chore(deps): bump google-cloud-kms from 2.24.2 to 3.16.0 - #6119
chore(deps): bump google-cloud-kms from 2.24.2 to 3.16.0#6119dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [google-cloud-kms](https://github.com/googleapis/google-cloud-python) from 2.24.2 to 3.16.0. - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-cloud-kms-v2.24.2...google-cloud-kms-v3.16.0) --- updated-dependencies: - dependency-name: google-cloud-kms dependency-version: 3.16.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🟡 Waiting for changesLast updated: 2026-09-01 00:42 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6119 — google-cloud-kms 2.24.2 → 3.16.0, major, production dependency. CI passing, but the Python unit tests never import KMS, google.cloud.logging, or the error-reporting middleware, so they don't exercise anything this diff changed.
Breaking changes: one, in 3.0.0 — pagination added to ListKeyHandles (Autokey). Studio doesn't use Autokey. utils/secretmanagement.py:81-95 uses KeyManagementServiceClient, crypto_key_path(), decrypt() and DecryptResponse.plaintext{,_crc32c}, all unchanged in 3.16.0. No code changes required. Security fixes: none in range.
blocking — the resolution silently downgrades two production packages.
google-cloud-logging2.7.1 → 2.6.0 andgoogle-cloud-appengine-logging1.8.0 → 0.2.0 (uploaded 2021-10-12).- Chain: kms 3.16.0 needs
grpc-google-iam-v1>=0.14.2; logging 2.7.1 pins<0.13dev— mutually exclusive, so the resolver falls back to 2.6.0, which drops that dep and caps appengine-logging at<1.0.0dev. - The ceiling is
google-cloud-error-reporting==1.4.0(google-cloud-logging<3.0.0dev), a production dep — imported atmiddleware/error_reporting.py:3, installed wheneverGCLOUD_ERROR_REPORTINGis set (settings.py:156). - All four packages import cleanly in a clean py3.10 venv with this branch's pins, so it's not an immediate crash — but a four-year rollback of a production dependency shouldn't arrive unreviewed under a KMS title.
- Fix: bump
google-cloud-error-reportingto 1.16.1 inrequirements.inin this PR — it requiresgoogle-cloud-logging>=3.12.0and thegrpc-google-iam-v1KMS 3.16 wants, so the GCP stack resolves forward. Regeneraterequirements.txtand confirm no-line moves a version down.
suggestion — protobuf 4.25.8 → 6.33.6, two majors, forced by googleapis-common-protos==1.75.2 via grpc-google-iam-v1==0.14.5. The protobuf runtime is process-global, so this affects every generated message, not just KMS. uv pip check is clean and the 2021-era appengine-logging gencode still loads under the protobuf 6 runtime (both verified), but nothing in CI covers it — worth stating in the merge notes.
suggestion — [grpc] extras dropped from the lock annotations (google-api-core[grpc] → google-api-core, same for googleapis-common-protos), even though kms 3.16.0 and grpc-google-iam-v1 both require them. grpcio/grpcio-status stay pinned so uv pip sync installs the same set, but the dropped markers suggest this was regenerated by a resolver rendering extras differently. Regenerate with the repo's own compile command and check the diff matches.
nitpick — KMS 3.8.0 added generated-GAPIC version checks, so on Studio's pinned Python 3.10 importing google.cloud.kms now emits a FutureWarning (Google drops 3.10 on 2026-10-04). Cosmetic, but it'll show in logs and test output.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
1 participant
Bumps google-cloud-kms from 2.24.2 to 3.16.0.
Release notes
Sourced from google-cloud-kms's releases.
... (truncated)
Changelog
Sourced from google-cloud-kms's changelog.
... (truncated)
Commits
97d7b42chore: release main (#17701)7823422chore(main): release bigframes 2.46.0 (#17686)ce5fd50fix: emit bracketed inline array syntax for scalar subquery expressions (#17716)2c3c213feat(bigtable): support materialized views in the data client (#17676)1ef0340chore(deps): update dependency cryptography to v48.0.1 [security] (#17734)75d30d5chore(deps): update dependency esbuild to ^0.28.0 [security] (#17736)9019b2atest(spanner): update pytest and add pytest-asyncio to samples test requireme...a2b4096test(spanner): add pytest-asyncio to samples test requirements (#17731)5d3ca44test: catch expected UserWarning in test_repr_mimebundle_selection_logic (#17...35e16dafeat: update googleapis and regenerate (#17725)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)