PR Review

Summary

Temporarily ignores CVE-2026-0994 in protobuf to unblock CI while waiting for upstream fix.

Issues Found

⚠️ Critical - Verify CVE Number
The CVE is listed as CVE-2026-0994 but we are currently in January 2026. This seems unusual - CVEs are typically assigned in the year they are discovered. Please verify:

• Is this actually CVE-2025-0994 or CVE-2024-0994?
• If it is 2026, can you confirm the CVE number is correct?

This is important for security tracking - the wrong CVE number defeats the purpose of the ignore flag.

Positives

• ✅ Both pip-audit commands updated consistently
• ✅ Clear TODO comment for tracking removal
• ✅ Minimal, focused change
• ✅ Whitespace cleanup on line 62

Recommendations

1. Verify and correct the CVE number if needed
2. Consider adding the upstream PR link in the TODO comment for easier tracking:

   # TODO: Remove --ignore-vuln once protobuf releases a fix for CVE-2026-0994
   # Tracking: https://github.com/protocolbuffers/protobuf/pull/25239

Approval: Conditional - please verify CVE number before merging.

@therealnb we could probably use the pyproject.toml file as ignore file. From there we could pass the vulnerabilities to ignore and have visibility of them. Will introduce in a later PR