deps: update protobuf and setuptools

[matthewelwell]

Changes

Update protobuf (transient dependency of google-api-python-client), wheel and jaraco.context (transient dependencies of setuptools).

Resolves CVEs:

• CVE-2026-0994
• CVE-2026-24049
• CVE-2026-23949

How did you test this code?

E2E / unit tests

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs	Ignored		Feb 6, 2026 10:00am
flagsmith-frontend-preview	Ignored		Feb 6, 2026 10:00am
flagsmith-frontend-staging	Ignored		Feb 6, 2026 10:00am

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-6670	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-6670	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-api-test:pr-6670	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-6670	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-6670	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-6670	Finished ✅	Results ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.20%. Comparing base (6a97300) to head (a30ed88).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6670      +/-   ##
==========================================
+ Coverage   98.12%   98.20%   +0.07%     
==========================================
  Files        1298     1298              
  Lines       47108    47108              
==========================================
+ Hits        46227    46262      +35     
+ Misses        881      846      -35     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[khvn26]

Why do we need setuptools in runtime again?

[matthewelwell]

Why do we need setuptools in runtime again?

This is a good question - it looks like it is a transient dependency of django-axes (see here). I would definitely like to try and remove that, but I think that's a separate concern.

[matthewelwell]

@khvn26 see here: #6671