Skip to content

chore(deps): update all non-major dependencies#572

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#572
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
gh minor 2.93.0 → 2.96.0 age confidence
github.com/klauspost/compress require minor v1.18.6 → v1.19.0 age confidence
golang.org/x/net require minor v0.55.0 → v0.56.0 age confidence
just minor 1.52.0 → 1.55.1 age confidence
protoc minor 3.7.1 → 3.20.3 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cli/cli (gh)

v2.96.0: GitHub CLI 2.96.0

Security

A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via gh codespace jupyter.

Users of gh codespace jupyter are advised to update gh to version v2.96.0 as soon as possible.

For more information see: GHSA-8cg3-r6g9-fpg2

Download release assets without authentication

gh release download now works against public repositories without authentication, matching gh extension install. A token is still used when one is present:

# Download assets from a public repository, no login required
gh release download v2.96.0 --repo cli/cli

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.95.0...v2.96.0

v2.95.0: GitHub CLI 2.95.0

Read repository files and directories with gh repo read-file and gh repo read-dir

Two new preview commands read repository contents without cloning:

# Read a single file to stdout
gh repo read-file README.md --repo cli/cli

# Read from a specific branch, tag, or commit
gh repo read-file go.mod --ref v2.94.0 --repo cli/cli

# Write a file to disk (use --clobber to overwrite)
gh repo read-file README.md --output ./README.md --repo cli/cli

# List the entries in a directory
gh repo read-dir script --repo cli/cli

Both commands default to the repository's default branch, accept --ref to target any branch, tag, or commit, and support --json, --jq, and --template for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout.

[!NOTE]
gh repo read-file and gh repo read-dir are in preview and subject to change without notice.

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.94.0...v2.95.0

v2.94.0: GitHub CLI 2.94.0

Issue types, sub-issues, and relationships in gh issue

issue-view-monas-cafe-with-frame

This release brings GitHub's advanced issue features to gh issue create, edit, view, and list. You can set and view an issue's type, organize work with sub-issues, and track blocked-by and blocking relationships without leaving the command line:

# Set an issue's type
gh issue create --type Bug
gh issue edit 123 --type Bug

# Organize work with sub-issues
gh issue create --parent 100
gh issue edit 100 --add-sub-issue 123

# Track blocked-by and blocking relationships
gh issue create --blocked-by 200
gh issue edit 123 --add-blocking 300

Issue types and sub-issues are available on GitHub.com and GHES 3.17+; relationships require GHES 3.19+.

Manage discussions with gh discussion

discussion-view-monas-cafe-with-frame

This release introduces the discussion command set for working with GitHub Discussions in gh:

# List discussions
gh discussion list

# View a discussion, its comments, or replies to a comment
gh discussion view 123 --comments

# Create a discussion
gh discussion create

# Edit a discussion
gh discussion edit 123

# Comment on a discussion
gh discussion comment 123

# Reply to a comment using its URL
gh discussion comment <url>

Run gh discussion --help for more information.

[!NOTE]
The discussion command set is in preview and is subject to change without notice.

Equip your agents with new gh features

Teach your agents how to leverage new GitHub CLI features on release day by installing the gh skill:

# Install
gh skill install cli/cli gh --scope user

# Or update
gh skill update gh

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

Full Changelog: cli/cli@v2.93.0...v2.94.0

klauspost/compress (github.com/klauspost/compress)

v1.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

v1.18.7

Compare Source

  • Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

casey/just (just)

v1.55.1

Compare Source

Fixed
  • Fix panic when empty path is passed to --show and --usage (#​3511 by casey)
Misc

v1.55.0

Compare Source

Fixed
Changed
Added
Misc

v1.54.0

Compare Source

Fixed
  • Forbid duplicate attribute keys (#​3454 by casey)
  • Clear signal handler when infallible line catches signal (#​3444 by casey)
Changed
Added
Cached Recipes
Misc

v1.53.0

Compare Source

Added
Changed
Lists
Misc
protocolbuffers/protobuf (protoc)

v3.20.3: Protocol Buffers v3.20.3

Java
  • Refactoring java full runtime to reuse sub-message builders and prepare to
    migrate parsing logic from parse constructor to builder.
  • Move proto wireformat parsing functionality from the private "parsing
    constructor" to the Builder class.
  • Change the Lite runtime to prefer merging from the wireformat into mutable
    messages rather than building up a new immutable object before merging. This
    way results in fewer allocations and copy operations.
  • Make message-type extensions merge from wire-format instead of building up
    instances and merging afterwards. This has much better performance.
  • Fix TextFormat parser to build up recurring (but supposedly not repeated)
    sub-messages directly from text rather than building a new sub-message and
    merging the fully formed message into the existing field.
  • This release addresses a Security Advisory for Java users

v3.20.2: Protocol Buffers v3.20.2

C++

v3.20.1: Protocol Buffers v3.20.1

PHP
  • Fix building packaged PHP extension (#​9727)
  • Fixed composer.json to only advertise compatibility with PHP 7.0+. (#​9819)
Ruby
  • Disable the aarch64 build on macOS until it can be fixed. (#​9816)
Other
  • Fix versioning issues in 3.20.0

v3.20.0: Protocol Buffers v3.20.0

2022-03-25 version 3.20.0 (C++/Java/Python/PHP/Objective-C/C#/Ruby/JavaScript)

Ruby
  • Dropped Ruby 2.3 and 2.4 support for CI and releases. (#​9311)
  • Added Ruby 3.1 support for CI and releases (#​9566).
  • Message.decode/encode: Add recursion_limit option (#​9218/#​9486)
  • Allocate with xrealloc()/xfree() so message allocation is visible to the
    Ruby GC. In certain tests this leads to much lower memory usage due to more
    frequent GC runs (#​9586).
  • Fix conversion of singleton classes in Ruby (#​9342)
  • Suppress warning for intentional circular require (#​9556)
  • JSON will now output shorter strings for double and float fields when possible
    without losing precision.
  • Encoding and decoding of binary format will now work properly on big-endian
    systems.
  • UTF-8 verification was fixed to properly reject surrogate code points.
  • Unknown enums for proto2 protos now properly implement proto2's behavior of
    putting such values in unknown fields.
Java
  • Revert "Standardize on Array copyOf" (#​9400)
  • Resolve more java field accessor name conflicts (#​8198)
  • Don't support map fields in DynamicMessage.Builder.{getFieldBuilder,getRepeatedFieldBuilder}
  • Fix parseFrom to only throw InvalidProtocolBufferException
  • InvalidProtocolBufferException now allows arbitrary wrapped Exception types.
  • Fix bug in FieldSet.Builder.mergeFrom
  • Flush CodedOutputStream also flushes underlying OutputStream
  • When oneof case is the same and the field type is Message, merge the
    subfield. (previously it was replaced.)’
  • Add @​CheckReturnValue to some protobuf types
  • Report original exceptions when parsing JSON
  • Add more info to @​deprecated javadoc for set/get/has methods
  • Fix initialization bug in doc comment line numbers
  • Fix comments for message set wire format.
Kotlin
  • Add test scope to kotlin-test for protobuf-kotlin-lite (#​9518)
  • Add orNull extensions for optional message fields.
  • Add orNull extensions to all proto3 message fields.
Python
  • Dropped support for Python < 3.7 (#​9480)
  • Protoc is now able to generate python stubs (.pyi) with --pyi_out
  • Pin multibuild scripts to get manylinux1 wheels back (#​9216)
  • Fix type annotations of some Duration and Timestamp methods.
  • Repeated field containers are now generic in field types and could be used
    in type annotations.
    *[Breaking change] Protobuf python generated codes are simplified. Descriptors and message
    classes' definitions are now dynamic created in internal/builder.py.
    Insertion Points for messages classes are discarded.
  • has_presence is added for FieldDescriptor in python
  • Loosen indexing type requirements to allow valid index() implementations
    rather than only PyLongObjects.
  • Fix the deepcopy bug caused by not copying message_listener.
  • Added python JSON parse recursion limit (default 100)
  • Path info is added for python JSON parse errors
  • Pure python repeated scalar fields will not able to pickle. Convert to list
    first.
  • Timestamp.ToDatetime() now accepts an optional tzinfo parameter. If
    specified, the function returns a timezone-aware datetime in the given time
    zone. If omitted or None, the function returns a timezone-naive UTC datetime
    (as previously).
  • Adds client_streaming and server_streaming fields to MethodDescriptor.
  • Add "ensure_ascii" parameter to json_format.MessageToJson. This allows smaller
    JSON serializations with UTF-8 or other non-ASCII encodings.
  • Added experimental support for directly assigning numpy scalars and array.
  • Improve the calculation of public_dependencies in DescriptorPool.
  • [Breaking Change] Disallow setting fields to numpy singleton arrays or repeated fields to numpy
    multi-dimensional arrays. Numpy arrays should be indexed or flattened explicitly before assignment.
Compiler
  • Migrate IsDefault(const std::string*) and UnsafeSetDefault(const std::string*)
  • Implement strong qualified tags for TaggedPtr
  • Rework allocations to power-of-two byte sizes.
  • Migrate IsDefault(const std::string*) and UnsafeSetDefault(const std::string*)
  • Implement strong qualified tags for TaggedPtr
  • Make TaggedPtr Set...() calls explicitly spell out the content type.
  • Check for parsing error before verifying UTF8.
  • Enforce a maximum message nesting limit of 32 in the descriptor builder to
    guard against stack overflows
  • Fixed bugs in operators for RepeatedPtrIterator
  • Assert a maximum map alignment for allocated values
  • Fix proto1 group extension protodb parsing error
  • Do not log/report the same descriptor symbol multiple times if it contains
    more than one invalid character.
  • Add UnknownFieldSet::SerializeToString and SerializeToCodedStream.
  • Remove explicit default pointers and deprecated API from protocol compiler
Arenas
  • Change Repeated*Field to reuse memory when using arenas.
  • Implements pbarenaz for profiling proto arenas
  • Introduce CreateString() and CreateArenaString() for cleaner semantics
  • Fix unreferenced parameter for MSVC builds
  • Add UnsafeSetAllocated to be used for one-of string fields.
  • Make Arena::AllocateAligned() a public function.
  • Determine if ArenaDtor related code generation is necessary in one place.
  • Implement on demand register ArenaDtor for InlinedStringField
C++
  • Enable testing via CTest (#​8737)
  • Add option to use external GTest in CMake (#​8736)
  • CMake: Set correct sonames for libprotobuf-lite.so and libprotoc.so (#​8635) (#​9529)
  • Add cmake option protobuf_INSTALL to not install files (#​7123)
  • CMake: Allow custom plugin options e.g. to generate mocks (#​9105)
  • CMake: Use linker version scripts (#​9545)
  • Manually *struct Cord fields to work better with arenas.
  • Manually destruct map fields.
  • Generate narrower code
  • Fix #​9378 by removing
    shadowed cached_size field
  • Remove GetPointer() and explicit nullptr defaults.
  • Add proto_h flag for speeding up large builds
  • Add missing overload for reference wrapped fields.
  • Add MergedDescriptorDatabase::FindAllFileNames()
  • RepeatedField now defines an iterator type instead of using a pointer.
  • Remove obsolete macros GOOGLE_PROTOBUF_HAS_ONEOF and GOOGLE_PROTOBUF_HAS_ARENAS.
PHP
  • Fix: add missing reserved classnames (#​9458)
  • PHP 8.1 compatibility (#​9370)
C#
  • Fix trim warnings (#​9182)
  • Fixes NullReferenceException when accessing FieldDescriptor.IsPacked (#​9430)
  • Add ToProto() method to all descriptor classes (#​9426)
  • Add an option to preserve proto names in JsonFormatter (#​6307)
Objective-C
  • Add prefix_to_proto_package_mappings_path option. (#​9498)
  • Rename proto_package_to_prefix_mappings_path to package_to_prefix_mappings_path. (#​9552)
  • Add a generation option to control use of forward declarations in headers. (#​9568)

v3.19.4: Protocol Buffers v3.19.4

Python
Ruby
  • Fixed a data loss bug that could occur when the number of optional fields in a message is an exact multiple of 32. (#​9440).
PHP
  • Fixed a data loss bug that could occur when the number of optional fields in a message is an exact multiple of 32. (#​9440).

v3.19.3: Protocol Buffers v3.19.3

Python
  • Fix missing Windows wheel for Python 3.10 on PyPI

v3.19.2: Protocol Buffers v3.19.2

Java

v3.19.1: Protocol Buffers v3.19.1

Bazel
  • Ensure that release archives contain everything needed for Bazel (#​9131)
  • Align dependency handling with Bazel best practices (#​9165)
JavaScript
  • Fix ReferenceError: window is not defined when getting the global object (#​9156)
Ruby
  • Fix memory leak in MessageClass.encode (#​9150)

v3.19.0: Protocol Buffers v3.19.0

C++
  • Make proto2::Message::DiscardUnknownFields() non-virtual
  • Separate RepeatedPtrField into its own header file
  • For default floating point values of 0, consider all bits significant
  • cmake: support MSVC_RUNTIME_LIBRARY property (#​8851)
  • Fix shadowing warnings (#​8926)
  • Fix for issue #​8484, constant initialization doesn't compile in msvc clang-cl environment (#​8993)
  • Fix build on AIX and SunOS (#​8373) (#​9065)
  • Add Android stlport and default toolchains to BUILD. (#​8290)
Java
  • For default floating point values of 0, consider all bits significant
  • Annotate //java/com/google/protobuf/util/... with nullness annotations
  • Use ArrayList copy constructor ([#​7853](https://redirect.github.com/protocolb

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: from: protoc-3.7.1, to: protoc-3.20.3
Bootstrapping /home/ubuntu/.cache/hermit/pkg/hermit@stable/hermit from https://github.com/cashapp/hermit/releases/download/stable
Creating /home/ubuntu/.cache/hermit/pkg/hermit@stable
Downloading https://github.com/cashapp/hermit/releases/download/stable/hermit-linux-amd64.gz to /home/ubuntu/.cache/hermit/pkg/hermit@stable/hermit
Hermit installed as /home/ubuntu/.cache/hermit/pkg/hermit@stable/hermit
Found Hermit in /home/ubuntu/bin/hermit but it is a different distribution, not overwriting.
Hermit is installed as /home/ubuntu/bin/hermit-stable

See https://cashapp.github.io/hermit/usage/get-started/ for more information.

error:file:///#PWD/../packages/.git: Cloning into '/home/ubuntu/.cache/hermit/sources/f20ea07710435d2335a6d24aca10db13a814bfe509d2a70211a13b2c57bd5690-2020108749'...
fatal: '/#PWD/../packages/.git' does not appear to be a git repository
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

fatal:hermit: git sync failed: git clone --depth=1 file:///#PWD/../packages/.git /home/ubuntu/.cache/hermit/sources/f20ea07710435d2335a6d24aca10db13a814bfe509d2a70211a13b2c57bd5690-2020108749 failed: exit status 128

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from abb38c8 to b8bbec1 Compare June 24, 2026 05:04
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 7ea0b1b to 70db5a9 Compare July 1, 2026 22:35
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 70db5a9 to ce7b5a4 Compare July 3, 2026 04:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants