Skip to content

fix(deps): update all dependencies #984

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update all dependencies #984

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 15, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/checkout action major v4 -> v5 age confidence
actions/download-artifact action major v4 -> v5 age confidence
actions/setup-java action major v4 -> v5 age confidence
apple_support bazel_dep minor 1.23.1 -> 1.24.1 age confidence
bazel major 7.6.2 -> 8.4.2 age confidence
bazel_jar_jar bazel_dep patch 0.1.0 -> 0.1.11 age confidence
contrib_rules_jvm bazel_dep minor 0.27.0 -> 0.30.0 age confidence
protobuf bazel_dep major 32.1 -> 33.0 age confidence
softprops/action-gh-release action minor v2.0.9 -> v2.4.1 age confidence
toolchains_llvm bazel_dep major 0.10.3 -> 1.5.0 age confidence
ubuntu github-runner major 22.04 -> 24.04 age confidence
org.jacoco:jacoco-maven-plugin (source) build patch 0.8.11 -> 0.8.14 age confidence
com.code-intelligence:cifuzz-maven-extension (source) build minor 1.7.0 -> 1.15.0 age confidence
com.google.protobuf:protobuf-java (source) compile major 3.25.5 -> 4.33.0 age confidence
com.google.truth:truth test patch 1.4.0 -> 1.4.5 age confidence
org.junit.platform:junit-platform-launcher (source) test major 1.10.2 -> 6.0.0 age confidence
org.junit.platform:junit-platform-commons (source) test major 1.10.2 -> 6.0.0 age confidence
org.junit.jupiter:junit-jupiter-params (source) test major 5.10.2 -> 6.0.0 age confidence
org.junit.jupiter:junit-jupiter-api (source) test major 5.10.2 -> 6.0.0 age confidence
org.junit.jupiter:junit-jupiter-engine (source) test major 5.10.2 -> 6.0.0 age confidence

Release Notes

actions/checkout (actions/checkout)

v5

Compare Source

actions/download-artifact (actions/download-artifact)

v5

Compare Source

actions/setup-java (actions/setup-java)

v5

Compare Source

bazelbuild/apple_support (apple_support)

v1.24.1

Compare Source

What's Changed

Full Changelog: bazelbuild/apple_support@1.24.0...1.24.1

This release is compatible with 7.x LTS, 8.x LTS, and rolling releases.

MODULE.bazel Snippet
bazel_dep(name = "apple_support", version = "1.24.1", repo_name = "build_bazel_apple_support")
Workspace Snippet
load("@​bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "build_bazel_apple_support",
    sha256 = "a270f034007ab6111645d27a8ed88b47ce2a75b608af633eeca889cb5e07ae0d",
    url = "https://github.com/bazelbuild/apple_support/releases/download/1.24.1/apple_support.1.24.1.tar.gz",
)

load(
    "@​build_bazel_apple_support//lib:repositories.bzl",
    "apple_support_dependencies",
)

apple_support_dependencies()

load("@​bazel_features//:deps.bzl", "bazel_features_deps")

bazel_features_deps()

v1.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: bazelbuild/apple_support@1.23.1...1.24.0

This release is compatible with 7.x LTS, 8.x LTS, and rolling releases.

MODULE.bazel Snippet
bazel_dep(name = "apple_support", version = "1.24.0", repo_name = "build_bazel_apple_support")
Workspace Snippet
load("@​bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "build_bazel_apple_support",
    sha256 = "69b3f650e909df177ab157c26fd253396b15628f9775f037603fb9c3e6da7ad3",
    url = "https://github.com/bazelbuild/apple_support/releases/download/1.24.0/apple_support.1.24.0.tar.gz",
)

load(
    "@​build_bazel_apple_support//lib:repositories.bzl",
    "apple_support_dependencies",
)

apple_support_dependencies()

load("@​bazel_features//:deps.bzl", "bazel_features_deps")

bazel_features_deps()
bazelbuild/bazel (bazel)

v8.4.2

Compare Source


Release Notes:

v8.4.1

Compare Source


Release Notes:

v8.4.0

Compare Source


Release Notes:

v8.3.1

Compare Source

[!NOTE]
If you are looking for rolling releases, please visit this page.

Release 8.3.1 (2025-06-30)

Bazel 8.3.1 is a patch LTS release. It is fully backward compatible with Bazel 8.0 and contains selected changes by the Bazel community and Google engineers.

  • Removed the "overwrote runfiles" warning related to rules_shell. (#​26374)
  • Reverted the change to move the Bash runfiles library out of Bazel. This will be delayed until 9.0. (#​26372)
  • Fixed hang with force fetching + repo contents cache (#​26412)

Refer to the full list of commits for more details.

Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.

Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.

Security: All our binaries are signed with our public key 3D5919B.

v8.3.0

Compare Source


Release Notes:

v8.2.1

Compare Source


Release Notes:

v8.2.0

Compare Source


Release Notes:

v8.1.1

Compare Source


Release Notes:

v8.1.0

Compare Source


Release Notes:

v8.0.1

Compare Source


Release Notes:

v8.0.0

Compare Source


Release Notes:
bazeltools/bazel_jar_jar (bazel_jar_jar)

v0.1.11

Using Bzlmod

  1. Enable with common --enable_bzlmod in .bazelrc (default with Bazel 7).
  2. Add to your MODULE.bazel file:
bazel_dep(name = "bazel_jar_jar", version = "0.1.11")

Using WORKSPACE

Paste this snippet into your WORKSPACE.bazel file:

load("@​bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "bazel_jar_jar",
    sha256 = "7a7d1c8cdd139864c55b1a09a76f92c4fdd2de0b5ccfd6137423006e2cfb2ed1",
    strip_prefix = "bazel_jar_jar-0.1.11",
    url = "https://github.com/bazeltools/bazel_jar_jar/releases/download/v0.1.11/bazel_jar_jar-v0.1.11.tar.gz",
)

load(
    "@​com_github_johnynek_bazel_jar_jar//:jar_jar.bzl",
    "jar_jar_repositories",
)

jar_jar_repositories()

What's Changed

Full Changelog: bazeltools/bazel_jar_jar@v0.1.10...v0.1.11

v0.1.10

Using Bzlmod

  1. Enable with common --enable_bzlmod in .bazelrc (default with Bazel 7).
  2. Add to your MODULE.bazel file:
bazel_dep(name = "bazel_jar_jar", version = "0.1.10")

Using WORKSPACE

Paste this snippet into your WORKSPACE.bazel file:

load("@​bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "bazel_jar_jar",
    sha256 = "d729fa86d4a443b5ab2b47eee560f5325940ff5977c2cddf32e671b582514f91",
    strip_prefix = "bazel_jar_jar-0.1.10",
    url = "https://github.com/bazeltools/bazel_jar_jar/releases/download/v0.1.10/bazel_jar_jar-v0.1.10.tar.gz",
)

load(
    "@​com_github_johnynek_bazel_jar_jar//:jar_jar.bzl",
    "jar_jar_repositories",
)

jar_jar_repositories()

What's Changed

Behind the scenes

New Contributors

Full Changelog: bazeltools/bazel_jar_jar@v0.1.6...v0.1.10

v0.1.7

Using Bzlmod

  1. Enable with common --enable_bzlmod in .bazelrc (default with Bazel 7).
  2. Add to your MODULE.bazel file:
bazel_dep(name = "bazel_jar_jar", version = "0.1.7")

Using WORKSPACE

Paste this snippet into your WORKSPACE.bazel file:

load("@​bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "bazel_jar_jar",
    sha256 = "d2159f2397b93f9e0de73dcc15d03277da5fab73fc789b3ea23edbd5f018b901",
    strip_prefix = "bazel_jar_jar-0.1.7",
    url = "https://github.com/bazeltools/bazel_jar_jar/releases/download/v0.1.7/bazel_jar_jar-v0.1.7.tar.gz",
)

load(
    "@​com_github_johnynek_bazel_jar_jar//:jar_jar.bzl",
    "jar_jar_repositories",
)

jar_jar_repositories()

What's Changed

New Contributors

Full Changelog: bazeltools/bazel_jar_jar@v0.1.6...v0.1.7

v0.1.5: 0.1.5

0.1.1 failed to publish to BCR, 0.1.5 is identical to 0.1.1.

Using Bzlmod

  1. Enable with common --enable_bzlmod in .bazelrc (default with Bazel 7).
  2. Add to your MODULE.bazel file:
bazel_dep(name = "bazel_jar_jar", version = "0.1.5")

Using WORKSPACE

Paste this snippet into your WORKSPACE.bazel file:

load("@​bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "bazel_jar_jar",
    sha256 = "a9d2ca9a2e9014f8d63dcbe9091bcb9f2d2929b3b7d16836c6225e98f9ca54df",
    strip_prefix = "bazel_jar_jar-0.1.5",
    url = "https://github.com/bazeltools/bazel_jar_jar/releases/download/v0.1.5/bazel_jar_jar-v0.1.5.tar.gz",
)

load(
    "@​com_github_johnynek_bazel_jar_jar//:jar_jar.bzl",
    "jar_jar_repositories",
)

jar_jar_repositories()

What's Changed

Behind the scenes

New Contributors

Full Changelog: bazeltools/bazel_jar_jar@v0.1.0...v0.1.5

bazel-contrib/rules_jvm (contrib_rules_jvm)

v0.30.0

contrib_rules_jvm only supports bzlmod-enabled builds

Module Setup

In your MODULE.bazel:

bazel_dep(name = "contrib_rules_jvm", version = "0.30.0")

Important Changes

  • This release changes how the JUnit5 runner reports test names to better support parameterised and other custom tests.
  • The java gazelle plugin will now respect java_export targets. Targets will depend on these rather than individual constituent java_library targets to ensure that each java_library target is only included in one java_export

What's Changed

New Contributors

Full Changelog: bazel-contrib/rules_jvm@v0.29.0...v0.30.0

v0.29.0

WORKSPACE snippet:

load("@​bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
    name = "contrib_rules_jvm",
    sha256 = "44c4946567adb9f7218b1eea7ad512e0af7189f66673c3ebe94b484ac5c246a7",
    strip_prefix = "rules_jvm-0.29.0",
    url = "https://github.com/bazel-contrib/rules_jvm/releases/download/v0.29.0/rules_jvm-v0.29.0.tar.gz",
)

### Fetches the contrib_rules_jvm dependencies.
### If you want to have a different version of some dependency,

### you should fetch it *before* calling this.
load("@​contrib_rules_jvm//:repositories.bzl", "contrib_rules_jvm_deps")

contrib_rules_jvm_deps()

### Now ensure that the downloaded deps are properly configured
load("@​contrib_rules_jvm//:setup.bzl", "contrib_rules_jvm_setup")

contrib_rules_jvm_setup()

What's Changed

New Contributors

Full Changelog: bazel-contrib/rules_jvm@v0.28.0...v0.29.0

v0.28.0

contrib_rules_jvm only supports bzlmod-enabled builds

Module setup

In your MODULE.bazel

bazel_dep(name = "contrib_rules_jvm", version = "0.28.0")

What's Changed

  • Drop support for workspace-based builds (#​321)
  • Bump lowest supported Java version to 8 in our build files (#​307)
  • Allow passing empty 'package' to 'java_test_suite' (#​312)
  • Add support for @​AfterAll in XML report (#​300)
  • Bump pmd to 7.7.0 (#​309)
  • Add support for transforming Checkstyle XML output to JUnit XML (#​283)
  • Optimize junit dependencies for each test target (#​303)
  • Gazelle: detect any directory with /test in path as test package (#​297)
  • Add timestamp and hostname to testsuite xml (#​294)
  • Escape invalid XML chars in testCase and testSuite names (#​284)

Full Changelog: bazel-contrib/rules_jvm@v0.27.0...v0.28.0

protocolbuffers/protobuf (protobuf)

v33.0: Protocol Buffers v33.0

Announcements

  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Bazel

Compiler

  • Disable symbol visibility enforcement by default in C++ runtime (ae308fc)
  • Ship all option dependencies to plugins along with regular ones. (abeb130)

C++

  • Avoid calling deprecated arena-enabled constructors in arena.h. (813a7ef)
  • Add a macro to make RepeatedField(Arena*) constructor private in a future release. (768db14)
  • Add a macro to make Map(Arena*) constructor private in a future release. (543a17f)
  • Optimize ReadPackedVarint (3d94d83)
  • Add a macro to make RepeatedPtrField(Arena*) constructor private in a future release (6422b9d)
  • Add IsEmpty() function to reflection. (b64e490)
  • Refactor RuntimeAssertInBounds to remove repeated logic and make Get/Mutable easier to read. (2f270c4)
  • Disable symbol visibility enforcement by default in C++ runtime (ae308fc)
  • Fix a bug in the main C++ JSON parser/serializer camelcasing of certain non-style-compliant names incorrectly, in a way that would prevent it from interoperating with any other implementation on those fields. (e25e267)
  • Fail early for messages with more than 65k fields. (90824aa)
  • Add option to C++ JSON Parser/Serializer to allow customers to affirmatively disable legacy bug-compatibilty behaviors. (6ea1640)
  • Fix mishandling on JSON serialization of Timestamp with invalid negative and too-large nanos value. (a959f27)
  • Preserve features in type resolver (c7030f4)
  • Add a DCHECK that ArenaStringPtr::Set(char*, Arena*) is not called with (95b1763)

Java

Restored compatibility of runtime with gencode created with protoc <3.21

With this release, compatibility of the runtime with older gencode down to 3.0.0 is restored, compared to the previous support minimum of gencode created with 3.22+. Note that it is still strongly recommended to regenerate your gencode with a newer protoc and to avoid using gencode which was created with an old protoc.

Generated code from this range is covered by CVE-2022-3171 and is potentially vulnerable to a Denial of Service risk.

JavaProto 4.x previously dropped compatibility with the potentially vulnerable generated code, having the behavior of:

  • The vulnerable generated code was source-incompatible with new runtime (would not compile when built from source)
  • The vulnerable generated code was ABI-incompatible with new runtime (when using a .class file compiled against old runtime, a NoSuchMethodException would be thrown at parse time).

Starting with this release:

  • The vulnerable generated code is now source-compatible (will compile).
  • The first time each potentially vulnerable type is parsed, an error message will be logged noting that potentially vulnerable generated code is in use and the name of the corresponding type.
  • Environment variables may be set to either throw an exception instead (-Dcom.google.protobuf.error_on_unsafe_pre22_gencode) or to entirely silence the logged messages (-Dcom.google.protobuf.use_unsafe_pre22_gencode)

This change was made based on community feedback regarding the difficulty in identifying and quickly remediating stale gencode in their transitive dependencies weighed against a careful evaluation of the realistic risk exposure of DoS (with no risk of other concerns including information leak or RCE).

We strongly recommend that any users who observe the log messages to regenerate the corresponding code with a newer protoc. We recommend that any security-conscious services opt into the error_on_unsafe_pre22_gencode behavior to preclude any risk of a Denial of Service surface area being exposed.

A future 4.x release may flip the default behavior to error by default as a measure to further help the ecosystem avoid the Denial of Service risks, while still maintaining the ability to opt into continuing to use insecure gencode for users who are parsing trusted inputs and where the difficulty of regenerating is high.

Changes

  • Switch the pre22 warning to use CopyOnWriteArraySet. (#​23969) (e55224c)
  • Expose helpers for checking if messages and enums are nested. (8de4002)
  • Fix a bug calculating the file name in the absense of directories. (c4ff7a6)
  • Clarify the public APIs of GeneratorNames helpers. (537ac35)
  • Expose helpers to predict generated class names in java. (eba6df2)
  • Deprecate ClassName methods in favor of new QualifiedClassName ones. (ca4fb2f)
  • Restore the 3-argument internalBuildGeneratedFileFrom. (4376591)
  • Fix large java enums not being honored on lite runtime. (a995803)
  • Slightly relax Java Poison Pill on prerelease versions (-rc1, -dev, etc). (7b0bee3)
  • Avoid boxing/unboxing varint, fixed32, and fixed64 fields in UnknownFieldSet.Field (810272f)
  • Readd new*List() methods on GeneratedMessageV3. (badaf41)
  • Add Values.of(Map<String, Value> values). (c518f25)
  • Fix handling of optional dependencies in java generator. (8d51e34)
  • Restore ABI compatibility for extension methods which was previously (knowingly) broken with 4.x: 94a2a44 (ea33ae8)
  • Restore Protobuf Java extension modifiers in gencode that were previously removed in 7bff169 (f2257f5)
  • Ship all option dependencies to plugins along with regular ones. (abeb130)
  • Optimize redaction state calculation (e05db5c)
  • Add isPlaceholder() accessors to file, message, and enum descriptors (f978ec2)
  • Improve Java gencode static initialization to avoid unnecessary temporaries again (745e15b)
  • Improve Java gencode static initialization to avoid unnecessary temporaries (b68b673)
  • Remove protobuf-util usages of guava except annotations. (5768acd)
  • Restore compatibility of runtime with pre-3.22.x gencode impacted by CVE-2022-3171 (7c51e5b)
  • Expose an iterator for GeneratedMessage.ExtendableMessage.extensions (b25d39e)

Rust

  • Change Rust prelude to bring in traits as _ (c3f7e8d)
  • Make message Muts Send (8bff944)
  • See also UPB changes below, which may affect Rust.

Python

  • Publish s390x wheels for Python/upb. (56b2b89)
  • Fix a crash that happens during shutdown due to looking up modules in the cache (d57d270)
  • Add construction support for repeated Timestamp/Duration/Struct/ListValue. (5f6c013)
  • Fix handling of repeated extension fields in PyProto JSON (07ef676)
  • Fixed a parser bug where closed enums are parsed incorrectly for non-repeated extensions. (c36f728)
  • Fixed mypy errors by setting __slots__ to empty in .pyi files. (38ca2d3)
  • Raise warnings for float_precision from python json_format. (4659cd7)
  • Raise warnings when assign bool to int/enum field in Python Proto. This will turn into error in 34.0 release. (4ee55d7)

PHP

UPB (Python/PHP/Ruby C-Extension)

  • Fixed a parser bug where closed enums are parsed incorrectly for non-repeated extensions. (c36f728)

Other

  • Update token for BCR release to reuse existing BOT_ACCESS_TOKEN used for staleness_refresh.yml and update_php_repo.yml (#​23925) (dcace2f)
  • Use the 'better' JSON parser on the conformance suite harness. (4b4e405)
  • Add JSON conformance test that a single value provided for a repeated field should parse fail. (9806994)
  • Add conformance test cases for malformed nanos fields on Durations and Timestamps. (a6bdd0a)
softprops/action-gh-release (softprops/action-gh-release)

v2.4.1

Compare Source

What's Changed

Other Changes 🔄
  • fix(util): support brace expansion globs containing commas in parseInputFiles by @​Copilot in #​672
  • fix: gracefully fallback to body when body_path cannot be read by @​Copilot in #​671

Full Changelog: softprops/action-gh-release@v2...v2.4.1

v2.4.0

Compare Source

What's Changed

Exciting New Features 🎉
Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2.3.4...v2.4.0

v2.3.4

Compare Source

What's Changed

Bug fixes 🐛
Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.3.4

v2.3.3

Compare Source

What's Changed

Exciting New Features 🎉
Other Changes 🔄
  • dependency updates

New Contributors

Full Changelog: softprops/action-gh-release@v2...v2.3.3

v2.3.2

Compare Source

  • fix: revert fs readableWebStream change

v2.3.1

Compare Source

What's Changed

Bug fixes 🐛

New Contributors

Full Changelog: softprops/action-gh-release@v2.3.0...v2.3.1

v2.3.0

Compare Source

  • Migrate from jest to vitest
  • Replace mime with mime-types
  • Bump to use node 24
  • Dependency updates

Full Changelog: softprops/action-gh-release@v2.2.2...v2.3.0

v2.2.2

Compare Source

What's Changed

Bug fixes 🐛
Other Changes 🔄

New Contributors

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/all branch 10 times, most recently from da526a2 to d3e5dc1 Compare October 17, 2025 12:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants