build: update protobuf version for 3.14 (cve)

eng/ci/public-build.yml

@@ -56,25 +56,38 @@ extends:
       - template: /eng/templates/jobs/build.yml@self
         parameters:
           PYTHON_VERSION: '3.11'
-          PROJECT_NAME: 'Azure Functions Python Worker'
+          SIMPLE_VERSION: '311'
+          PROJECT_NAME: 'Azure Functions Python Worker <= 3.12'
+          PROJECT_DIRECTORY: 'workers'
+      - template: /eng/templates/jobs/build.yml@self
+        parameters:
+          PYTHON_VERSION: '3.13'
+          SIMPLE_VERSION: '313'
+          PROJECT_NAME: 'Azure Functions Python Worker == 3.13'
+          PROJECT_DIRECTORY: 'workers'
+      - template: /eng/templates/jobs/build.yml@self
+        parameters:
+          PYTHON_VERSION: '3.14'
+          SIMPLE_VERSION: '314'
+          PROJECT_NAME: 'Azure Functions Python Worker == 3.14'
           PROJECT_DIRECTORY: 'workers'
       # Skip the build stage for SDK and Extensions release branches. This stage will fail because pyproject.toml contains the updated (and unreleased) library version
       condition: and(eq(variables.isSdkRelease, false), eq(variables.isExtensionsRelease, false), eq(variables['USETESTPYTHONSDK'], false), eq(variables['USETESTPYTHONEXTENSIONS'], false))
     - stage: CheckPythonWorkerDependencies
-      dependsOn: BuildPythonWorker
+      dependsOn: []
       jobs:
       - template: /eng/templates/jobs/ci-dependency-check.yml@self
         parameters:
           PoolName: 1es-pool-azfunc-public
     - stage: RunWorkerUnitTests
-      dependsOn: BuildPythonWorker
+      dependsOn: CheckPythonWorkerDependencies
       jobs:
         - template: /eng/templates/jobs/ci-unit-tests.yml@self
           parameters:
             PROJECT_DIRECTORY: 'workers'
             PoolName: 1es-pool-azfunc-public
     - stage: RunWorkerEmulatorTests
-      dependsOn: BuildPythonWorker
+      dependsOn: CheckPythonWorkerDependencies
       jobs:
         - template: /eng/templates/jobs/ci-emulator-tests.yml@self
           parameters:
@@ -98,8 +111,6 @@ extends:
             PROJECT_DIRECTORY: 'runtimes/v2'
             PoolName: 1es-pool-azfunc-public
 
-
-
     # Python V1 Library Build and Test Stages
     - stage: BuildV1Library
       dependsOn: []

eng/pack/scripts/mac_arm64_deps.sh

@@ -3,6 +3,7 @@
 python -m venv .env
 source .env/bin/activate
 python -m pip install --upgrade pip
+python -m pip install "setuptools>=62,<82.0"
 
 cd workers
 python -m pip install .

eng/pack/scripts/nix_arm64_deps.sh

@@ -3,6 +3,7 @@
 python -m venv .env
 source .env/bin/activate
 python -m pip install --upgrade pip
+python -m pip install "setuptools>=62,<82.0"
 
 version_minor=$(echo $1 | cut -d '.' -f 2)
 mkdir -p $BUILD_SOURCESDIRECTORY/deps
@@ -21,6 +22,7 @@ docker run --name my-arm64-container --platform linux/arm64 \
         ls -la /src  # debug: see what files exist
         apt-get update && apt-get install -y git curl && \
         pip install --upgrade pip && \
+        pip install "setuptools>=62,<82.0" && \
         cd workers && \
         pip install . && \
         pip install . --target /src && \

eng/pack/scripts/nix_deps.sh

@@ -3,6 +3,7 @@
 python -m venv .env
 source .env/bin/activate
 python -m pip install --upgrade pip
+python -m pip install "setuptools>=62,<82.0"
 
 cd workers
 python -m pip install .

eng/pack/scripts/win_deps.ps1

@@ -7,6 +7,7 @@ $versionMinor = [int]$versionParts[1]
 python -m venv .env
 .env\Scripts\Activate.ps1
 python -m pip install --upgrade pip
+python -m pip install "setuptools>=62,<82.0"
 
 cd workers
 python -m pip install .

eng/templates/jobs/build.yml

@@ -1,11 +1,12 @@
 parameters:
   PYTHON_VERSION: ''
+  SIMPLE_VERSION: ''
   PROJECT_NAME: ''
   PROJECT_DIRECTORY: ''
 
 jobs:
-  - job: "Build"
-    displayName: 'Build'
+  - job: "Build${{ parameters.SIMPLE_VERSION }}"
+    displayName: 'Build ${{ parameters.PROJECT_NAME }}'
 
     pool:
       name: 1es-pool-azfunc-public

eng/templates/shared/build-steps.yml

@@ -20,5 +20,4 @@ steps:
       pip install pip-audit
       cd ${{ parameters.PROJECT_DIRECTORY }}
       pip-audit -r requirements.txt
-    displayName: 'Run vulnerability scan'
-    continueOnError: true
+    displayName: 'Run vulnerability scan'

workers/pyproject.toml

@@ -30,7 +30,7 @@ dependencies = [
      "python-dateutil~=2.9.0",
      "protobuf~=4.25.3; python_version < '3.13'",
      "protobuf~=5.29.0; python_version == '3.13'",
-     "protobuf~=6.32.1; python_version == '3.14'",
+     "protobuf~=6.33.1; python_version == '3.14'",
      "grpcio-tools~=1.59.0;python_version < '3.13'",
      "grpcio-tools~=1.70.0; python_version == '3.13'",
      "grpcio-tools~=1.75.1; python_version == '3.14'",