Skip to content

chore(deps): update proto dependencies bump - #17

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/proto-dependencies-bump
Open

chore(deps): update proto dependencies bump#17
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/proto-dependencies-bump

Conversation

@renovate

@renovate renovate Bot commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change Age Confidence
bun minor 1.3.14 → 1.4.2 age confidence
deno patch 2.9.4 → 2.9.7 age confidence
go minor 1.26.5 → 1.27.1 age confidence
node (source) minor 26.5.0 → 26.10.0 age confidence
pnpm (source) minor 11.17.0 → 11.28.3 age confidence
proto minor 0.59.0 → 0.62.3 age confidence
python patch 3.14.6 → 3.14.8 age confidence
rust (source, changelog) minor 1.97.1 → 1.99.0 age confidence
uv minor 0.11.33 → 0.12.22 age confidence

Release Notes

oven-sh/bun (bun)

v1.4.2: Bun v1.4.2

Compare Source

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade
Read Bun v1.4.2's release notes on Bun's blog
Thanks to 3 contributors!

v1.4.1: Bun v1.4.1

Compare Source

To install Bun v1.4.1

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.1:

bun upgrade
Read Bun v1.4.1's release notes on Bun's blog
Thanks to 7 contributors!

v1.4.0: Bun v1.4

Compare Source

To install Bun v1.4

curl -fsSL https://bun.com/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.0:

bun upgrade

Read the blog post: image (1)

Thank you

Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3.

denoland/deno (deno)

v2.9.7

Compare Source

  • fix(audit): honor configured CA stores (#​36728)
  • fix(cache): make HTTP authority paths unambiguous (#​36356)
  • fix(cli): accept all valid sys permission descriptors (#​36753)
  • fix(cli): don't duplicate passthrough args for deno deploy/sandbox (#​36722)
  • fix(cli): generate valid bash completions (#​36736)
  • fix(cli): preserve double dash before the entrypoint (#​36835)
  • fix(cli): restore optional-value semantics for deno bundle --sourcemap
    (#​36723)
  • fix(completions): keep the dash on short flags in zsh completions (#​36720)
  • fix(desktop): complete deferred window close and fix NAPI symbol export on
    Linux (#​36718)
  • fix(ext/http): extract traceparent from Deno.serve regardless of header name
    case (#​36840)
  • fix(ext/node): allow repeated child process signals (#​36644)
  • fix(ext/node): check resolved IP against net deny list in tcp_wrap bind
    (#​36482)
  • fix(ext/node): don't panic on prime sizes below 2 bits (#​36400)
  • fix(ext/node): improve node:dns error codes and lookupService/setLocalAddress
    compat (#​36552)
  • fix(ext/node): normalize resourceUsage maxRSS on macOS (#​36784)
  • fix(install): validate lockfile tarball registry paths (#​36473)
  • fix(lsp): resolve the newest prerelease of jsr packages that have no stable
    release (#​36655)
  • fix(net): check permissions for multicast membership (#​36529)
  • fix(node): align IncomingMessage header map prototypes (#​36438)
  • fix(node): preserve AsyncLocalStorage exit context (#​36464)
  • fix(npm): correct the pnpm lockfile import against real-world lockfiles
    (#​36727)
  • fix(npm): validate lockfile tarball origins (#​36430)
  • fix(permissions): fold unix socket paths for case-insensitive filesystems
    (#​36553)
  • fix(permissions): parse unix: net rules as POSIX paths (#​36785)
  • fix(process): clear supplementary groups before changing identity (#​36433)
  • fix(sqlite): refuse symlink database paths (#​36357)
  • fix(transpile): don't report diagnostics from bundled assets in declaration
    emit (#​36716)
  • fix(web): avoid flushing compression streams on every write (#​36744)
  • fix: add missing property desktop.app.identifier (#​36774)
  • fix: hash source contents for V8 code cache (#​36743)
  • fix: point JSON schema $id values at the maintained GitHub raw endpoint
    (#​36747)
  • fix: toplevel fetch/cron leak its spans (#​36757)
  • fix: validate --ignore-scripts package selectors (#​36742)
  • perf(core): drop dead module-graph retention (#​36683)
  • perf(core): make extension op tables const in static memory (#​36696)
  • perf(core): split OpCtx into shared OpCommonCtx + borrowed op declarations
    (#​36693)
  • perf(ext/node): Buffer hex paths via native Uint8Array toHex/setFromHex
    (#​36531)

v2.9.6

Compare Source

  • feat(compressible): add support for 'text/x-component' content type (#​36450)
  • feat(desktop): clipboard api (#​35750)
  • feat(desktop): support checked, icon, and tooltip on menu items (#​36649)
  • fix(bundle): isolate esbuild downloads from workspace registries (#​36467)
  • fix(cache): combine duplicate headers for Vary matching (#​36476)
  • fix(cli_parser): remove orphaned sync-types parser
  • fix(core): cap adaptive buffer initial allocations (#​36432)
  • fix(core): make Unix pipe fd ownership explicit (#​36353)
  • fix(core): make user timer waker state thread-safe (#​36495)
  • fix(coverage): compare a range against a line in V8's units (#​36613)
  • fix(crypto): preserve RSA-OAEP label bytes (#​36441)
  • fix(desktop): keep dots in the app name when resolving the runtime library
    (#​36006)
  • fix(desktop): keep the macOS bundle signature valid unless an update is
    applied (#​36574)
  • fix(desktop): never block the JS thread on the error-report dialog (#​36575)
  • fix(desktop): propagate deno.json version and license into packaged installers
    (#​36577)
  • fix(desktop): run Vite-based HMR dev servers inside the desktop runtime
    (#​36488)
  • fix(desktop): transport binding args and results as DesktopValue so Uint8Array
    survives (#​36573)
  • fix(ext/fetch): enforce permissions for proxy transports (#​36217)
  • fix(ext/fetch): only retry transport errors on pooled connections (#​36415)
  • fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB
    (#​36558)
  • fix(ext/http): keep request body readable after response is sent (#​36629)
  • fix(ext/http): route invalid async responses to onError (#​36437)
  • fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#​36556)
  • fix(ext/napi): run JS-calling finalizers safely, NULL string result, and
    Float16Array (#​36572)
  • fix(ext/napi): surface OS error and path on addon load failure (#​36630)
  • fix(ext/napi): track pending finalizers by identity (#​36551)
  • fix(ext/napi): wake the event loop at the next uv_timer deadline (#​36559)
  • fix(ext/net): skip unsupported DNS records in ANY queries (#​36650)
  • fix(ext/node): accept string ports in dns.lookupService (#​36546)
  • fix(ext/node): build the proxied request target with the URL parser (#​36557)
  • fix(ext/node): do not resume client TLS sessions unless requested (#​36592)
  • fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#​36407)
  • fix(ext/node): handle readv short reads (#​36211)
  • fix(ext/node): require sys permission for inspector.open (#​36465)
  • fix(ext/node_sqlite): invalidate sessions on database close (#​36633)
  • fix(ext/tls): avoid panic for mismatched client certificate and key (#​36457)
  • fix(ext/web): clean up abort handlers when listeners are removed (#​36226)
  • fix(ext/web): close transfer MessagePort when a transferred readable is
    cancelled (#​36270)
  • fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode()
    (#​36611)
  • fix(fetch): require an initial multipart boundary (#​36470)
  • fix(ffi): validate struct return buffers (#​36373)
  • fix(fmt): honor .editorconfig when formatting from stdin (#​36267)
  • fix(fs): require write permission for creating opens (#​36497)
  • fix(fs): use a private FsFile constructor token (#​36439)
  • fix(glob): retain valid gitignore rules after parse errors (#​36478)
  • fix(http): preserve keep-alive after reading request body (#​36690)
  • fix(http): truncate streaming responses to content length (#​36496)
  • fix(lsp): restrict registry completion endpoint schemes (#​36477)
  • fix(node): check reads during require resolution (#​36461)
  • fix(node): match domain uncaught exception handling (#​36475)
  • fix(node): preserve v8 deserializer view offsets (#​36460)
  • fix(node): validate Brotli encoder operations (#​36530)
  • fix(node): validate raw outgoing HTTP headers (#​36471)
  • fix(node/crypto): preserve binary key export passphrases (#​36443)
  • fix(node_crypto): apply RFC 7748 scalar decoding for X448 (#​36466)
  • fix(node_crypto): size cipher updates by byte length (#​36459)
  • fix(node_shim): preserve explicit argument delimiters (#​36435)
  • fix(npm): flatten single-resolution peers when building package ids (#​36608)
  • fix(npm): match peer fallbacks when checking peer resolution cache (#​36607)
  • fix(npm): remove arrayref dependency (#​36653)
  • fix(npm): resolve bare npm specifier when latest is too new for min dependency
    age (#​36619)
  • fix(npm): use cached abbreviated metadata under --cached-only (#​36526)
  • fix(npm): validate tar paths before extraction (#​36468)
  • fix(os): serialize process environment updates (#​36074)
  • fix(permissions): check resolved IP against import deny list (#​36486)
  • fix(process): reject NULs in Windows arguments (#​36436)
  • fix(process): validate whitespace-only loader environment values (#​36431)
  • fix(publish): authenticate the package existence check so private packages
    work (#​36656)
  • fix(publish): memoize publish order depth (#​36215)
  • fix(publish): reject invalid JSR package names (#​36474)
  • fix(repl): skip regex literals when validating input (#​36375)
  • fix(runtime): unregister dropped signal resources (#​36213)
  • fix(web): keep MessagePort resource identifiers private (#​36440)
  • fix: bugs in primordials related to ObjectCreate and
    ObjectDefineProperties (#​36541)
  • fix: prevent threadpool starvation with concurrent file locks (#​32789)
  • perf(core): grow the op driver's future arena on demand (#​36678)
  • perf(core): uncontended-borrow fast path for AsyncRefCell (#​36679)
  • perf(core): use index-based SafeArrayIterator in primordials (#​36543)
  • perf(core): zero-copy snapshot rehydration, drop bincode (#​36680)
  • perf(ext/web): apply the base64url op design to standard base64 (#​36422)
  • perf(ext/websocket): shrink the op_ws_create future (#​36681)

v2.9.5

Compare Source

  • feat(add): --unscoped flag to alias packages by their unscoped name (#​36319)
  • feat(task): add --members flag to run tasks in workspace members only (#​35748)
  • feat: add Blob/Body textStream() (#​35616)
  • feat: add experimental QuickJS backend (#​36194)
  • fix(bundle): avoid esbuild protocol deadlock (#​36427)
  • fix(bundle): respect runtime file permissions (#​36107)
  • fix(cjs): use loader sources for recursive analysis (#​36111)
  • fix(cli): escape control characters in external metadata (#​36198)
  • fix(core): don't resolve internal module imports with the user's import map
    (#​36303)
  • fix(crypto): add "raw-secret" to KeyFormat type (#​35708)
  • fix(desktop): handle colored HMR URLs and page loads (#​36316)
  • fix(desktop): retain update signature verification op (#​36152)
  • fix(ext/crypto): allow deriveBits with length 0 (#​36283)
  • fix(ext/napi): polyfill uv_handle_size and uv_strerror (#​36308)
  • fix(ext/net): release completed QUIC stream resources (#​36247)
  • fix(ext/net): require --allow-sys for node:dns.getServers() (#​35941)
  • fix(ext/node): Node compat for web streams (#​36285)
  • fix(ext/node): apply backpressure in Readable.toWeb() (#​36321)
  • fix(ext/node): defer TLS write completion callback to avoid reentrancy panic
    (#​35867)
  • fix(ext/node): don't fire http2 settings callback after session destroy
    (#​36230)
  • fix(ext/node): gate constrained memory cgroup reads (#​36218)
  • fix(ext/node): handle pre-quoted shell arguments (#​36371)
  • fix(ext/node): implement node:test tags (#​36292)
  • fix(ext/node): implement util.diff (#​36289)
  • fix(ext/node): implement v8.promiseHooks API (#​36281)
  • fix(ext/node): sort fs.readdir entries to match Node.js (#​36341)
  • fix(ext/node): stop http2 file reads after stream close (#​36300)
  • fix(ext/node): store blocklist ranges compactly (#​36212)
  • fix(ext/node): support the fs flush option for writes (#​36290)
  • fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify (#​36326)
  • fix(ext/node_crypto): use named group exponent sizes (#​36347)
  • fix(ext/web): attach Node error codes to WHATWG API validation errors (#​36288)
  • fix(ext/websocket): disable HTTP/2 server push on wss upgrade path (#​36327)
  • fix(fetch): scope redirect-sensitive headers by origin (#​36361)
  • fix(ffi): reject resizable buffers in nonblocking calls (#​36259)
  • fix(fmt): accept xml and svg extensions for stdin (#​36149)
  • fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 (#​36397)
  • fix(http): preserve stripped headers across redirects (#​36360)
  • fix(inspector): validate request host headers (#​36348)
  • fix(net): cancel pending writes on stream close (#​36369)
  • fix(net): clean up concurrently dropped load-balanced listeners (#​36246)
  • fix(net): handle malformed DNS record text (#​36374)
  • fix(node): clean up Web Stream finished listeners (#​36227)
  • fix(node): retain consumed HTTP stream wrapper (#​36254)
  • fix(npm): ignore invalid package bin targets (#​36354)
  • fix(npm): tolerate malformed scripts field in packuments (#​36324)
  • fix(npmrc): match auth configs by authority and path (#​36359)
  • fix(outdated): don't report JSR pre-release versions as latest (#​36325)
  • fix(publish): report when the registry rejects a provenance attestation
    (#​36404)
  • fix(resolver): don't treat deno eval modules as npm package files (#​36304)
  • fix(runtime): map notify's Windows missing-path error to NotFound (#​35864)
  • fix(sync-types): add reason to too_many_arguments allows (lint)
  • fix(telemetry): handle reentrant attribute conversion (#​36256)
  • fix(webgpu): own mapped range backing stores (#​36257)
  • fix(webstorage): preserve Storage constructor name (#​35944)
  • fix: capitalize IP in help text (#​36170)
  • fix: upgrade deno_task_shell to 0.33.3 (#​36406)
  • fix: wire no-legacy-abort unstable flag from deno.json config (#​36312)
  • perf(core): run the common-path tick drain in Rust (#​36157)
  • perf(ext/node): bypass dns lookup on literal IPs in udp send (#​35909)
  • perf(ext/web): implement base64url encode/decode as simdutf ops (#​36398)
  • perf(fs): open files on the blocking pool in async readFile/writeFile (#​36160)
  • perf: order startup functions in release builds (#​36219)
  • perf: reduce eager module evaluation at startup (#​36331)
  • perf: remove Linux unwind tables from release artifacts (#​36265)
golang/go (go)

v1.27.1

Compare Source

v1.27.0

Compare Source

v1.26.8

Compare Source

v1.26.7

Compare Source

v1.26.6

Compare Source

nodejs/node (node)

v26.10.0: 2026-09-22, Version 26.10.0 (Current), @​aduh95

Compare Source

Notable Changes
Commits

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch from a6554ac to af78ec1 Compare July 29, 2026 15:51
@renovate renovate Bot changed the title chore(deps): update dependency uv to v0.12.0 chore(deps): update proto dependencies bump Jul 29, 2026
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 6 times, most recently from 654a4e5 to add218a Compare August 7, 2026 18:03
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 7 times, most recently from f068cc8 to f276336 Compare August 15, 2026 21:34
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 8 times, most recently from 72c16f6 to 591b76f Compare August 26, 2026 18:58
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 5 times, most recently from a61dfc9 to f3974ce Compare September 2, 2026 01:34
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 2 times, most recently from 74e3882 to 723e9f1 Compare September 4, 2026 08:57
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 7 times, most recently from 2cf584e to a0d0899 Compare September 11, 2026 06:08
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 7 times, most recently from 3d1df12 to 905e78d Compare September 18, 2026 20:02
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 5 times, most recently from ec35d3b to 1cc00ad Compare September 25, 2026 16:40
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch 4 times, most recently from 04b0222 to d9ec7c0 Compare October 1, 2026 15:12
@renovate
renovate Bot force-pushed the renovate/proto-dependencies-bump branch from d9ec7c0 to 0f84117 Compare October 2, 2026 01:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants