0.14.0 dependency pins resolve grpcio-reflection to 1.62.3 (incompatible with pinned grpcio 1.81.0 / protobuf 7.35.0)

[vilmosmartinek]

What happened?

Installing crossplane-function-sdk-python==0.14.0 (currently the latest release on PyPI) causes pip to backtrack through most of the grpcio-reflection 1.x line and settle on grpcio-reflection==1.62.3, while still installing grpcio==1.81.0 and protobuf==7.35.0.

That is a ~2 year version skew between grpcio and grpcio-reflection. Pip also spends a long time backtracking before it finds that combination.

How can we reproduce it?

pip install crossplane-function-sdk-python==0.14.0 --dry-run --ignore-installed

Resolved set (trimmed):

crossplane-function-sdk-python-0.14.0
grpcio-1.81.0
grpcio-reflection-1.62.3
protobuf-7.35.0

Why this happens

0.14.0 publishes:

dependencies = [
  "grpcio==1.81.0",
  "grpcio-reflection==1.*",
  "protobuf==7.35.0",
  ...
]

Those three constraints are not jointly satisfiable by a matching grpcio-reflection 1.81.x:

grpcio-reflection	grpcio requirement	protobuf requirement
1.84.0	>=1.84.0	>=7.35.1,<8
1.83.1	>=1.83.1	>=7.35.1,<8
1.81.0 / 1.81.1	>=1.81.0 / >=1.81.1	>=6.33.5,<7
1.63.0	>=1.63.0	>=5.26.1,<6.0dev
1.62.3	>=1.62.3	>=4.21.6 (no upper bound)

So:

1. Newer reflection (1.82+) that allows protobuf 7 needs a newer grpcio than ==1.81.0.
2. Reflection that matches grpcio 1.81.x still declares protobuf<7, which conflicts with the SDK's protobuf==7.35.0.
3. pip therefore walks every remaining 1.* candidate until it hits 1.62.3, which predates protobuf upper bounds and still accepts both pins.

grpcio itself does not constrain protobuf; the conflict is specifically grpcio-reflection's protobuf range vs the SDK's protobuf pin, plus the exact grpcio==1.81.0 pin blocking newer reflection.

What we already checked

main already has a compatible set:

dependencies = [
  "grpcio==1.83.1",
  "grpcio-reflection==1.*",
  "protobuf==7.36.1", # Must be compatible with grpcio-tools.
  "pydantic==2.*",
  "structlog==26.*",
]

That resolves cleanly:

pip install grpcio==1.83.1 grpcio-reflection==1.* protobuf==7.36.1 --dry-run --ignore-installed
# Would install grpcio-1.83.1 grpcio-reflection-1.83.1 protobuf-7.36.1 ...

(grpcio-reflection 1.84.0 is skipped because it requires grpcio>=1.84.0, then 1.83.1 matches.)

There has been no SDK release since v0.14.0 (2026-06-10), so consumers cannot pick this up from PyPI yet.

Request

Could you please cut a new release from current main (or equivalent) so PyPI publishes grpcio==1.83.1 + protobuf==7.36.1 (and a grpcio-reflection that actually supports protobuf 7)?

Optional follow-up: it would possibly make sense to pin grpcio-reflection to the same version as grpcio (for example ==1.83.1) instead of ==1.*. Leaving reflection as ==1.* will keep probing newer 1.x first (1.84.0 already requires grpcio>=1.84.0) and can recreate this backtracking if protobuf/grpcio pins drift again.

[bobh66]

v0.15.0 is available

[vilmosmartinek]

Thank you for the amazingly quick fix, much appreciated!