 +75,7 @@ jobs:
       - name: Install protobuf
         id: install-protobuf
         if: ${{ steps.install-wheel.outcome == 'success' }}
-        run: pip3 install protobuf==4.25.3
+        run: pip3 install protobuf==6.31.1
 
       - name: Generate API proto files
         id: generate-api-proto-files

.github/workflows/kfp-kubernetes-library-test.yml

@@ -21,6 +21,7 @@ jobs:
           { 'version': '3.9' },
           { 'version': '3.13' }
         ]
+        protobuf-version: ['5.26.0', '6.31.1']
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -42,7 +43,9 @@ jobs:
         run: pip3 install wheel==0.42.0
 
       - name: Install protobuf
-        run: pip3 install protobuf==4.25.3
+        run: pip3 install protobuf==${PROTOBUF_VERSION}
+        env:
+          PROTOBUF_VERSION: ${{ matrix.protobuf-version }}
 
       - name: Install kfp-sdk from source
         run: |

.github/workflows/kfp-samples.yml

@@ -8,6 +8,7 @@ on:
       - '.github/resources/**'
       - '.github/workflows/kfp-samples.yml'
       - '.github/workflows/kubeflow-pipelines-integration-v2.yml'
+      - 'api/**'
       - 'backend/**'
       - 'samples/**'
       - 'samples/core/dataflow/**'
@@ -53,7 +54,7 @@ jobs:
       run: pip3 install wheel==0.42.0
 
     - name: Install protobuf
-      run: pip3 install protobuf==4.25.3
+      run: pip3 install protobuf==6.31.1
 
     - name: Generate API proto files
       working-directory: ./api

.github/workflows/kfp-sdk-tests.yml

@@ -5,6 +5,7 @@ on:
     branches: [master]
   pull_request:
     paths:
+      - 'api/**'
       - 'sdk/**'
       - 'test/presubmit-tests-sdk.sh'
       - '.github/workflows/kfp-sdk-tests.yml'
@@ -17,6 +18,7 @@ jobs:
     strategy:
       matrix:
         python-version: ['3.9', '3.13']
+        protobuf-version: ['5.26.0', '6.31.1']
 
     steps:
     - name: Checkout code
@@ -41,6 +43,9 @@ jobs:
       run: |
         python3 -m pip install -I api/v2alpha1/python
 
-    - name: Run SDK Tests
+    - name: Run presubmit tests
+      env:
+        PROTOBUF_VERSION: ${{ matrix.protobuf-version }}
       run: |
+        echo "Testing with protobuf==$PROTOBUF_VERSION"
         ./test/presubmit-tests-sdk.sh

.github/workflows/sdk-component-yaml.yml

@@ -38,7 +38,7 @@ jobs:
         run: pip3 install wheel==0.42.0
 
       - name: Install protobuf
-        run: pip3 install protobuf==4.25.3
+        run: pip3 install protobuf==6.31.1
 
       - name: Generate API proto files
         working-directory: ./api

.github/workflows/sdk-execution.yml

@@ -88,7 +88,7 @@ jobs:
       - name: Install protobuf
         id: install-protobuf
         if: ${{ steps.install-wheel.outcome == 'success' }}
-        run: pip3 install protobuf==4.25.3
+        run: pip3 install protobuf==6.31.1
 
       - name: Generate API proto files
         id: generate-api-proto-files

api/Makefile

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Contact one of chensun, HumairAK, zijianjoy if this remote image needs an update.
-PREBUILT_REMOTE_IMAGE=ghcr.io/kubeflow/kfp-api-generator:1.1
+# Contact one of chensun, HumairAK if this remote image needs an update.
+PREBUILT_REMOTE_IMAGE=ghcr.io/kubeflow/kfp-api-generator:1.2
 
 .PHONY: all
 all: golang python
@@ -36,14 +36,22 @@ clean-go:
 	rm -rf v2alpha1/go
 	rm -f v2alpha1/google/rpc/status.proto
 
-# Build and locally install Python package.
+# Build Python package using pre-built image
 .PHONY: python
-python: v2alpha1/pipeline_spec.proto v2alpha1/google/rpc/status.proto
-	python3 v2alpha1/python/generate_proto.py && cd v2alpha1/python && python3 setup.py bdist_wheel
+python: python fetch-protos
+	docker run --interactive --rm \
+		--user $$(id -u):$$(id -g) \
+		-e HOME=/tmp \
+		-v "$$(pwd)/..":"/go/src/github.com/kubeflow/pipelines":z \
+		$(PREBUILT_REMOTE_IMAGE) \
+		sh -c 'cd /go/src/github.com/kubeflow/pipelines/api/v2alpha1/python && \
+		    python3 -m pip install --user --break-system-packages -r requirements.txt && \
+		    python3 generate_proto.py && \
+		    python3 setup.py sdist bdist_wheel --dist-dir ./dist'
 
 # Build and locally install Python package using editable mode for development.
 .PHONY: python-dev
-python-dev: v2alpha1/pipeline_spec.proto v2alpha1/google/rpc/status.proto
+python-dev: v2alpha1/pipeline_spec.proto fetch-protos
 	python3 v2alpha1/python/generate_proto.py && cd v2alpha1/python && pip install -e .
 
 # Delete all generated Python packages
@@ -55,17 +63,17 @@ clean-python:
 	rm -f v2alpha1/python/kfp/pipeline_spec/pipeline_spec_pb2.py
 	rm -f v2alpha1/google/rpc/status.proto
 
-##########################
+###########################################
 # The following are IMPLEMENTATION DETAILS.
-##########################
+###########################################
 
 # Generates proto packages locally, this should only be called:
 # * during development
 # * inside the prebuilt docker container
 .PHONY: generate
 generate: go_pipelinespec go_cachekey
 
-go_pipelinespec: v2alpha1/pipeline_spec.proto v2alpha1/google/rpc/status.proto
+go_pipelinespec: v2alpha1/pipeline_spec.proto fetch-protos
 	mkdir -p v2alpha1/go/pipelinespec
 	cd v2alpha1 && protoc -I=. \
 		--go_out=go/pipelinespec \
@@ -79,12 +87,32 @@ go_cachekey: v2alpha1/pipeline_spec.proto v2alpha1/cache_key.proto
 		--go_opt=paths=source_relative \
 		cache_key.proto
 
-# Fetch dependency proto
-v2alpha1/google/rpc/status.proto:
-	mkdir -p v2alpha1/google/rpc
-	wget -O v2alpha1/google/rpc/status.proto https://raw.githubusercontent.com/googleapis/googleapis/047d3a8ac7f75383855df0166144f891d7af08d9/google/rpc/status.proto
+#########################################
+# The following are dependencies
+# Required for compiling the proto files
+#########################################
+
+GOOGLEAPIS_COMMIT ?= fecd7d35f46753b45bf4519f6342495a181740c9
+PROTOBUF_TAG ?= v26.0
+PROTO_DST_DIR := v2alpha1/google
+TMP_PROTOBUF_DIR := /tmp/protobuf-src
+
+.PHONY: fetch-protos fetch-googleapis fetch-protobuf protoc-gen-go clean-protobuf-tmp
+
+fetch-protos: fetch-googleapis fetch-protobuf
+
+fetch-googleapis:
+	@echo "Downloading google/rpc/status.proto from googleapis@$(GOOGLEAPIS_COMMIT)..."
+	mkdir -p $(PROTO_DST_DIR)/rpc
+	wget -qO $(PROTO_DST_DIR)/rpc/status.proto https://raw.githubusercontent.com/googleapis/googleapis/$(GOOGLEAPIS_COMMIT)/google/rpc/status.proto
+
+fetch-protobuf: clean-protobuf-tmp
+	@git clone --depth 1 --branch $(PROTOBUF_TAG) https://github.com/protocolbuffers/protobuf.git $(TMP_PROTOBUF_DIR)
+	@mkdir -p $(PROTO_DST_DIR)/protobuf
+	@cp $(TMP_PROTOBUF_DIR)/src/google/protobuf/*.proto $(PROTO_DST_DIR)/protobuf/
+
+clean-protobuf-tmp:
+	@rm -rf $(TMP_PROTOBUF_DIR)
 
-# protoc-gen-go is already installed in api-generator image
-.PHONY: protoc-gen-go
 protoc-gen-go:
 	go install google.golang.org/protobuf/cmd/protoc-gen-go