From bb7eb06697885cdaa3fbe65f0b5402954d8bde4e Mon Sep 17 00:00:00 2001
From: Palash Debnath <4178343+debpalash@users.noreply.github.com>
Date: Thu, 10 Sep 2026 13:49:32 -0700
Subject: [PATCH] test(deps): raise the app's protobuf and transformers floors
 too

The app's own lock already resolves transformers 5.15.1 and protobuf
7.36.0, but PYTHON_FLOORS still allowed transformers 5.5.0 and did not
pin protobuf. A later lock change could have slipped below the fixes for
the advisories Dependabot raised on CosyVoice's manifest (#2030, #2031).
---
 tests/test_dependency_security_floors.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/test_dependency_security_floors.py b/tests/test_dependency_security_floors.py
index db7a233d..a10a0d7f 100644
--- a/tests/test_dependency_security_floors.py
+++ b/tests/test_dependency_security_floors.py
@@ -16,12 +16,13 @@ PYTHON_FLOORS = {
     "msgpack": "1.2.1",
     "nltk": "3.10.0",
     "pillow": "12.3.0",
+    "protobuf": "5.29.6",
     "pydantic-settings": "2.14.2",
     "pygments": "2.20.0",
     "pypdf": "6.15.0",
     "python-multipart": "0.0.31",
     "starlette": "1.3.1",
-    "transformers": "5.5.0",
+    "transformers": "5.10.0",
     "yt-dlp": "2026.7.4",
 }
 CARGO_FLOORS = {"quinn-proto": "0.11.15"}