Bump protobufjs from 8.0.1 to 8.4.0 in /tests/functional#2419
Bump protobufjs from 8.0.1 to 8.4.0 in /tests/functional#2419dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 8.0.1 to 8.4.0. - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v8.0.1...protobufjs-v8.4.0) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 8.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Hello dependabot[bot],My role is to assist you with the merge of this Available options
Available commands
Status report is not available. The following options are set: bypass_author_approval, bypass_jira_check |
Waiting for approvalThe following approvals are needed before I can proceed with the merge:
The following options are set: bypass_author_approval, bypass_jira_check |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency Bump Evaluation
Version change: protobufjs 8.0.1 -> 8.4.0 (minor, multiple versions)
Files changed: tests/functional/yarn.lock only
Dependency type: Transitive (via @platformatic/kafka)
Changes (8.0.1 → 8.4.0):
- feat: BigInt conversions support (8.4.0)
- feat: Improved generated TypeScript typings (8.3.0)
- fix: Consolidate depth limit checks — DoS mitigation (8.2.1)
- fix: Preserve explicit enum zero if not the default (8.2.1)
- feat: finishInto() for zero-copy serialization (8.2.0)
- feat: textformat extension, CLI plugins, roundtrip unknown fields (8.2.0)
- fix: Multiple decoding correctness fixes (oneof, bool varints, map keys, truncated strings) (8.2.0)
Breaking changes: None documented across any intermediate release
Security concerns: None — depth limit consolidation (8.2.1) is a positive security hardening. npm publisher changed to GitHub Actions (automated releases), which is standard practice.
Impact on codebase: No direct imports or usage of protobufjs found anywhere in the codebase. It is pulled in transitively by @platformatic/kafka. Lockfile-only change.
Recommendation: SAFE TO MERGE
Notes: All features are additive, bug fixes improve protocol conformance, and since the library is only used transitively with no direct API calls in this repo, the risk of behavioral impact is negligible.
— Claude Code
1 participant
Bumps protobufjs from 8.0.1 to 8.4.0.
Release notes
Sourced from protobufjs's releases.
... (truncated)
Changelog
Sourced from protobufjs's changelog.
... (truncated)
Commits
7c6e6f4chore: release master (#2259)36873e6feat: Support BigInt conversions (#2257)f4c4385docs: Share JSDoc patch with API docs (#2252)a799376chore: release master (#2251)faa424efeat: Improve generated typings (#2244)c1251d9chore: release master (#2243)cb44b9bdeps: Update CLI peer depdedency9621b35fix: Preserve explicit enum zero if not the default (#2249)bddae34chore: Add FUNDING.yml9050289fix: Consolidate depth limit checks (#2246)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.