uv.lock can silently resolve protobuf incompatible with generated event_pb2.py (ImportError: runtime_version)

[chrisblech]

Summary

uv.lock can silently resolve protobuf to a version that is incompatible
with the checked-in generated code in app/events/generated/event_pb2.py,
breaking app, email_handler.py and job_runner.py at import time with:

ImportError: cannot import name 'runtime_version' from 'google.protobuf'

This is not a hypothetical: it reproduces on a clean checkout of master.

Root cause

• app/events/generated/event_pb2.py is generated code that requires
  google.protobuf.runtime_version, which only exists starting with
  protobuf >= 4.25.
• protobuf is not a direct dependency in pyproject.toml — it is only
  pulled in transitively through google-api-python-client ~= 1.12.3 (an
  ~2020-era pin) via its google-api-core dependency chain.
• google-api-python-client ~= 1.12.3's transitive constraints permit
  (and, once nudged, actively prefer) protobuf < 4, i.e. the latest 3.x
  release (3.20.3), which does not have the runtime_version module at
  all.
• Separately, app/email_utils.py does from cachetools import cached, TTLCache, but cachetools is also not declared as a direct
  dependency — it only happens to be present transitively (currently via
  google-auth).

Because protobuf and cachetools both float as undeclared/transitive
dependencies, the exact versions that get resolved depend entirely on
whatever else is going on in the rest of the dependency graph at lock time.
The currently committed uv.lock happens to have protobuf==5.27.1, which
works — but that is incidental, not guaranteed by pyproject.toml.

Reproduction (on a clean checkout of master)

Add any new, unrelated top-level dependency and re-lock, e.g.:

   "google-auth-httplib2 ~= 0.0.4",
+  "cachetools ~= 5.3.3",

uv lock

Result:

Updated cachetools v4.1.1 -> v5.3.3
Updated google-api-core v1.22.2 -> v1.34.1
Updated google-auth v1.22.0 -> v2.47.0
Updated googleapis-common-protos v1.52.0 -> v1.73.0
Updated protobuf v5.27.1 -> v3.20.3

protobuf drops from 5.27.1 to 3.20.3. Booting the app (or running
python -c "import email_handler") with this lockfile immediately fails
with the ImportError above.

We hit this for real: adding a dependency for an unrelated feature on a
fork triggered exactly this, taking down a production deployment until we
tracked it down (the failure mode gives no indication that protobuf, of
all things, is the problem).

Suggested fix

• Declare protobuf as a direct dependency with a floor that matches what
  the generated event_pb2.py actually requires, e.g. protobuf >= 4.25, < 6.
• Declare cachetools as a direct dependency (it's directly imported in
  app/email_utils.py), e.g. cachetools >= 5.0, < 6.
• Bump google-api-python-client off the 2020-era ~= 1.12.3 pin to a
  current 2.x release (>= 2.100, < 3) and google-auth-httplib2 to >= 0.2.0, < 1.0 accordingly — the only call site
  (app/api/views/auth.py, googleapiclient.discovery.build("oauth2", "v2", ...)) is unaffected by the major version bump.

This resolves cleanly to stable (non-prerelease) versions across the board
(protobuf 5.27.1, google-api-core 2.30.3) and removes the landmine for
good, rather than just re-locking back to a lucky state.

I'll open a PR with this fix, verified locally (dependency resolution +
container build + import smoke test for app, email_handler.py,
job_runner.py, and the Google OAuth code path).