Bump protobufjs from 8.0.1 to 8.3.0 in /tests/functional#2418
Bump protobufjs from 8.0.1 to 8.3.0 in /tests/functional#2418dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 8.0.1 to 8.3.0. - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v8.0.1...protobufjs-v8.3.0) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 8.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Hello dependabot[bot],My role is to assist you with the merge of this Available options
Available commands
Status report is not available. The following options are set: bypass_author_approval, bypass_jira_check |
Waiting for approvalThe following approvals are needed before I can proceed with the merge:
The following options are set: bypass_author_approval, bypass_jira_check |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency Bump Evaluation
Version change: 8.0.1 -> 8.3.0 (minor, multiple intermediate releases: 8.0.3, 8.2.0, 8.2.1, 8.3.0)
Breaking changes: None
Security concerns: None — includes positive security hardening (parser input handling #2240, depth limit consolidation #2246)
Impact on codebase: protobufjs is an optional transitive dependency of @platformatic/kafka in tests/functional/. No source files in the repo directly import or use protobufjs. Only yarn.lock was modified (lockfile-only change).
Key changes across releases:
- 8.2.0: New features (finishInto, textformat extension, unknown field roundtrip), many decode correctness fixes (oneof, bool varints, wire tags, map keys, truncated strings, message field merging)
- 8.2.1: Depth limit check consolidation, enum zero preservation, generated code optimization
- 8.3.0: Improved generated TypeScript typings
Maintainer note: npm publisher changed to GitHub Actions — this is standard CI/CD publishing, not a supply chain concern.
Recommendation: SAFE TO MERGE
— Claude Code
|
Superseded by #2419. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/tests/functional/protobufjs-8.3.0
branch
1 participant
Bumps protobufjs from 8.0.1 to 8.3.0.
Release notes
Sourced from protobufjs's releases.
... (truncated)
Changelog
Sourced from protobufjs's changelog.
... (truncated)
Commits
a799376chore: release master (#2251)faa424efeat: Improve generated typings (#2244)c1251d9chore: release master (#2243)cb44b9bdeps: Update CLI peer depdedency9621b35fix: Preserve explicit enum zero if not the default (#2249)bddae34chore: Add FUNDING.yml9050289fix: Consolidate depth limit checks (#2246)c41160cperf: Slightly optimize generated code (#2242)5af7a5echore: Fix API docs publishing (#2241)f8d5f3fchore: release master (#2194)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.